From 6a0ff34c9c57b87d037e44b6b67d0117da583c78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gabriel=20N=C3=BCtzi?= Date: Mon, 1 Apr 2024 20:16:38 +0000 Subject: [PATCH] bugfix: Correct some typos --- Containerfile | 9 ++++++++- root/setup.sh | 21 ++++++++++----------- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/Containerfile b/Containerfile index 419ea91..8288b40 100644 --- a/Containerfile +++ b/Containerfile @@ -24,7 +24,7 @@ ADD /home/ /home/ # an incompatible change be introduced. ARG RUNNER_VERSION=latest -# Permit building containers for alternate architectures. At the time +# Permit building containers for alternate architectures. At the time # of this commit, only 'arm64' is available. ARG TARGETARCH=amd64 @@ -45,8 +45,10 @@ ENTRYPOINT /lib/systemd/systemd # Gitlab-runner configuration options, may be freely overridden at # container image build time. ARG DEFAULT_JOB_IMAGE=registry.fedoraproject.org/fedora-minimal:latest + # Allow image-builders to override the Gitlab URL ARG GITLAB_URL=https://gitlab.com/ + # Run nested containers in --privileged mode - required to allow building # container images using podman or buildah. Otherwise may be set 'false'. ARG NESTED_PRIVILEGED=true @@ -72,17 +74,21 @@ LABEL register="podman run -it --rm \ -e DOCKER_NETWORK_MODE=host \ -e DOCKER_PRIVILEGED=${NESTED_PRIVILEGED} \ --entrypoint=/usr/bin/gitlab-runner \$IMAGE register" + # Additionally, the nested-podman storage volumes must be pre-created with # 'podman' UID/GID values to allow nested containers access. LABEL setupstorage="podman volume create --opt o=uid=1000,gid=1000 pipglr-storage" + # Lastly, the gitlab-runner will manage container-cache in this directory, # which will also be bind-mounted into every container. So it must be # writable by both 'podman' user and 'runner' group. LABEL setupcache="podman volume create --opt o=uid=1000,gid=1001 pipglr-cache" + # Helper to extract the current configuration secret to allow editing. LABEL dumpconfig="podman run -it --rm \ --secret config.toml --entrypoint=/bin/cat \ \$IMAGE /var/run/secrets/config.toml" + # Executing the runner container depends on the config.toml secret being # set (see above) and two volumes existing with correct permissions set. # Note: The contents of the volumes are not critical, they may be removed @@ -93,3 +99,4 @@ LABEL run="podman run -dt --name pipglr \ -v pipglr-cache:/cache \ --systemd true --privileged \ --device /dev/fuse \$IMAGE" +# ========================== diff --git a/root/setup.sh b/root/setup.sh index 70f2b36..1e851d6 100644 --- a/root/setup.sh +++ b/root/setup.sh @@ -1,4 +1,3 @@ - # This script is intended to be run during container-image build. Any # other usage outside this context is likely to cause harm. # @@ -29,11 +28,11 @@ done # Make image smaller by not installing docs. DNF="dnf --setopt=tsflags=nodocs -y" -for rpm in $(egrep -v '^(# )+' < /root/xpackages.txt); do - x+="--exclude=$rpm "; +for rpm in $(egrep -v '^(# )+' :65539` -echo -e "podman:1:999\npodman:1002:64536" | tee /etc/subuid > /etc/subgid +echo -e "podman:1:999\npodman:1002:64536" | tee /etc/subuid >/etc/subgid # Host volume mount necessary for nested-podman to use overlayfs2 for container & volume storage. mkdir -p /home/podman/.local/share/containers # Nested-container's local container-cache volume mount, recommended by gitlab-runner docs. @@ -103,8 +102,8 @@ touch /var/lib/systemd/linger/podman # Setup 'podman' socket and a container-storage pruning service for 'podman' user. mkdir -p /home/podman/.config/systemd/user/{sockets.target.wants,default.target.wants} cd /home/podman/.config/systemd/user/ -ln -s $PWD/podman.socket ./sockets.target.wants/ # Added from Containerfile -ln -s $PWD/prune.timer ./default.target.wants/ # also from Containerfile +ln -s $PWD/podman.socket ./sockets.target.wants/ # Added from Containerfile +ln -s $PWD/prune.timer ./default.target.wants/ # also from Containerfile # Substitute value from --build-arg if specified, otherwise use default from Containerfile. sed -i -e "s/@@@PRUNE_INTERVAL@@@/$PRUNE_INTERVAL/" ./prune.timer # Containerfile ADD instruction does not properly set ownership/permissions.