# devops-base-images

One-time-setup repo for mirroring minimized base images into Harbor's
`base-images` project, so language builds (via `devops-lib`'s
`buildDocker.groovy` fallback templates) never depend on Docker Hub at
build time, and the images that actually ship are the leanest official
variant available for each language.

Not wired into any Jenkins pipeline — this is deliberately a manual,
occasional operation (re-run when `images.txt` changes: a new language,
a version bump, or picking up an upstream base-image update), using the
same one-off `kubectl`-based DinD pod pattern `devops-lib`'s
`build-tools.Dockerfile` bootstrap already uses, since the VM itself may
not have Docker installed directly.

## One-time setup

**1. Create the Harbor project** (public — these are just re-hosted
public images, no confidentiality concern, and public avoids needing any
pull credentials wired into every build):

Harbor UI → New Project → name `base-images` → check **Public** → Create.

Or via API:
```
curl -X POST -u admin:'<harbor admin password>' -H "Content-Type: application/json" \
  -d '{"project_name":"base-images","metadata":{"public":"true"}}' \
  "http://harbor.192.168.1.7.nip.io/api/v2.0/projects"
```

**2. Run the mirror**, via a throwaway DinD pod (same shape as the
`build-tools` image bootstrap):

```
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: base-images-mirror
  namespace: jenkins
data:
  images.txt: |
    golang:1.22-alpine golang:1.22-alpine
    alpine:3.20 alpine:3.20
    node:20-alpine node:20-alpine
    python:3.12-alpine python:3.12-alpine
    maven:3-eclipse-temurin-21-alpine maven:3-eclipse-temurin-21-alpine
    eclipse-temurin:21-jre-alpine eclipse-temurin:21-jre-alpine
    php:8.3-cli-alpine php:8.3-cli-alpine
  mirror.sh: |
    #!/bin/sh
    set -eu
    REGISTRY="harbor.192.168.1.7.nip.io"
    PROJECT="base-images"
    while read -r src target; do
        [ -z "$src" ] && continue
        case "$src" in \#*) continue ;; esac
        dest="${REGISTRY}/${PROJECT}/${target}"
        echo "=== ${src} -> ${dest} ==="
        docker pull "$src"
        docker tag "$src" "$dest"
        docker push "$dest"
    done < images.txt
    echo "=== done ==="
---
apiVersion: v1
kind: Pod
metadata:
  name: base-images-mirror
  namespace: jenkins
spec:
  restartPolicy: Never
  containers:
    - name: docker
      image: docker:27-dind
      securityContext:
        privileged: true
      args:
        - "--insecure-registry=harbor.192.168.1.7.nip.io"
      env:
        - name: DOCKER_TLS_CERTDIR
          value: ""
      volumeMounts:
        - name: docker-graph-storage
          mountPath: /var/lib/docker
    - name: docker-cli
      image: docker:27-cli
      command: ["cat"]
      tty: true
      env:
        - name: DOCKER_HOST
          value: tcp://localhost:2375
      volumeMounts:
        - name: mirror
          mountPath: /mirror
  volumes:
    - name: docker-graph-storage
      emptyDir: {}
    - name: mirror
      configMap:
        name: base-images-mirror
        defaultMode: 0755
EOF
```

**No `harbor-robot-dockerconfig` mount here on purpose** — that robot
account is scoped only to the `homelab` project (push+pull there
specifically); it has no grant on `base-images` at all, and making
`base-images` public only grants anonymous *pull*, never push. Push
always needs real credentials scoped to that project regardless. For a
one-off manual task like this, simplest is just logging in with your
Harbor admin account directly inside the pod, rather than provisioning
a whole new robot account for something run this rarely:

```
kubectl wait --for=condition=Ready pod/base-images-mirror -n jenkins --timeout=120s
kubectl exec -it -n jenkins base-images-mirror -c docker-cli -- sh -c '
  for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 2; done
  docker login harbor.192.168.1.7.nip.io
'
```
(enter your Harbor admin username/password when prompted)

```
kubectl exec -n jenkins base-images-mirror -c docker-cli -- sh -c '
  cd /mirror && sh mirror.sh
'
kubectl delete pod base-images-mirror -n jenkins
kubectl delete configmap base-images-mirror -n jenkins
```

**3. Verify:**
```
curl -s http://harbor.192.168.1.7.nip.io/v2/_catalog
```
Should list `base-images/golang`, `base-images/alpine`,
`base-images/node`, `base-images/python`,
`base-images/maven`, `base-images/eclipse-temurin`, `base-images/php`.

## Adding a new image / updating a version

Add a line to `images.txt`, commit, push, then re-run step 2 above (the
ConfigMap's `images.txt` needs updating to match — copy the current file
content in, same as the initial setup).