mward4
a6f8e67976
Build the image from the vendor vshell-https .deb on ubuntu:24.04 (required: GLIBC_2.38 / GLIBCXX_3.4.32). Contains the Dockerfile, the entrypoint that starts and supervises the three VShell daemons without systemd, the no-container-runtime build/validate/push tooling used to publish the image, and the vendored .deb (sha256 pinned). Published as gitea.milesward.dev/mward4/vshell:5.0.1-3985 and :latest. Manifest digest sha256:8b0ff00be981fa05f1e4a4e4ff5307b6c7e5e61b487d4fbe7e02fefb2a04659f.
56 lines
2.2 KiB
Bash
Executable File
56 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the vendor .deb into an extracted ubuntu:24.04 rootfs and prepare it as
|
|
# a container filesystem. This is the no-container-runtime build path used to
|
|
# produce the published image; with Docker/Podman use the Dockerfile instead.
|
|
#
|
|
# Usage: docker/install-rootfs.sh /path/to/rootfs
|
|
#
|
|
# The rootfs must be an extraction of the ubuntu:24.04 layer:
|
|
# tar -xzf /tmp/vshell-base/layer-00.tar -C "$ROOTFS" --numeric-owner
|
|
set -euo pipefail
|
|
|
|
ROOTFS=${1:?usage: install-rootfs.sh <rootfs>}
|
|
REPO=$(cd "$(dirname "$0")/.." && pwd)
|
|
DEB=$(ls "$REPO"/vendor/vshell-https-*.deb)
|
|
|
|
[ -d "$ROOTFS/usr/bin" ] || { echo "not an ubuntu rootfs: $ROOTFS" >&2; exit 1; }
|
|
|
|
cp "$DEB" "$ROOTFS/tmp/vshell.deb"
|
|
mkdir -p "$ROOTFS/tmp/stub"
|
|
printf '#!/bin/sh\necho "[systemctl stub] $*"\nexit 0\n' >"$ROOTFS/tmp/stub/systemctl"
|
|
chmod 0755 "$ROOTFS/tmp/stub/systemctl"
|
|
install -m 0755 "$REPO/docker/entrypoint.sh" "$ROOTFS/usr/local/bin/vshell-entrypoint"
|
|
|
|
# chroot into the rootfs. As an unprivileged user this needs a user namespace
|
|
# plus a bind-mounted /dev (mknod is not permitted inside one).
|
|
CHROOT_CMD='
|
|
export DEBIAN_FRONTEND=noninteractive PATH=/tmp/stub:$PATH
|
|
dpkg -i /tmp/vshell.deb
|
|
apt-get update -qq -o APT::Sandbox::User=root
|
|
apt-get install -y --no-install-recommends -o APT::Sandbox::User=root openssl
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*.deb
|
|
rm -rf /tmp/vshell.deb /tmp/stub
|
|
: > /etc/resolv.conf
|
|
rm -f /var/run/*.pid /var/lib/dpkg/lock* /usr/local/etc/vshelld_hostkey /usr/local/etc/vshelld_hostkey.pub /usr/local/etc/vshell-https.pem /usr/local/etc/vshell-https.p12
|
|
/usr/local/sbin/vshelld -version
|
|
'
|
|
# apt needs a resolv.conf and a /proc to work inside the chroot
|
|
cp /etc/resolv.conf "$ROOTFS/etc/resolv.conf"
|
|
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
mount -t proc proc "$ROOTFS/proc" || true
|
|
trap 'umount "$ROOTFS/proc" 2>/dev/null || true' EXIT
|
|
chroot "$ROOTFS" /bin/bash -c "$CHROOT_CMD"
|
|
else
|
|
unshare -rmpf --mount-proc="$ROOTFS/proc" sh -c '
|
|
rootfs=$1
|
|
for d in null zero random urandom tty; do
|
|
[ -e "$rootfs/dev/$d" ] || touch "$rootfs/dev/$d"
|
|
mount --bind "/dev/$d" "$rootfs/dev/$d"
|
|
done
|
|
chroot "$rootfs" /bin/bash -c "$2"
|
|
' sh "$ROOTFS" "$CHROOT_CMD"
|
|
fi
|
|
|
|
echo "rootfs ready: $ROOTFS"
|