Dockerfile.e2e-node

# Dockerfile.e2e-node -- a kind-style "systemd-as-PID1 node container" for the
# provider-kubernetes e2e harness (ADR-13, slice E2).
#
# It FROM-derives a built kairos-kubeadm image so it REUSES the
# checksum-verified toolchain (kubeadm / kubelet / kubectl / containerd / runc /
# CNI) already baked there -- nothing is re-downloaded here. We only add the
# tweaks a real kubeadm+kubelet+containerd need to run inside a privileged
# container on cgroup v2 with the systemd cgroup driver, mirroring the
# upstream-blessed kind node-image pattern.
#
# Build (via the Makefile, which sets BASE_IMAGE for you):
#   make e2e-node-image KUBERNETES_VERSION=v1.34.0
# or directly:
#   docker build \
#     --build-arg BASE_IMAGE=kairos-kubeadm:v1.34.0 \
#     -f Dockerfile.e2e-node -t kairos-kubeadm-e2e-node:v1.34.0 .
#
# Run (the harness does this for you; recorded here for reference):
#   docker run -d --privileged \
#     --cgroupns=private \
#     --tmpfs /run --tmpfs /tmp \
#     -v /var/lib/containerd -v /var/lib/kubelet -v /var/lib/etcd \
#     --entrypoint /sbin/init \
#     kairos-kubeadm-e2e-node:v1.34.0

ARG BASE_IMAGE=kairos-kubeadm:v1.34.0
FROM ${BASE_IMAGE}

# kubeadm refuses to run with swap on by default; a container has no swap, but be
# explicit and disable the kubelet's swap-detection nuisance the way kind does.
ENV container=docker

# --- kind systemd-in-container tweaks -------------------------------------
# 1. Mask units that are meaningless or harmful inside a container (they try to
#    touch real hardware / the host kernel and would fail or hang). This is the
#    same set kind masks in its node image entrypoint.
# 2. Ensure the journal goes to a writable location and systemd does not try to
#    set up a separate cgroup hierarchy (we run cgroup v2 unified, delegated).
# 3. Enable containerd + kubelet so systemd brings them up at boot (the base
#    image already `systemctl enable`s them, but we re-assert idempotently).
RUN set -eux; \
    # Units that must not run in a container.
    for unit in \
      systemd-udevd.service \
      systemd-udevd-kernel.socket \
      systemd-udevd-control.socket \
      systemd-modules-load.service \
      sys-kernel-config.mount \
      sys-kernel-debug.mount \
      sys-kernel-tracing.mount \
      systemd-journald-audit.socket ; do \
        systemctl mask "$unit" || true; \
    done; \
    # Do not let getty/console units spin.
    systemctl mask getty.target console-getty.service || true; \
    # Make sure containerd + kubelet start under systemd.
    systemctl enable containerd.service kubelet.service || true

# The kubelet must not be gated on swap; kind passes failSwapOn=false via the
# kubelet config. kubeadm 1.34 defaults to handling swap, but a privileged
# container can momentarily see host swap, so we belt-and-braces the flag through
# the kubeadm extra-args drop-in the unit already sources (/etc/default/kubelet).
RUN set -eux; \
    mkdir -p /etc/default; \
    printf 'KUBELET_EXTRA_ARGS=--fail-swap-on=false\n' > /etc/default/kubelet

# Declare the stateful directories as volumes so each container run gets a fresh,
# isolated, writable layer for them (kind keeps these out of the image layer for
# correctness and teardown). The harness also passes anonymous -v for these.
VOLUME [ "/var/lib/containerd", "/var/lib/kubelet", "/var/lib/etcd" ]

# systemd is PID 1. The kairos base image is systemd-based, so /sbin/init is
# systemd. STOPSIGNAL SIGRTMIN+3 is systemd's clean-shutdown signal (kind uses
# the same), so `docker stop` shuts the node down gracefully.
STOPSIGNAL SIGRTMIN+3
ENTRYPOINT [ "/sbin/init" ]