Containerfile.base

FROM docker.io/archlinux/archlinux:latest AS bootc-builder

ARG BOOTC_VERSION=v1.17.1

# Arch does not yet package bootc. Build one pinned upstream release in an
# isolated stage so no compiler, source tree, or build-only account reaches
# the operating-system image.
RUN sed -i '/^[[:space:]]*DownloadUser[[:space:]]/d' /etc/pacman.conf

RUN --mount=type=cache,dst=/root/.cargo/registry \
    --mount=type=cache,dst=/root/.cargo/git \
    pacman -Syu --needed --noconfirm \
        git \
        glib2 \
        go-md2man \
        make \
        ostree \
        pkgconf \
        rust

WORKDIR /tmp/bootc
# Upstream's release profile enables thin LTO and full debug info. The final
# bootc link can exceed the memory available to rootless Podman and be killed
# by the host OOM killer. These binaries are stripped below, so omit both and
# serialize rustc jobs to keep peak build memory bounded.
ENV CARGO_BUILD_JOBS=1 \
    CARGO_PROFILE_RELEASE_DEBUG=0 \
    CARGO_PROFILE_RELEASE_LTO=false
# bootc 1.17 turned SELinux into a default cargo feature that links libselinux,
# which Arch does not package. Build with upstream's documented feature set for
# non-SELinux distributions; bootc then treats SELinux as disabled on the host,
# which is already the case on Arch.
RUN git clone --branch "${BOOTC_VERSION}" --depth 1 \
        https://github.com/bootc-dev/bootc.git . && \
    make bin install-all DESTDIR=/output \
        CARGO_OPTIONS='--no-default-features --features "install-to-disk pre-6.15"'

# install-all also emits bootc's development integration-test executable and
# keeps full Rust debug sections. Neither belongs in the deployed OS image.
RUN rm -f /output/usr/bin/bootc-integration-tests && \
    strip --strip-unneeded \
        /output/usr/bin/bootc \
        /output/usr/bin/system-reinstall-bootc

FROM docker.io/archlinux/archlinux:latest AS system

COPY --from=bootc-builder /output /

# Keep pacman's mutable database and cache outside the image-managed /usr
# deployment. This follows bootcrew/mono's Arch base design and keeps pacman
# usable inside an explicit `bootc usr-overlay`.
RUN grep "= */var" /etc/pacman.conf | \
        sed "/= *\/var/s/.*=// ; s/ //" | \
        xargs -n1 sh -c \
            'mkdir -p "/usr/lib/sysimage/$(dirname "$(printf %s "$1" | sed "s@/var/@@")")"; mv -v "$1" "/usr/lib/sysimage/$(printf %s "$1" | sed "s@/var/@@")"' '' && \
    sed -i \
        -e "/= *\/var/ s/^#//" \
        -e "s@= */var@= /usr/lib/sysimage@g" \
        -e "/DownloadUser/d" \
        /etc/pacman.conf

RUN --mount=type=tmpfs,dst=/tmp \
    --mount=type=cache,dst=/usr/lib/sysimage/cache/pacman \
    pacman -Syu --needed --noconfirm \
        base \
        base-devel \
        btrfs-progs \
        bubblewrap \
        networkmanager \
        cargo \
        go-md2man \
        gcc-libs \
        glib2 \
        glibc \
        openssl \
        ostree \
        zlib \
        zstd \
        cargo \
        cpio \
        cryptsetup \
        dbus \
        dosfstools \
        dracut \
        e2fsprogs \
        glib2 \
        linux \
        ostree \
        shadow \
        skopeo \
        podman \
        buildah \
        systemd \
        tpm2-tools \
        tpm2-tss

RUN chmod 4755 /usr/bin/newuidmap && \
    chmod 4755 /usr/bin/newgidmap

# bootc 1.17's runtime-deps lint requires a chcon executable in the image. Arch
# builds coreutils without SELinux, so chcon is not shipped. bootc itself only
# runs chcon on hosts where SELinux is enabled, which a build without the
# selinux feature never reports, so this stub is never executed. It mirrors what
# coreutils' chcon does when SELinux support is compiled out: fail with an error.
RUN printf '%s\n' \
        '#!/bin/sh' \
        'echo "chcon: SELinux is not supported on this system" >&2' \
        'exit 1' \
        > /usr/bin/chcon && \
    chmod 0755 /usr/bin/chcon

RUN install -d /usr/lib/dracut/dracut.conf.d && \
    printf '%s\n' \
        'systemdsystemconfdir=/etc/systemd/system' \
        'systemdsystemunitdir=/usr/lib/systemd/system' \
        > /usr/lib/dracut/dracut.conf.d/30-archlinux-bootc-module.conf && \
    printf '%s\n' \
        'reproducible=yes' \
        'hostonly=no' \
        'compress=zstd' \
        'add_dracutmodules+=" ostree bootc crypt dm btrfs tpm2-tss "' \
        > /usr/lib/dracut/dracut.conf.d/30-archlinux-bootc-container-build.conf && \
    kernel_dir="$(find /usr/lib/modules -mindepth 1 -maxdepth 1 -type d | sort -V | tail -1)" && \
    test -n "$kernel_dir" && \
    dracut --force "${kernel_dir}/initramfs.img"

RUN sed -i 's|^HOME=.*|HOME=/var/home|' /etc/default/useradd && \
    printf 'uninitialized\n' > /etc/machine-id && \
    systemctl mask systemd-firstboot.service && \
    rm -rf \
        /boot \
        /home \
        /root \
        /tmp \
        /usr/local \
        /srv \
        /opt \
        /mnt \
        /var \
        /usr/lib/sysimage/log \
        /usr/lib/sysimage/cache/pacman/pkg && \
    find /run -mindepth 1 -maxdepth 1 ! -name .containerenv -exec rm -rf -- {} + && \
    install -d /sysroot /boot /run /usr/lib/ostree /var && \
    install -d -m 1777 /tmp && \
    ln -sT sysroot/ostree /ostree && \
    ln -sT var/roothome /root && \
    ln -sT var/srv /srv && \
    ln -sT var/opt /opt && \
    ln -sT var/mnt /mnt && \
    ln -sT var/home /home && \
    ln -sT ../var/usrlocal /usr/local && \
    printf '%s\n' \
        'd /var/opt 0755 root root -' \
        'd /var/home 0755 root root -' \
        'd /var/srv 0755 root root -' \
        'd /var/mnt 0755 root root -' \
        'd /var/usrlocal 0755 root root -' \
        'd /var/roothome 0700 root root -' \
        'd /run/media 0755 root root -' \
        > /usr/lib/tmpfiles.d/bootc-base-dirs.conf && \
    printf '%s\n' \
        '[composefs]' \
        'enabled = yes' \
        '[sysroot]' \
        'readonly = true' \
        > /usr/lib/ostree/prepare-root.conf

LABEL containers.bootc=1
LABEL org.opencontainers.image.source="https://github.com/oci-native/archlinux"

RUN bootc container lint --fatal-warnings