ironic-image/Dockerfile.scos at main · openshift/ironic-image · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# Please ensure this file is kept in sync with Dockerfile.ocp
FROM quay.io/centos/centos:stream9 AS builder

WORKDIR /tmp

COPY prepare-efi.sh /bin/
RUN prepare-efi.sh centos

FROM quay.io/centos/centos:stream9

ENV PKGS_LIST=main-packages-list.okd
ARG EXTRA_PKGS_LIST
ARG DNSMASQ_DATA_DIR=/data/dnsmasq

COPY ${PKGS_LIST} ${EXTRA_PKGS_LIST:-$PKGS_LIST} python-requirements.okd /tmp/
COPY ironic-config/inspector.ipxe.j2 ironic-config/httpd-ironic-api.conf.j2 \
     ironic-config/ipxe_config.template ironic-config/dnsmasq.conf.j2 \
     /templates/
COPY prepare-image.sh prepare-ipxe.sh configure-nonroot.sh setup.okd scripts/*  /bin/

# Install Python 3.12 for SCOS builds
RUN dnf install -y python3.12 python3.12-pip python3.12-devel python3.12-setuptools

RUN prepare-image.sh && \
    rm -f /bin/prepare-image.sh && \
    rm -f /bin/setup.okd && \
    /bin/prepare-ipxe.sh && \
    rm -f /bin/prepare-ipxe.sh

# Add PQC support - on Stream 9 apply the PQ subpolicy; Skip if on Stream 10+ as PQ is already in DEFAULT
RUN if [ -f /usr/share/crypto-policies/policies/modules/PQ.pmod ]; then \
      update-crypto-policies --set DEFAULT:PQ; \
    fi

# IRONIC #
COPY --from=builder /tmp/uefi_esp_*.img /tmp/

COPY ironic-config/ironic.conf.j2 /etc/ironic/

# DNSMASQ #
COPY ironic-config/dnsmasq.conf.j2 /etc/

# Custom httpd config, removes all but the bare minimum needed modules
COPY ironic-config/httpd.conf.j2 /etc/httpd/conf/
COPY ironic-config/httpd-ironic-proxy.conf.j2 /etc/httpd/conf/
COPY ironic-config/httpd-modules.conf /etc/httpd/conf.modules.d/
COPY ironic-config/apache2-vmedia.conf.j2 /templates/httpd-vmedia.conf.j2
COPY ironic-config/apache2-proxy.conf.j2 /etc/httpd-proxy.conf.j2
COPY ironic-config/apache2-ipxe.conf.j2 /templates/httpd-ipxe.conf.j2

RUN mkdir -p /var/lib/ironic && \
  sqlite3 /var/lib/ironic/ironic.sqlite "pragma journal_mode=wal" && \
  dnf remove -y sqlite

# configure non-root user and set relevant permissions
RUN configure-nonroot.sh && \
  rm -f /bin/configure-nonroot.sh

ENV IS_SCOS=true