commit 249270db26fa89721d73fbd36e952fa4bc5b8edc
parent 7f38d89f2df0abd53bf51819a19e0081fa2cf695
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 9 Apr 2026 12:30:50 +0200
switch build system
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
5 files changed, 81 insertions(+), 43 deletions(-)
diff --git a/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml b/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml
@@ -16,13 +16,6 @@ spec:
serviceAccountName: image-builder-cronjob
restartPolicy: Never
initContainers:
- - name: setup-buildctl
- image: moby/buildkit:v0.29.0
- command: [cp, /usr/bin/buildctl, /tools/buildctl]
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- name: setup-cosign
image: alpine:3
command:
@@ -35,19 +28,6 @@ spec:
- name: tools
mountPath: /tools
- - name: setup-crane
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tmp/crane.tar.gz https://github.com/google/go-containerregistry/releases/download/v0.21.4/go-containerregistry_Linux_x86_64.tar.gz \
- && tar -xzf /tmp/crane.tar.gz -C /tools crane \
- && chmod +x /tools/crane
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- name: clone-repo
image: alpine/git:latest
command:
@@ -68,8 +48,7 @@ spec:
- -c
- |
set -eu
- apk add --no-cache git >/dev/null
- export PATH="/tools:$PATH"
+ apk add --no-cache podman cosign >/dev/null
mkdir -p /root/.docker
cp /registry-secret/dockerconfig.json /root/.docker/config.json
@@ -80,21 +59,21 @@ spec:
echo "==> Building ${IMAGE}:${TAG_TS}"
- buildctl \
- --addr tcp://buildkitd.image-builder.svc.cluster.local:1234 \
- build \
- --frontend dockerfile.v0 \
- --opt platform=linux/amd64,linux/arm64 \
- --local context=/workspace/apps/talos_cluster/continuwuity \
- --local dockerfile=/workspace/apps/talos_cluster/continuwuity \
- --output "type=image,name=${IMAGE}:${TAG_TS},push=true,oci-mediatypes=true" \
- --metadata-file /tmp/build-meta.json
+ podman build \
+ --platform linux/amd64,linux/arm64 \
+ --manifest "${IMAGE}:${TAG_TS}" \
+ -f /workspace/apps/talos_cluster/continuwuity/Dockerfile \
+ /workspace/apps/talos_cluster/continuwuity
- DIGEST="$(crane digest ${IMAGE}:${TAG_TS})"
- echo "==> Digest: ${DIGEST}"
+ podman manifest push --all "${IMAGE}:${TAG_TS}" "docker://${IMAGE}:${TAG_TS}"
+ podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:main"
+ podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}"
+ podman push "${IMAGE}:main"
+ podman push "${IMAGE}:${TAG_SHA}"
- crane cp "${IMAGE}:${TAG_TS}" "${IMAGE}:main"
- crane cp "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}"
+ DIGEST="$(podman inspect --format='{{.RepoDigests}}' ${IMAGE}:${TAG_TS} | grep -o 'sha256:[^@]*' | cut -d: -f2)"
+ [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
+ echo "==> Digest: sha256:${DIGEST}"
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
cosign sign --yes \
@@ -102,7 +81,7 @@ spec:
--new-bundle-format=false \
--use-signing-config=false \
--registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
+ "${IMAGE}@sha256:${DIGEST}"
echo "==> Done: ${IMAGE}:${TAG_TS}"
env:
@@ -111,8 +90,6 @@ spec:
- name: COSIGN_EXPERIMENTAL
value: "1"
volumeMounts:
- - name: tools
- mountPath: /tools
- name: workspace
mountPath: /workspace
readOnly: true
@@ -124,10 +101,10 @@ spec:
readOnly: true
volumes:
- - name: tools
- emptyDir: {}
- name: workspace
emptyDir: {}
+ - name: tools
+ emptyDir: {}
- name: registry-secret
secret:
secretName: image-builder-registry-secret
diff --git a/apps/talos_cluster/image-builder/buildkitd-statefulset.yaml b/apps/talos_cluster/image-builder/buildkitd-statefulset.yaml
@@ -19,7 +19,7 @@ spec:
spec:
containers:
- name: buildkitd
- image: moby/buildkit:master
+ image: tonistiigi/buildkit:master
args:
- --addr
- unix:///run/buildkit/buildkitd.sock
diff --git a/apps/talos_cluster/image-builder/kustomization.yaml b/apps/talos_cluster/image-builder/kustomization.yaml
@@ -3,8 +3,6 @@ kind: Kustomization
resources:
- namespace.yaml
- rbac.yaml
- - buildkitd-statefulset.yaml
- - buildkitd-service.yaml
- binfmt-daemonset.yaml
- registry-secret.yaml
- cosign-secret.yaml
diff --git a/apps/talos_cluster/image-builder/podman-deployment.yaml b/apps/talos_cluster/image-builder/podman-deployment.yaml
@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: podman-builder
+ namespace: image-builder
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: podman-builder
+ template:
+ metadata:
+ labels:
+ app: podman-builder
+ spec:
+ serviceAccountName: image-builder
+ containers:
+ - name: podman
+ image: podman:latest
+ command:
+ - podman
+ - system
+ - service
+ - unix:///run/podman/podman.sock
+ ports:
+ - containerPort: 8888
+ protocol: TCP
+ securityContext:
+ privileged: true
+ volumeMounts:
+ - name: docker-config
+ mountPath: /root/.docker
+ readOnly: true
+ - name: podman-sock
+ mountPath: /run/podman
+ resources:
+ requests:
+ cpu: 500m
+ memory: 512Mi
+ limits:
+ memory: 2Gi
+ volumes:
+ - name: docker-config
+ secret:
+ secretName: image-builder-registry-secret
+ items:
+ - key: dockerconfig.json
+ path: config.json
+ - name: podman-sock
+ emptyDir: {}
diff --git a/apps/talos_cluster/image-builder/podman-service.yaml b/apps/talos_cluster/image-builder/podman-service.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+ name: podman-builder
+ namespace: image-builder
+spec:
+ selector:
+ app: podman-builder
+ ports:
+ - port: 8888
+ targetPort: 8888
+ protocol: TCP
+ type: ClusterIP
