Mukul SharmaandClaude Opus 5
2f80cfe288
build-tools is the image the pipeline's build pod runs its shell steps in. It was owned by devops-lib, which is an odd home: it is not library code, it is an artefact built by hand and pushed to Harbor, exactly like the mirrors here. devops-lib only ever referenced the result by tag, and it still will. Three deliberate changes from the homelab's version: - Pushed to base-images/build-tools:1, not homelab/. That project is public, so build pods pull it with no credentials — the same reason the language images live there. - FROM the mirrored docker:27-cli rather than Docker Hub, with that tag added to images.txt. Otherwise building the image that exists to remove a Docker Hub dependency would itself depend on Docker Hub. - yq is pinned instead of "releases/latest". An image that resolves a different yq on every build is not reproducible, and that is the kind of drift that surfaces months later as an unexplained pipeline failure. The README gains the build-and-push procedure: the same pod shape as the mirror, with the registry CA mounted into dind so the push is trusted, and DOCKER_BUILDKIT=0, since BuildKit wants to write state under /root/.docker where the push credentials get mounted read-only. Verified the three places that must agree do: images.txt, the README's inlined ConfigMap copy of it, and the Dockerfile's FROM tag. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
33 lines
1.6 KiB
Plaintext
33 lines
1.6 KiB
Plaintext
# Manifest of base images mirrored into Harbor's base-images project.
|
|
# One line each: <source image on Docker Hub> <target name:tag under base-images>
|
|
#
|
|
# All chosen as the leanest official variant that still keeps a shell +
|
|
# package manager (not distroless — deliberate choice: homelab
|
|
# debuggability via kubectl exec matters more here than the last bit of
|
|
# attack-surface reduction). go/alpine were already minimal and are
|
|
# mirrored unchanged; node/python/java/php all moved from their
|
|
# Debian-slim (or, for php, full Apache+Debian) default to an Alpine
|
|
# equivalent.
|
|
#
|
|
# Re-run mirror.sh after editing this file to add a language/version or
|
|
# pick up a base image update — nothing here happens automatically.
|
|
|
|
golang:1.22-alpine golang:1.22-alpine
|
|
# quant-agent needs 1.24: the Anthropic Go SDK declares go 1.24 in its
|
|
# module, and a 1.22 toolchain refuses to build a module requiring a
|
|
# newer language version. Kept alongside 1.22 rather than replacing it,
|
|
# so the existing demo apps keep building against the version they were
|
|
# proven on.
|
|
golang:1.24-alpine golang:1.24-alpine
|
|
alpine:3.20 alpine:3.20
|
|
node:20-alpine node:20-alpine
|
|
python:3.12-alpine python:3.12-alpine
|
|
maven:3-eclipse-temurin-21-alpine maven:3-eclipse-temurin-21-alpine
|
|
eclipse-temurin:21-jre-alpine eclipse-temurin:21-jre-alpine
|
|
php:8.3-cli-alpine php:8.3-cli-alpine
|
|
# Not a language runtime: this is what build-tools.Dockerfile builds FROM.
|
|
# Mirrored for the same reason as everything else here — so building the
|
|
# build image does not depend on Docker Hub either. Keep the tag in step
|
|
# with the FROM line in build-tools.Dockerfile.
|
|
docker:27-cli docker:27-cli
|