Update containerfiles #111

arewm · 2025-01-06T18:47:43Z

Changing parent image from Fedora to CentOS Stream to get a newer golang and unshare version before it is available in UBI
Updating labels on images to be more accurate

cgwalters

Only tangentially related to this, when I was looking at labels a while ago, I found that the OpenSUSE base images had clean and elegant metadata:

skopeo inspect -n docker://docker.io/opensuse/leap | jq .Labels
{
  "org.openbuildservice.disturl": "obs://build.opensuse.org/openSUSE:Leap:15.6:Images/images/25049cab88eae9e94c1aeac7a8f0aee7-opensuse-leap-image:docker",
  "org.opencontainers.image.created": "2024-09-19T19:48:27.536230874Z",
  "org.opencontainers.image.description": "Image containing a minimal environment for containers based on openSUSE Leap 15.6.",
  "org.opencontainers.image.source": "https://build.opensuse.org/package/show/openSUSE:Leap:15.6:Images/opensuse-leap-image?rev=25049cab88eae9e94c1aeac7a8f0aee7",
  "org.opencontainers.image.title": "openSUSE Leap 15.6 Base Container",
  "org.opencontainers.image.url": "https://www.opensuse.org/",
  "org.opencontainers.image.vendor": "openSUSE Project",
  "org.opencontainers.image.version": "15.6.5.643",
  "org.opensuse.base.created": "2024-09-19T19:48:27.536230874Z",
  "org.opensuse.base.description": "Image containing a minimal environment for containers based on openSUSE Leap 15.6.",
  "org.opensuse.base.disturl": "obs://build.opensuse.org/openSUSE:Leap:15.6:Images/images/25049cab88eae9e94c1aeac7a8f0aee7-opensuse-leap-image:docker",
  "org.opensuse.base.reference": "registry.opensuse.org/opensuse/leap:15.6.5.643",
  "org.opensuse.base.source": "https://build.opensuse.org/package/show/openSUSE:Leap:15.6:Images/opensuse-leap-image?rev=25049cab88eae9e94c1aeac7a8f0aee7",
  "org.opensuse.base.title": "openSUSE Leap 15.6 Base Container",
  "org.opensuse.base.url": "https://www.opensuse.org/",
  "org.opensuse.base.vendor": "openSUSE Project",
  "org.opensuse.base.version": "15.6.5.643",
  "org.opensuse.reference": "registry.opensuse.org/opensuse/leap:15.6.5.643"
}

cgwalters · 2025-01-06T19:00:00Z

Containerfile.buildah

+    org.label-schema.vendor="Konflux CI" \
+    org.opencontainers.image.vendor="Konflux CI" \
+    org.opencontainers.image.url="https://quay.io/konflux-ci/buildah" \
+    org.opencontainers.image.url="https://quay.io/konflux-ci/buildah" \


Why is this duplicated?
Also linking to quay seems redundant, anyone can infer that from where they find the image. If there's no actual web page for this I'd personally just drop the url here and keep .source.

The duplication was unintentional.

I included url because I saw it in other images, i.e.

$ skopeo inspect docker://quay.io/containers/buildah:latest | jq -e ".Labels" { "built.by.commit": "f27333ae1ff3efbc9e5a507bb44c90e3bacc937e", "built.by.digest": "sha256:113ae526992d1e4d777ecfb152085119d47d9ee32c2b6ffe2e25e16dbd3e953d", "built.by.exec": "containers_build_push.sh", "built.by.logs": "https://cirrus-ci.com/task/5416367588900864", "built.by.repo": "https://github.com/containers/image_build.git", "io.buildah.version": "1.35.4", "io.containers.capabilities": "CHOWN,DAC_OVERRIDE,FOWNER,FSETID,KILL,NET_BIND_SERVICE,SETFCAP,SETGID,SETPCAP,SETUID,CHOWN,DAC_OVERRIDE,FOWNER,FSETID,KILL,NET_BIND_SERVICE,SETFCAP,SETGID,SETPCAP,SETUID,SYS_CHROOT", "license": "MIT", "name": "fedora", "org.opencontainers.image.authors": "[email protected]", "org.opencontainers.image.created": "2025-01-06T15:21:22+00:00", "org.opencontainers.image.documentation": "https://github.com/containers/image_build/blob/f27333ae1ff3efbc9e5a507bb44c90e3bacc937e/buildah/README.md", "org.opencontainers.image.license": "MIT", "org.opencontainers.image.name": "fedora", "org.opencontainers.image.revision": "f27333ae1ff3efbc9e5a507bb44c90e3bacc937e", "org.opencontainers.image.source": "https://github.com/containers/image_build/blob/f27333ae1ff3efbc9e5a507bb44c90e3bacc937e/buildah/", "org.opencontainers.image.url": "https://quay.io/containers/buildah", "org.opencontainers.image.vendor": "Fedora Project", "org.opencontainers.image.version": "1.38.0", "vendor": "Fedora Project", "version": "41" }

* Changing parent image from Fedora to CentOS Stream to get a newer golang and unshare version before it is available in UBI * Updating labels on images to be more accurate Signed-off-by: arewm <[email protected]>

This infra has been flakier, so reducing the dependency on it (as well as the load). Signed-off-by: arewm <[email protected]>

tkdchen · 2025-01-16T04:40:43Z

Containerfile.image_build

-      distribution-scope="public" \
-      release="0" \
-      url="github.com/konflux-ci/buildah-container"
+      org.opencontainers.image.documentation="https://github.com/containers/image_build/blob/main/buildah/README.md"


It would be good to use OCI annotations consistently.

The CenOS Stream images use org.label-schema so I wanted to overwrite those. I don't think that we currently have the ability to set annotations on our builds. It would be handy if our buildah tasks would copy all labels to annotations though as that seems like it is a preferred pattern.

tkdchen · 2025-01-16T04:41:21Z

/retest

tkdchen · 2025-01-16T06:34:54Z

buildah-on-pull-request fails due to error: No package matches 'gpgme-devel'

cgwalters · 2025-01-17T01:23:16Z

buildah-on-pull-request fails due to error: No package matches 'gpgme-devel'

Yes in RHEL that's part of CRB - that repo needs to be enabled at build time.

And remove the old one which is just copied from within the buildah submodule. Signed-off-by: arewm <[email protected]>

arewm · 2025-01-17T05:20:24Z

Yeah, I had the CRB packages enabled locally, I just never go around to stashing them. This change still doesn't build as

    rpm --setcaps shadow-utils

fails in CentOS stream and the --exclude option doesn't exist for microdnf. I haven't gotten around to iterating on this further.

I guess I can probably exclude both of those?

$  podman run --rm -it --platform=linux/arm64 --privileged --user root  quay.io/centos/centos:stream10-minimal
Trying to pull quay.io/centos/centos:stream10-minimal...
Getting image source signatures
Copying blob sha256:3e447f1ca12a9262da5684920800658edf477d4dce11dd230257eef7b22cd8ea
Copying config sha256:4db09f2d37c37d6a940129042d1472fbaf2bad87b599d9075bb7e479f472cd69
Writing manifest to image destination
[root@e2103a0b0b5e /]# microdnf -y install shadow-utils
Downloading metadata...
Downloading metadata...
Downloading metadata...
Nothing to do.
[root@e2103a0b0b5e /]# rpm --setcaps shadow-utils
error: failed to open dir bs of /usr/share/locale/bs/LC_MESSAGES/: No such file or directory
error: shadow-utils-2:4.15.0-5.el10.aarch64: restored failed
[root@e2103a0b0b5e /]# microdnf install -y buildah --exclude container-selinux
error: Unknown option --exclude
[root@e2103a0b0b5e /]# microdnf install -y buildah
Package                                                                                                             Repository                                     Size
Installing:                                                                                                                                                            
 aardvark-dns-2:1.13.1-1.el10.aarch64                                                                               appstream                                  893.8 kB
 buildah-2:1.38.0-1.el10.aarch64                                                                                    appstream                                    9.8 MB
 containers-common-5:0.61.0-1.el10.noarch                                                                           appstream                                  149.2 kB
 containers-common-extra-5:0.61.0-1.el10.noarch                                                                     appstream                                    4.9 kB
 [...]```

arewm mentioned this pull request Jan 6, 2025

Use a fedora parent image #27

Merged

arewm force-pushed the update-containerfile branch from 511933d to f947964 Compare January 6, 2025 18:59

cgwalters reviewed Jan 6, 2025

View reviewed changes

arewm force-pushed the update-containerfile branch from f947964 to b1aa2d5 Compare January 6, 2025 19:38

Update containerfiles

6ff1502

* Changing parent image from Fedora to CentOS Stream to get a newer golang and unshare version before it is available in UBI * Updating labels on images to be more accurate Signed-off-by: arewm <[email protected]>

arewm force-pushed the update-containerfile branch 2 times, most recently from c08eb6d to 6f7eb08 Compare January 6, 2025 21:07

disable s390x builds for PRs

d0b9ea1

This infra has been flakier, so reducing the dependency on it (as well as the load). Signed-off-by: arewm <[email protected]>

arewm force-pushed the update-containerfile branch from 6f7eb08 to d0b9ea1 Compare January 6, 2025 21:12

tkdchen reviewed Jan 16, 2025

View reviewed changes

Update the proper buildah Containerfile

8dff7b4

And remove the old one which is just copied from within the buildah submodule. Signed-off-by: arewm <[email protected]>

arewm force-pushed the update-containerfile branch from e725b18 to 8dff7b4 Compare January 17, 2025 05:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update containerfiles #111

Update containerfiles #111

arewm commented Jan 6, 2025

cgwalters left a comment

cgwalters Jan 6, 2025

arewm Jan 6, 2025 •

edited

Loading

tkdchen Jan 16, 2025

arewm Jan 17, 2025

tkdchen commented Jan 16, 2025

tkdchen commented Jan 16, 2025

cgwalters commented Jan 17, 2025

arewm commented Jan 17, 2025

Update containerfiles #111

Are you sure you want to change the base?

Update containerfiles #111

Conversation

arewm commented Jan 6, 2025

cgwalters left a comment

Choose a reason for hiding this comment

cgwalters Jan 6, 2025

Choose a reason for hiding this comment

arewm Jan 6, 2025 • edited Loading

Choose a reason for hiding this comment

tkdchen Jan 16, 2025

Choose a reason for hiding this comment

arewm Jan 17, 2025

Choose a reason for hiding this comment

tkdchen commented Jan 16, 2025

tkdchen commented Jan 16, 2025

cgwalters commented Jan 17, 2025

arewm commented Jan 17, 2025

arewm Jan 6, 2025 •

edited

Loading