Containerfile.arch

# composefs-os:arch-latest — Base images for composefs-rs bootable Arch Linux systems.
#
# Three named targets are available (default: grub):
#   --target grub           GRUB-based boot (BLS Type 1)
#   --target uki            systemd-boot + UKI (BLS Type 2, cmdline embedded at build time)
#   --target uki-secureboot systemd-boot + UKI + Secure Boot signing tools
#
# Note: GRUB + Secure Boot is not supported — Arch does not ship a signed shim
# or signed grub EFI binary in official repos (shim-signed is AUR-only).
#
# Build:
#   podman build -t composefs-os:arch-latest        -f Containerfile.arch .          # GRUB
#   podman build -t composefs-os:arch-latest-uki    --target uki -f Containerfile.arch .
#   podman build -t composefs-os:arch-latest-uki-sb --target uki-secureboot -f Containerfile.arch .

# ---------------------------------------------------------------------------
# Stage 0a: Build cbootc
# ---------------------------------------------------------------------------
FROM rust:1-slim AS cbootc-builder
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
COPY src/ src/
RUN cargo build --release

# ---------------------------------------------------------------------------
# Stage 0b: Build composefs-rs tools (cfsctl + composefs-setup-root)
# ---------------------------------------------------------------------------
FROM rust:1-slim AS composefs-builder
RUN apt-get update && apt-get install -y git pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
WORKDIR /build
RUN git clone --depth=1 https://github.com/containers/composefs-rs .
RUN cargo build --release -p composefs-ctl && \
    cargo build --release -p composefs-setup-root --no-default-features

# ---------------------------------------------------------------------------
# Stage 1: Bootstrap Arch rootfs (common to all boot styles).
# Uses pacman --root instead of pacstrap to avoid chroot mounts that are
# unavailable in non-privileged container builds.  dracut --sysroot then
# builds the initramfs without needing a chroot either.
# ---------------------------------------------------------------------------
FROM archlinux:latest AS rootfs-common

RUN pacman -Sy --noconfirm --needed dracut

# Mask mkinitcpio alpm hooks before installing the kernel so pacman does
# not attempt to build a mkinitcpio initramfs.  Both hooks must be masked:
# 90 fires on kernel install, 60 fires on kernel removal.
RUN mkdir -p /rootfs/etc/pacman.d/hooks && \
    ln -sf /dev/null /rootfs/etc/pacman.d/hooks/90-mkinitcpio-install.hook && \
    ln -sf /dev/null /rootfs/etc/pacman.d/hooks/60-mkinitcpio-remove.hook

# pacman -r skips backup files (pacman.conf, mirrorlist) that already exist on
# the build host, so copy them explicitly before installing packages.
# The keyring is also required by pacman -r for signature verification.
RUN cp /etc/pacman.conf /rootfs/etc/pacman.conf && \
    cp /etc/pacman.d/mirrorlist /rootfs/etc/pacman.d/mirrorlist && \
    cp -a /etc/pacman.d/gnupg /rootfs/etc/pacman.d/ && \
    mkdir -p /rootfs/var/lib/pacman

RUN pacman -r /rootfs --noconfirm -Syu \
        base \
        linux linux-firmware \
        systemd dbus-broker \
        networkmanager iproute2 iputils \
        e2fsprogs dosfstools btrfs-progs \
        dracut \
        podman skopeo \
        vim less

# Refresh the keyring from the just-installed archlinux-keyring package.
# The builder snapshot (copied above) may be missing keys added after the
# archlinux:latest image was published; importing from the freshly-downloaded
# archlinux-keyring ensures derivative RUN pacman calls can verify all
# current developer signatures.
RUN gpg --homedir /rootfs/etc/pacman.d/gnupg --batch --no-permission-warning \
        --import /rootfs/usr/share/pacman/keyrings/archlinux.gpg && \
    grep -v '^#' /rootfs/usr/share/pacman/keyrings/archlinux-trusted | \
        grep -Ev '^[[:space:]]*$' | \
        awk '{print $0 ":6:"}' | \
        gpg --homedir /rootfs/etc/pacman.d/gnupg --batch --no-permission-warning \
            --import-ownertrust

# ---------------------------------------------------------------------------
# composefs dracut module (37composefs → module name 'composefs')
# ---------------------------------------------------------------------------
RUN mkdir -p /rootfs/usr/lib/dracut/modules.d/37composefs
COPY --from=composefs-builder \
    /build/target/release/composefs-setup-root \
    /rootfs/usr/lib/dracut/modules.d/37composefs/composefs-setup-root
RUN cat > /rootfs/usr/lib/dracut/modules.d/37composefs/module-setup.sh <<'EOF'
#!/usr/bin/bash
check() { return 0; }
depends() { return 0; }
install() {
    inst "${moddir}/composefs-setup-root" /bin/composefs-setup-root
    inst "${moddir}/composefs-setup-root.service" \
        "${systemdsystemunitdir}/composefs-setup-root.service"
    $SYSTEMCTL -q --root "${initdir}" add-wants \
        initrd-root-fs.target composefs-setup-root.service
}
EOF
RUN chmod +x /rootfs/usr/lib/dracut/modules.d/37composefs/module-setup.sh
RUN cat > /rootfs/usr/lib/dracut/modules.d/37composefs/composefs-setup-root.service <<'EOF'
[Unit]
DefaultDependencies=no
ConditionKernelCommandLine=composefs
ConditionPathExists=/etc/initrd-release
After=sysroot.mount
Requires=sysroot.mount
Before=initrd-root-fs.target
Before=initrd-switch-root.target
OnFailure=emergency.target
OnFailureJobMode=isolate

[Service]
Type=oneshot
ExecStart=/bin/composefs-setup-root
StandardInput=null
StandardOutput=journal
StandardError=journal+console
RemainAfterExit=yes
EOF

# Build initramfs using dracut --sysroot (no chroot or bind-mounts needed).
# Arch installs the kernel to /boot/vmlinuz-linux; copy it to the path
# expected by the cbootc image contract (/usr/lib/modules/<kver>/vmlinuz).
RUN KVER=$(ls /rootfs/usr/lib/modules/ | head -1) && \
    [ -n "$KVER" ] || { echo "ERROR: no kernel found in /rootfs/usr/lib/modules" >&2; exit 1; } && \
    dracut --sysroot /rootfs \
        --force --no-hostonly --kver "$KVER" \
        --tmpdir /tmp \
        --add "systemd systemd-initrd dbus base bash composefs" \
        --add-drivers "overlay erofs loop virtio_blk virtio_pci vfat" \
        --reproducible \
        "/rootfs/usr/lib/modules/$KVER/initramfs.img" && \
    cp /rootfs/boot/vmlinuz-linux /rootfs/usr/lib/modules/$KVER/vmlinuz

# ---------------------------------------------------------------------------
# Install cfsctl, cbootc, and update units.
# Enable services — symlinks land in /rootfs/etc/systemd (preserved in image).
# ---------------------------------------------------------------------------
COPY --from=composefs-builder /build/target/release/cfsctl /rootfs/usr/bin/cfsctl
COPY --from=cbootc-builder /build/target/release/cbootc /rootfs/usr/bin/cbootc
COPY units/cbootc-update.service units/cbootc-update.timer \
    /rootfs/usr/lib/systemd/system/

RUN systemctl --root /rootfs enable \
        dbus-broker.service \
        NetworkManager.service systemd-resolved.service cbootc-update.timer && \
    systemctl --root /rootfs set-default multi-user.target && \
    systemctl --root /rootfs mask systemd-firstboot.service

# ---------------------------------------------------------------------------
# composefs-required filesystem structure
# /sysroot — mount point for the underlying ext4 after switch_root
# /home /opt /srv — conventional symlinks into /var
# ---------------------------------------------------------------------------
RUN mkdir -p /rootfs/sysroot && \
    mkdir -p /rootfs/var/home /rootfs/var/opt /rootfs/var/srv && \
    rm -rf /rootfs/home /rootfs/opt /rootfs/srv && \
    ln -sf var/home /rootfs/home && \
    ln -sf var/opt  /rootfs/opt && \
    ln -sf var/srv  /rootfs/srv

# ---------------------------------------------------------------------------
# Stage 2a: GRUB — install grub and efibootmgr, clear /boot.
# At install time cbootc uses grub-mkstandalone to build the EFI binary from
# grub's module files (same code path as Ubuntu; Arch has 'grub', not 'grub2').
# ---------------------------------------------------------------------------
FROM rootfs-common AS rootfs-grub
# -S --needed installs only the listed packages without a full system upgrade.
# Avoid -Syu here: upgrading would install a newer kernel in /usr/lib/modules/
# without a matching initramfs (dracut ran in rootfs-common for the original
# kernel only), causing cfsctl prepare-boot to panic on the kernel-without-initramfs.
RUN pacman -r /rootfs --noconfirm -S --needed grub efibootmgr
RUN rm -rf /rootfs/boot/*

# ---------------------------------------------------------------------------
# Stage 2b: systemd-boot — add systemd-ukify, clear /boot.
# systemd-boot (bootctl) is included in the systemd package already installed
# in rootfs-common.
# ---------------------------------------------------------------------------
FROM rootfs-common AS rootfs-uki
RUN pacman -r /rootfs --noconfirm -S --needed systemd-ukify
RUN rm -rf /rootfs/boot/*

# ---------------------------------------------------------------------------
# Stage 2c: systemd-boot + Secure Boot — adds sbsigntools and openssl so
# cbootc can sign systemd-boot and UKIs with a self-generated key at install
# time.  No shim needed: firmware verifies against the UEFI Signature Database.
# ---------------------------------------------------------------------------
FROM rootfs-common AS rootfs-uki-sb
RUN pacman -r /rootfs --noconfirm -S --needed systemd-ukify sbsigntools openssl
RUN rm -rf /rootfs/boot/*

# ---------------------------------------------------------------------------
# Final stage: GRUB (default target, backward-compat)
# ---------------------------------------------------------------------------
FROM scratch AS grub
COPY --from=rootfs-grub /rootfs /

LABEL containers.bootc=1
LABEL composefs.backend=cfs-rs
LABEL org.opencontainers.image.title="Arch Linux CFS Base"
LABEL org.opencontainers.image.description="Base image for composefs-rs bootable Arch Linux systems (GRUB)"

CMD ["/sbin/init"]

# ---------------------------------------------------------------------------
# Final stage: UKI (--target uki)
# ---------------------------------------------------------------------------
FROM scratch AS uki
COPY --from=rootfs-uki /rootfs /

LABEL containers.bootc=1
LABEL composefs.backend=cfs-rs
LABEL cbootc.boot-style=uki
LABEL org.opencontainers.image.title="Arch Linux CFS Base (UKI)"
LABEL org.opencontainers.image.description="Base image for composefs-rs bootable Arch Linux systems (systemd-boot + UKI)"

CMD ["/sbin/init"]

# ---------------------------------------------------------------------------
# Final stage: UKI + Secure Boot (--target uki-secureboot)
# ---------------------------------------------------------------------------
FROM scratch AS uki-secureboot
COPY --from=rootfs-uki-sb /rootfs /

LABEL containers.bootc=1
LABEL composefs.backend=cfs-rs
LABEL cbootc.boot-style=uki-secureboot
LABEL org.opencontainers.image.title="Arch Linux CFS Base (UKI + Secure Boot)"
LABEL org.opencontainers.image.description="Base image for composefs-rs bootable Arch Linux systems (systemd-boot + UKI + Secure Boot)"

CMD ["/sbin/init"]