kevinveenbirkenbachandClaude Opus 4.7
b34131ca1d
Brings up the package-cache compose service alongside the existing
registry-cache, gated by the same `cache` profile. Bootstrap helper
(scripts/docker/cache/package.sh) auto-rotates the admin password from
the well-known default, accepts the Sonatype CE EULA (3.71+ blocks
artifact downloads with HTTP 403 until /v1/system/eula is POSTed —
disclaimer must be sent verbatim with its unicode quotes), enables
anonymous read, creates one default blobstore, and registers the MVP
proxy set: apt-debian, apt-ubuntu, pypi-proxy, npm-proxy, helm-bitnami,
raw-githubusercontent. The runner gets pip.conf / .npmrc /
sources.list snippets bind-mounted in (each defaulting to /dev/null
when the cache profile is inactive) so the deploy is byte-identical
with cache off.
Cache plumbing:
- scripts/meta/env/cache/{registry,package}.sh: per-cache env defaults,
hostname-derived admin password seed (uses `hostname` command, not
$HOSTNAME shell var, so the value is identical across interactive
shells, non-interactive subshells, and Python subprocesses).
- scripts/docker/cache/{registry-ca,package}.sh: container-side
bootstrap helpers, both moved under scripts/docker/cache/.
- scripts/system/cache/clean.sh + `make cache-clean`: wipes both
/var/cache/infinito/core/cache/{registry,package} dirs and stops
the cache containers.
- cli/deploy/development/compose.py: Profile gate exports the three
new INFINITO_PACKAGE_CACHE_* client-snippet paths and runs the
bootstrap helper after the package-cache reports healthy.
Compose service uses sonatype/nexus3:3.91.1-ubi pinned, runs as
root (UBI image refuses to chown a fresh bind-mount), and forces
NEXUS_SECURITY_RANDOMPASSWORD=false so the bootstrap can log in with
admin/admin123 before rotating; the random-password mode otherwise
auto-completes onboarding silently and leaves no readable secret on
disk for an automated bootstrap to pick up.
Tests: tests/unit/cli/deploy/development/test_compose.py grows two
new assertions (cache services listed in `up` args when local; build
tests pin CI=true to retain ci-only assertions).
Closes req-012.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Docker Runner Scripts 🐳
Shell helpers that run inside the infinito runner container defined by
the top-level compose.yml. They cover container
lifecycle (entry, healthcheck) and integration with peer compose
services (e.g. the registry-cache pull-through proxy).
Scope 📋
- This directory MUST contain only scripts that execute inside the
infinitocontainer, either as the container entrypoint, as a DockerHEALTHCHECK, or as asystemdunit hook. - This directory MUST NOT host host-side tooling. Scripts that run on
the developer or CI host belong under their workflow-specific path
(for example
scripts/tests/,scripts/image/,scripts/meta/). - This directory MUST NOT host application logic that belongs to an Ansible role.
Bind-mounted scripts 🔗
A script that is bind-mounted from this directory into a fixed in-container path (see compose.yml) MUST keep its git executable bit, because Docker bind-mounts preserve host file permissions and the in-container caller (systemd, dockerd, the entrypoint) cannot recover from a non-executable mount.
When a new script is added with a bind-mount target, its purpose and
in-container target path SHOULD be documented at the call site (the
matching compose/<service>/ README, or compose.yml.md).
Distro portability 🌐
A script in this directory MUST work across every distro variant that
the runner image is built for (currently Debian, Ubuntu, Arch, Fedora,
CentOS). Tool availability differs across these variants, so a script
SHOULD branch on command -v <tool> rather than on distro IDs.