Dockerfile.template 1.63 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
# We're using a multistage Docker build here in order to allow us to release a self-verifying
# Docker image when built on the official Docker infrastructure.
# They require us to verify the source integrity in some way while making sure that this is a
# reproducible build.
# See https://github.com/docker-library/official-images#image-build
# In order to achieve this, we externally host the rootfs archives and their checksums and then
# just download and verify it in the first stage of this Dockerfile.
# The second stage is for actually configuring the system a little bit.
# Some templating is done in order to allow us to easily build different configurations and to
# allow us to automate the releaes process.
hashworks's avatar
hashworks committed
11
FROM alpine:3.12 AS verify
12
COPY TEMPLATE_ROOTFS_FILE /
13
RUN apk add --no-cache curl bash
14
SHELL ["/bin/bash", "-c"]
hashworks's avatar
hashworks committed
15
RUN ROOTFS="$(curl -sOJL --continue-at - -w "%{filename_effective}" TEMPLATE_ROOTFS_URL)" && \
16
17
    sha256sum -c <<< "TEMPLATE_ROOTFS_HASH" && \
    mkdir /rootfs && \
hashworks's avatar
hashworks committed
18
    tar -C /rootfs --extract --file "${ROOTFS}"
19

20
FROM scratch AS root
21
COPY --from=verify /rootfs/ /
22

23
# manually run all alpm hooks that can't be run inside the fakechroot
Sven-Hendrik Haase's avatar
Sven-Hendrik Haase committed
24
RUN ldconfig && update-ca-trust && locale-gen
25
26
RUN sh -c 'ls usr/lib/sysusers.d/*.conf | /usr/share/libalpm/scripts/systemd-hook sysusers '

27
28
29
# update /etc/os-release
RUN ln -s /usr/lib/os-release /etc/os-release

30
# initialize the archlinux keyring, but discard any private key that may be shipped.
Sven-Hendrik Haase's avatar
Sven-Hendrik Haase committed
31
RUN pacman-key --init && pacman-key --populate archlinux && bash -c "rm -rf etc/pacman.d/gnupg/{openpgp-revocs.d/,private-keys-v1.d/,pubring.gpg~,gnupg.S.}*"
32

33
ENV LANG=en_US.UTF-8
Pierre Schmitz's avatar
Pierre Schmitz committed
34
CMD ["/usr/bin/bash"]