probox/arch-with-code-server/Containerfile at main · evertheylen/probox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
FROM archlinux:base-devel

# NAME = docker.io/evertheylen/arch-with-code-server

# Parts taken from https://github.com/containers/image_build/blob/main/podman/Containerfile

# Fresh build: podman build --no-cache -t docker.io/evertheylen/arch-with-code-server .
# Login to docker registry: podman login docker.io
# Deploy: podman push docker.io/evertheylen/arch-with-code-server

# ------------------------ Install stuff ------------------------

RUN pacman-key --init
RUN pacman -Sy --noconfirm archlinux-keyring
RUN pacman -Su --noconfirm

RUN useradd --create-home --system aurbuilder
RUN echo "aurbuilder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

RUN systemd-machine-id-setup

# Install paru from AUR (takes a relatively long time to compile)
RUN pacman -S --noconfirm git
RUN sudo -u aurbuilder bash -c "git clone https://aur.archlinux.org/paru.git /tmp/paru && cd /tmp/paru && makepkg -si --noconfirm" \
    && rm -rf /tmp/paru

# Install code-server (takes a bit of time to compile)
RUN sudo -u aurbuilder bash -c "paru -S --noconfirm code-server"

# System mgmt
RUN pacman -S --noconfirm pkgfile
# Podman (in podman)
RUN pacman -S --noconfirm podman fuse-overlayfs
# Terminal stuff
RUN pacman -S --noconfirm less nano fish ripgrep tree htop bat fzf tmux tree jq go-yq
# Databases
RUN pacman -S --noconfirm postgresql postgis pgcli
# Programming
RUN pacman -S --noconfirm python uv python-pexpect python-pillow python-poetry python-distutils-extra jedi-language-server python-jedi nodejs npm go jupyterlab clang rust-analyzer gopls shellcheck julia
# Debugging
RUN pacman -S --noconfirm strace valgrind gdb
# Network
RUN pacman -S --noconfirm openssh openvpn traceroute nmap wget tcpdump socat net-tools rsync rclone bind
# Various
RUN pacman -S --noconfirm zip unzip ffmpeg imagemagick man-db doctl

# Clean up
RUN pacman -Sc --noconfirm

# Problem while starting various systemd services (e.g. postgres):
#   postgresql.service: Failed to keep CAP_SYS_ADMIN: Operation not permitted
#   postgresql.service: Failed at step USER spawning /usr/bin/postgresql-check-db-dir: Operation not permitted
#
# Solution: systemd is requesting CAP_SYS_ADMIN and fails.
#   ProtectKernelModules=true
#   ProtectKernelTunables=true
#   PrivateDevices=true
#   RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
#   RestrictNamespaces=true
#   RestrictRealtime=true
#   SystemCallArchitectures=native
# This issue goes into more detail: https://github.com/systemd/systemd/issues/34565
RUN sed -i -E 's/^(ProtectKernelModules|ProtectKernelTunables|PrivateDevices|RestrictAddressFamilies|RestrictNamespaces|RestrictRealtime|SystemCallArchitectures)/# \1/' /usr/lib/systemd/system/postgresql.service

RUN npm install --global pnpm

RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
  touch /var/lib/shared/overlay-images/images.lock && \
  touch /var/lib/shared/overlay-layers/layers.lock && \
  touch /var/lib/shared/vfs-images/images.lock && \
  touch /var/lib/shared/vfs-layers/layers.lock


# ------------------------ Configs ------------------------

RUN pkgfile --update

RUN echo 'include /usr/share/nano/*.nanorc' >> /etc/nanorc

RUN mkdir -p /var/lib/systemd/linger

USER root
CMD [ "/sbin/init" ]

# LESSON LEARNED: do not set /etc/containers/storage.conf
# let podman decide what is best, and performance becomes near-native
# However, do provide mounts into the host filesystem for graphRoot! (user and system)

# Like quay.io/podman/stable (comments removed)
#
# IMPORTANT (podman v6): the config file lookup changed! Only the *single* highest-precedence
# main containers.conf is loaded (user > /etc > /usr/share), so a main file in /etc would be
# silently ignored whenever ~/.config/containers/containers.conf exists. Drop-in directories
# (containers.conf.d) are always merged, so we use one of those instead.
# See https://github.com/containers/container-libs/blob/main/common/docs/containers-config.5.md
#
# Also (podman v6 / buildah 1.44): `build` now mounts an overlay over the build context
# (buildah#5975), with upper/work dirs in $TMPDIR (default /var/tmp). Inside this container
# /var/tmp is on overlayfs, and overlayfs-on-overlayfs upperdir = EINVAL. Setting
# image_copy_tmp_dir="storage" puts it in the storage graph root, which probox mounts from
# the host filesystem. NOTE: buildah does not create <graphroot>/tmp itself, so probox.py
# pre-creates it in the volume.
#
# Additionally, utsns="host" is required for `build`: with a private UTS namespace buildah/crun
# now call sethostname(), which the *outer* container's seccomp profile denies (EPERM) because
# the probox container has no CAP_SYS_ADMIN.
RUN mkdir -p /etc/containers/containers.conf.d && cat <<EOF >/etc/containers/containers.conf.d/50-probox-pinp.conf
[containers]
netns="host"
userns="host"
ipcns="host"
utsns="host"
cgroupns="host"
cgroups="disabled"
log_driver = "k8s-file"

[engine]
cgroup_manager = "cgroupfs"
events_logger="file"
runtime="crun"
image_copy_tmp_dir="storage"

EOF

# Also for rootless PINP, make pings work
RUN setcap cap_setuid,cap_setgid=eip /usr/sbin/newuidmap &&\
  setcap cap_setuid,cap_setgid=eip /usr/sbin/newgidmap &&\
  setcap cap_net_raw+p $(which ping)

COPY ./setup-user.sh /usr/bin/setup-user.sh
COPY ./start-shell.sh /usr/bin/start-shell.sh
RUN chmod +x /usr/bin/start-shell.sh /usr/bin/setup-user.sh

LABEL probox.setup_user="/usr/bin/setup-user.sh"
LABEL probox.start_shell="/usr/bin/start-shell.sh"