Mukul SharmaandClaude Opus 5
2f80cfe288
build-tools is the image the pipeline's build pod runs its shell steps in. It was owned by devops-lib, which is an odd home: it is not library code, it is an artefact built by hand and pushed to Harbor, exactly like the mirrors here. devops-lib only ever referenced the result by tag, and it still will. Three deliberate changes from the homelab's version: - Pushed to base-images/build-tools:1, not homelab/. That project is public, so build pods pull it with no credentials — the same reason the language images live there. - FROM the mirrored docker:27-cli rather than Docker Hub, with that tag added to images.txt. Otherwise building the image that exists to remove a Docker Hub dependency would itself depend on Docker Hub. - yq is pinned instead of "releases/latest". An image that resolves a different yq on every build is not reproducible, and that is the kind of drift that surfaces months later as an unexplained pipeline failure. The README gains the build-and-push procedure: the same pod shape as the mirror, with the registry CA mounted into dind so the push is trusted, and DOCKER_BUILDKIT=0, since BuildKit wants to write state under /root/.docker where the push credentials get mounted read-only. Verified the three places that must agree do: images.txt, the README's inlined ConfigMap copy of it, and the Dockerfile's FROM tag. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
38 lines
1.8 KiB
Docker
38 lines
1.8 KiB
Docker
# The docker-cli image the pipeline's build pod runs its shell steps in.
|
|
#
|
|
# Bakes in everything the stages need — git, yq, bash, python3 with pip and
|
|
# venv for runHooks' python hooks, curl — so nothing is installed on demand
|
|
# on every single build. Installing tools per build was slow and, worse,
|
|
# quietly undermined reproducibility: a build's behaviour depended on
|
|
# whatever the package mirror served that morning.
|
|
#
|
|
# Lives here rather than in devops-lib because it is the same kind of thing
|
|
# as everything else in this repo: an image built by hand, occasionally,
|
|
# and pushed into Harbor for builds to pull. devops-lib only references the
|
|
# result by tag.
|
|
#
|
|
# Built and pushed manually — never by a Jenkins job, which would need this
|
|
# image to already exist in order to run. See README.md.
|
|
#
|
|
# Pushed to base-images, not homelab: that project is public, so build pods
|
|
# pull this with no credentials at all, which is the same reason the
|
|
# mirrored language images live there.
|
|
#
|
|
# The tag is pinned explicitly by devops-lib-gcp's dind-pod.yaml, so
|
|
# rebuilding this does not roll anything out until that pin is bumped too.
|
|
# Bump the tag when this file changes; do not overwrite an existing tag.
|
|
FROM harbor.35.238.248.203.nip.io/base-images/docker:27-cli
|
|
|
|
# Pinned rather than the homelab's "releases/latest": an image that resolves
|
|
# a different yq every time it is built is not reproducible, and this is
|
|
# exactly the sort of thing that changes under you months later. Bump it
|
|
# deliberately.
|
|
ARG YQ_VERSION=v4.44.3
|
|
|
|
RUN apk add --no-cache git bash python3 py3-pip py3-virtualenv curl \
|
|
&& curl -sL -o /usr/local/bin/yq \
|
|
"https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \
|
|
&& chmod +x /usr/local/bin/yq \
|
|
&& yq --version \
|
|
&& git --version
|