fix: proper usage of ostree container commit

[xynydev]

I was just reading the CoreOS documentation on OSTree Native Containers and saw this:

Using “ostree container commit”

In a container build, it’s a current best practice to invoke this at the end of each RUN instruction (or equivalent). This will verify compatibility of /var, and also clean up extraneous files in e.g. /tmp.

In the future, this command may perform more operations.

We should remove the additional RUN ostree container commit step, and instead add it to the end of each RUN command.

This was not an issue previously with the legacy template, as all the modules were run as a single layer.

Read more: ostreedev/ostree-rs-ext#159

[gmpinder]

So to do this would require some changes to the rpm-ostree caching since it resides in /var/run/rpm-ostree. I could try seeing if the commit is fine with having that in there, but if it isn't we would loose caching ability to do it this way.

[xynydev]

The cache shouldn't be in the image, ostee container commit checks the images compatibility. Is it possible to somehow unmount the cache, or should just an exception be added. It also might not be necessary to run this command, if our bind mounts clean things up already.

[gmpinder]

The cache shouldn't be in the image, ostee container commit checks the images compatibility. Is it possible to somehow unmount the cache, or should just an exception be added. It also might not be necessary to run this command, if our bind mounts clean things up already.

After some testing it wouldn't work with our config and module mounts either. We can either make use of a RUN ostree container commit after each module run or just have it at the end with the standard rm -fr /tmp/* /var/*.

[gmpinder]

NVM this seems to indicate that having an ostree container commit on its own wouldn't work

[gmpinder]

Actually it seems that using mounts is supported! https://github.com/ostreedev/ostree-rs-ext/blob/main/lib/src/commit.rs#L63

Also local testing seems to work with putting ostree container commit on the same line as module runs