From 7032e8a7f833078d180ce47afa39364e0633ae84 Mon Sep 17 00:00:00 2001 From: gunnar Date: Wed, 10 Jun 2026 18:56:30 +0200 Subject: [PATCH] switch to buildah/chunkah --- .gitea/workflows/build.yml | 137 ++++++++++++++++++++++--------------- 1 file changed, 82 insertions(+), 55 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index cedf204..a3a7de6 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,9 +1,9 @@ name: Build container image on: - pull_request: - branches: - - main + #pull_request: + #branches: + #- main schedule: - cron: '05 12 * * 2,5' workflow_dispatch: @@ -30,7 +30,6 @@ jobs: steps: - name: Prepare environment run: | - # Extrahiert die reine Domain/Host (inkl. Port, falls vorhanden) aus der Gitea-URL REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}') OWNER_LOWER="${{ github.repository_owner }}" NAME_LOWER="${{ env.IMAGE_NAME }}" @@ -41,7 +40,7 @@ jobs: - name: Determine image tag run: | - BRANCH="${GITHUB_REF_NAME}" + BRANCH="$GITHUB_REF_NAME" if [[ "$BRANCH" == "main" ]]; then echo "IMAGE_TAG=${DEFAULT_TAG}" >> ${GITHUB_ENV} echo "IS_TEST_BUILD=false" >> ${GITHUB_ENV} @@ -52,16 +51,15 @@ jobs: fi - name: Checkout - uses: actions/checkout@v5 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + # Abgesichert: entspricht actions/checkout@v5.0.0 (oder aktuellste v5-Commit) + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0 - name: Image Metadata id: metadata - uses: docker/metadata-action@v5 + # Abgesichert: entspricht docker/metadata-action@v5.7.0 + uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 with: - images: ${{ env.REGISTRY_HOST }}/${{ github.repository }} + images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=raw,value=${{ env.IMAGE_TAG }} type=raw,value=${{ env.IMAGE_TAG }}.{{date 'YYYYMMDD'}},enable=${{ env.IS_TEST_BUILD == 'false' }} @@ -80,63 +78,91 @@ jobs: containers.bootc=1 ostree.bootable=1 - - name: Install Skopeo - run: | - sudo apt-get update - sudo apt-get install -y skopeo - - - name: Login to Gitea Container Registry + - name: Login to Gitea Container Registry (Buildah) if: github.event_name != 'pull_request' - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY_HOST }} - username: ${{ github.repository_owner }} - password: ${{ secrets.REGISTRY }} + run: | + echo "${{ secrets.REGISTRY }}" | buildah login -u "${{ github.repository_owner }}" --password-stdin ${{ env.REGISTRY_HOST }} - - name: Build Image Locally - uses: docker/build-push-action@v6 - id: build_image - with: - context: . - file: ./Containerfile - push: false # Docker baut nur, schiebt aber nichts hoch - load: true # Lädt das Image direkt in den lokalen Docker-Daemon des Runners - tags: ${{ steps.metadata.outputs.tags }} - labels: ${{ steps.metadata.outputs.labels }} + - name: 1. Build Base OS Image (Rootless) + run: | + LABEL_ARGS=() + while IFS= read -r line; do + if [[ -n "$line" ]]; then + LABEL_ARGS+=("--label" "$line") + fi + done <<< "${{ steps.metadata.outputs.labels }}" - - name: Push Image via Skopeo (Optimized Archive) + buildah bud \ + --storage-driver=overlay \ + --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \ + --format=oci \ + "${LABEL_ARGS[@]}" \ + -t localhost/fluffy-pancake:base \ + -f ./Containerfile \ + . + + - name: 2. Rechunk via Chunkah (Rootless) if: github.event_name != 'pull_request' env: GENERATED_TAGS: ${{ steps.metadata.outputs.tags }} run: | - # Die mehrzeiligen Tags in ein Bash-Array umwandeln + CHUNKAH_CONFIG_STR="$(podman inspect localhost/fluffy-pancake:base)" + # Chunkah ist hier bereits vorbildlich über seinen immutable SHA-256 Digest gepinnt! + CHUNKAH_REF="quay.io/coreos/chunkah:v0.6.0@sha256:ff8b8b466a942ec6000445d4001fc661e2fc5a952ad9ee29b4de9ab09d1d1708" + TAG_LIST=($GENERATED_TAGS) FIRST_TAG=${TAG_LIST[0]} - echo "Saving image ONCE via $FIRST_TAG to temporary tarball..." - docker save "$FIRST_TAG" -o image.tar + echo "Starte Re-Chunking für Haupt-Tag: $FIRST_TAG" + buildah build \ + --storage-driver=overlay \ + --storage-opt=overlay.mount_program=/usr/bin/fuse-overlayfs \ + --skip-unused-stages=false \ + --from localhost/fluffy-pancake:base \ + --build-arg "CHUNKAH=${CHUNKAH_REF}" \ + --build-arg "CHUNKAH_CONFIG_STR=${CHUNKAH_CONFIG_STR}" \ + --build-arg "CHUNKAH_ARGS=--max-layers 128 --prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-" \ + -t "$FIRST_TAG" \ + -v "$(pwd):/run/src" \ + --security-opt=label=disable \ + ./Containerfile.splitter - # Jetzt loopen wir NUR den Upload-Schritt über dieselbe Datei for tag in "${TAG_LIST[@]}"; do - echo "Pushing and converting $tag to clean OCI format..." - skopeo copy \ - --format oci \ - --dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \ - docker-archive:image.tar \ - docker://$tag + if [[ "$tag" != "$FIRST_TAG" ]]; then + echo "Zusätzliches Tag setzen: $tag" + buildah tag --storage-driver=overlay "$FIRST_TAG" "$tag" + fi done - # Am Ende sauber aufräumen - rm -f image.tar + rm -rf out - - name: Install envsubst dependencies + - name: 3. Push OCI Images directly if: github.event_name != 'pull_request' + env: + GENERATED_TAGS: ${{ steps.metadata.outputs.tags }} run: | - sudo apt-get update && sudo apt-get install -y gettext + TAG_LIST=($GENERATED_TAGS) + FIRST_TAG=${TAG_LIST[0]} + + echo "Pushe primäres Image und extrahiere Digest für Cosign..." + buildah push \ + --storage-driver=overlay \ + --digestfile primary_digest.txt \ + "$FIRST_TAG" + + echo "IMAGE_DIGEST=$(cat primary_digest.txt)" >> ${GITHUB_ENV} + + for tag in "${TAG_LIST[@]}"; do + if [[ "$tag" != "$FIRST_TAG" ]]; then + echo "Pushe zusätzliches Tag: $tag" + buildah push --storage-driver=overlay "$tag" + fi + done - name: Install Cosign if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@v4.1.2 + # Abgesichert: entspricht sigstore/cosign-installer@v3.8.1 (Stabile v3/v4-Basis) + uses: sigstore/cosign-installer@dc267600647854ebb7c40d274a033735887d9e44 # v3.8.1 - name: Sign container image if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' @@ -144,16 +170,17 @@ jobs: COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PASSWORD: "" run: | - IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" - - echo "Fetching digest for $IMAGE_REF..." - DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}') - - echo "Signing image with explicit Cosign v3 legacy bypass..." + echo "Signing image mit lokal extrahiertem Digest: ${{ env.IMAGE_DIGEST }}" cosign sign -y \ --key env://COSIGN_PRIVATE_KEY \ --use-signing-config=false \ --new-bundle-format=false \ --tlog-upload=false \ --registry-referrers-mode=legacy \ - "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" + "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.IMAGE_DIGEST }}" + + - name: Post-Build Cleanup + if: always() + run: | + echo "Bereinige unprivilegierten Buildah-Storage..." + buildah prune --storage-driver=overlay --force