Skip to content

Commit

Permalink
feat: rootfs - build/upload action and Dockerfile
Browse files Browse the repository at this point in the history
In order to facilitate Finch on Windows, we need a root filesystem. We
will use this Dockerfile as a basis for that root filesystem - using
`docker export` to turn a built container into an archived rootfs. For
the scope of these changes, create the Dockerfile and an action that
runs on changes to the file to build and push to ECR repo.

Signed-off-by: Gavin Inglis <[email protected]>
  • Loading branch information
ginglis13 committed Jul 21, 2023
1 parent f1e9aa4 commit 3079cc4
Show file tree
Hide file tree
Showing 2 changed files with 73 additions and 0 deletions.
43 changes: 43 additions & 0 deletions .github/workflows/rootfs.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
name: Build and Push Rootfs Docker Image

on:
push:
branches:
- main
paths:
- 'Dockerfile'
workflow_dispatch:

permissions:
# This is required for configure-aws-credentials to request an OIDC JWT ID token to access AWS resources later on.
# More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
id-token: write
contents: write

jobs:
build-rootfs-image:
runs-on: ubuntu-latest
steps:
- name: configure aws credentials
uses: aws-actions/configure-aws-credentials@v2
with:
aws-region: ${{ secrets.REGION }}
role-to-assume: ${{ secrets.ROLE }}
role-session-name: rootfs-ecr-image-upload-session

- name: checkout repo
uses: actions/checkout@v3
with:
fetch-depth: 0
persist-credentials: false

- name: Build, Tag, and Push Image
run: |
# create sha256 of the Dockerfile to use as tag
HASH=$(sha256sum Dockerfile | cut -d ' ' -f 1)
# make empty tempdir for build context
BUILDCTX=$(mktemp -d)
DOCKER_BUILDKIT=1 docker build -f Dockerfile -t ${{ secrets.ROOTFS_IMAGE_ECR_REPOSITORY_NAME }}:"$HASH" "$BUILDCTX"
docker tag ${{ secrets.ROOTFS_IMAGE_ECR_REPOSITORY_NAME }}:"$HASH" ${{ secrets.ROOTFS_IMAGE_ECR_REPOSITORY_NAME }}:"$HASH"
docker push ${{ secrets.ROOTFS_IMAGE_ECR_REPOSITORY_NAME }}:"$HASH"
30 changes: 30 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# syntax = docker/dockerfile:1.4
FROM public.ecr.aws/docker/library/fedora:38

# install necessary cloud-server packages
RUN dnf group install -y cloud-server-environment --exclude=plymouth* \
--exclude=geolite* \
--exclude=firewalld* \
--exclude=grub* \
--exclude=dracut* \
--exclude=shim-*

RUN systemctl enable cloud-init cloud-init-local cloud-config cloud-final

# enable systemd
# disabled network conf in cloud config
RUN <<EOF cat >> /etc/wsl.conf
[boot]
systemd=true
EOF

RUN <<EOF cat >> /etc/cloud/cloud.cfg
network:
config: disabled
EOF

# cleanup
RUN dnf clean all &&\
rm -f /etc/NetworkManager/system-connections/*.nmconnection && \
truncate -s 0 /etc/machine-id && \
rm -f /var/lib/systemd/random-seed

0 comments on commit 3079cc4

Please sign in to comment.