mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5.5
4e060767f1
CentOS jobs also die on "Failed to download metadata for repo 'epel': Cannot download repomd.xml ... All mirrors were tried" (feature/store-i18n run 39658756830, Baserow#0 and Nextcloud#8 aarch64): the failing host's librepo log shows mirrors that answered and then failed the checksum the metalink expects, the stale-metalink signature already pinned away for the CentOS Stream repos, plus TLS errors from two mirrors. centos_mirror.sh now also rewrites the EPEL repo files: each section's own commented `#baseurl=https://download.example/pub/epel/...` template becomes the baseurl on dl.fedoraproject.org and the Fedora metalink line goes. Using the file's template keeps the path variables of whichever epel-release is installed (`$releasever${stream:+s}` on CentOS Stream, `releasever_minor` in newer releases). A file whose metalinks lack that template stops the script with an error instead of losing its source. The Dockerfile runs the script again right after scripts/install/filesystem.sh. Its first run precedes the EPEL install (filesystem.sh adds epel-release for btrfs-progs), so the image shipped an unpinned epel.repo, and the failing call, sys-svc-ssh's OpenSSH install, runs before roles/update/tasks/centos.yml pins anything. On CentOS Stream the template resolves to epel/10s/, which on dl.fedoraproject.org serves the same aarch64 repomd.xml as epel/10.4/, the only path the epel-10s metalink lists. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
84 lines
3.6 KiB
Docker
84 lines
3.6 KiB
Docker
# Base image (pkgmgr) selector. SPOT lives in default.env's
|
|
# INFINITO_PARENT_IMAGE and is forwarded as a build arg by compose.yml /
|
|
# scripts/image/build.sh.
|
|
# Example values:
|
|
# INFINITO_PARENT_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch:stable
|
|
ARG INFINITO_PARENT_IMAGE
|
|
FROM ${INFINITO_PARENT_IMAGE} AS full
|
|
|
|
ARG NIX_CONFIG
|
|
|
|
ARG INFINITO_SRC_DIR
|
|
ENV INFINITO_SRC_DIR=${INFINITO_SRC_DIR}
|
|
ARG INFINITO_VENV_DIR
|
|
ENV INFINITO_VENV_DIR=${INFINITO_VENV_DIR}
|
|
ENV PYTHON="${INFINITO_VENV_DIR}/bin/python"
|
|
ENV PIP="${INFINITO_VENV_DIR}/bin/python -m pip"
|
|
ENV PATH="${INFINITO_VENV_DIR}/bin:${PATH}"
|
|
|
|
# hadolint DL4006: ensure pipefail is set for RUN instructions that use pipes
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-lc"]
|
|
|
|
RUN set -euo pipefail; \
|
|
cat /etc/os-release || true; \
|
|
if [ -f /etc/nix/nix.conf ]; then \
|
|
grep -q '^accept-flake-config *= *true' /etc/nix/nix.conf || \
|
|
echo 'accept-flake-config = true' >> /etc/nix/nix.conf; \
|
|
fi
|
|
|
|
COPY default.env ${INFINITO_SRC_DIR}/default.env
|
|
COPY scripts/install ${INFINITO_SRC_DIR}/scripts/install
|
|
COPY roles/dev-python/files/shell ${INFINITO_SRC_DIR}/roles/dev-python/files/shell
|
|
COPY roles/update/files/shell/centos_mirror.sh ${INFINITO_SRC_DIR}/roles/update/files/shell/centos_mirror.sh
|
|
COPY requirements ${INFINITO_SRC_DIR}/requirements
|
|
COPY utils/__init__.py ${INFINITO_SRC_DIR}/utils/__init__.py
|
|
COPY utils/install/__init__.py ${INFINITO_SRC_DIR}/utils/install/__init__.py
|
|
COPY utils/install/collections.py ${INFINITO_SRC_DIR}/utils/install/collections.py
|
|
|
|
# hadolint ignore=DL3008,DL3033,DL3041,SC1090,SC3040
|
|
RUN set -euo pipefail; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/roles/update/files/shell/centos_mirror.sh"; \
|
|
source <(grep -hE '^INFINITO_PYTHON_INSTALL_SCRIPT=' "${INFINITO_SRC_DIR}/default.env"); \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PYTHON_INSTALL_SCRIPT:?}" ensure; \
|
|
VENV="${INFINITO_VENV_DIR}" bash "${INFINITO_SRC_DIR}/scripts/install/venv.sh"; \
|
|
${PIP} install --upgrade pip setuptools wheel; \
|
|
${PIP} install ansible PyYAML; \
|
|
ANSIBLE_COLLECTIONS_DIR="${HOME}/.ansible/collections" \
|
|
bash "${INFINITO_SRC_DIR}/scripts/install/ansible.sh"
|
|
|
|
COPY . ${INFINITO_SRC_DIR}
|
|
|
|
# hadolint ignore=DL3008,DL3033,DL3041,SC1090
|
|
RUN set -euo pipefail; \
|
|
source <(grep -hE '^INFINITO_((PYTHON|DOCKER_CLI|PACKAGE|FILESYSTEM|INTERPRETERS)_INSTALL_SCRIPT|APT_UBUNTU_MIRRORS)=' "${INFINITO_SRC_DIR}/default.env"); \
|
|
INFINITO_APT_UBUNTU_MIRRORS="${INFINITO_APT_UBUNTU_MIRRORS:?}" /bin/bash "${INFINITO_SRC_DIR}/scripts/install/apt-mirrors.sh"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PYTHON_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_DOCKER_CLI_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PACKAGE_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_FILESYSTEM_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/roles/update/files/shell/centos_mirror.sh"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_INTERPRETERS_INSTALL_SCRIPT:?}"
|
|
|
|
RUN set -euo pipefail; \
|
|
systemctl mask systemd-firstboot.service first-boot-complete.target || true; \
|
|
systemd-machine-id-setup || true
|
|
|
|
ENV container=docker
|
|
STOPSIGNAL SIGRTMIN+3
|
|
|
|
# hadolint ignore=SC3040
|
|
RUN set -euo pipefail; \
|
|
export NIX_CONFIG="${NIX_CONFIG:-}"; \
|
|
"${INFINITO_SRC_DIR}/scripts/docker/entry.sh" --compile -- true
|
|
|
|
WORKDIR /
|
|
|
|
COPY scripts/docker/healthcheck.sh /usr/local/bin/healthcheck.sh
|
|
RUN chmod +x /usr/local/bin/healthcheck.sh
|
|
HEALTHCHECK --interval=5s --timeout=20s --start-period=30s --retries=20 \
|
|
CMD ["/usr/local/bin/healthcheck.sh"]
|
|
|
|
ENTRYPOINT ["/bin/bash", "-c", "exec \"${INFINITO_SRC_DIR}/scripts/docker/entry.sh\" \"$@\"", "--"]
|
|
|
|
CMD ["/sbin/init"]
|