babbarc/workspaces
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(buildah): add some packages and set permissions to specific files

Browse Source
This commit is contained in:
yeti 2025-04-17 21:36:03 +01:00
parent 8b5433999a
commit c104750a02
1 changed files with 51 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
build-workspace.sh
View File

@ -12,38 +12,75 @@ DEV_HOME=/home/$DEV_USER
ctr=$(buildah from archlinux) ctr=$(buildah from archlinux)
buildah run "$ctr" -- bash -c "\ buildah run "$ctr" -- bash -c "\
pacman -Sy --noconfirm && pacman -S --noconfirm neovim git zsh tmux podman \ pacman -Sy --noconfirm && pacman -S --noconfirm --needed base-devel neovim git zsh tmux \
fzf fd ripgrep jdk-openjdk && pacman -Scc --noconfirm && \ nodejs python podman fzf fd ripgrep jdk-openjdk zsh-completions zsh-syntax-highlighting \
lazygit zsh-autosuggestions luarocks python-pynvim npm bash-completion tree-sitter-cli \
pkgconf lua51 && pacman -Scc --noconfirm && \
groupadd secproc && useradd -ms /bin/zsh -G secproc $DEV_USER && \ groupadd secproc && useradd -ms /bin/zsh -G secproc $DEV_USER && \
useradd --system --no-create-home -s /usr/sbin/nologin -G $DEV_USER viewer && \ useradd --system --no-create-home -s /usr/sbin/nologin -G $DEV_USER viewer && \
mkdir -p /tmp/tmux-shared && chown -R $DEV_USER:$DEV_USER /tmp/tmux-shared && \ mkdir -p /tmp/tmux-shared && chown $DEV_USER:$DEV_USER /tmp/tmux-shared && \
chmod 750 /tmp/tmux-shared && \
mkdir -p $SECURE && chmod -R 500 $SECURE && \ mkdir -p $SECURE && chmod -R 500 $SECURE && \
mkdir /app && chmod 700 /app && chown $DEV_USER:$DEV_USER /app mkdir /app && chmod 700 /app && chown $DEV_USER:$DEV_USER /app
" "
# copy start script # copy start script
buildah copy "$ctr" start.sh $DEV_HOME/start.sh buildah copy "$ctr" start.sh $DEV_HOME/start.sh
# copy zshrc, neovim and tmux setup
buildah copy "$ctr" zshrc $DEV_HOME/.zshrc
buildah copy "$ctr" config $DEV_HOME/.config
# copy ssh setup # copy ssh setup
buildah copy "$ctr" ssh $SECURE/ssh buildah copy "$ctr" ssh $SECURE/ssh
# copy zshrc, neovim and tmux setup
buildah copy "$ctr" zshrc $DEV_HOME/.zshrc
buildah copy "$ctr" config $DEV_HOME/.config
buildah copy "$ctr" local $DEV_HOME/.local
# zsh and tmux config (immutable) # zsh and tmux config (immutable)
buildah run "$ctr" -- bash -c " buildah run "$ctr" -- chown -R $DEV_USER:$DEV_USER $DEV_HOME
chown -R $DEV_USER:$DEV_USER $DEV_HOME && \ buildah run --user $DEV_USER "$ctr" -- nvim --headless "+Lazy! sync" +qa
find $DEV_HOME -type f -exec chmod 750 {} + && \
find $DEV_HOME -type f -exec chown root:secproc {} + && \ # lock the files
setfacl -R -m u:devuser:--x $DEV_HOME && \ buildah run "$ctr" -- bash -c "\
chmod 750 $DEV_HOME/start.sh \
$DEV_HOME/.config/lazygit/config.yml \
$DEV_HOME/.config/nvim/lua/config/lazy.lua \
$DEV_HOME/.config/nvim/lazyvim.json \
$DEV_HOME/.config/nvim/lazy-lock.json \
$DEV_HOME/.config/nvim/init.lua \
$DEV_HOME/.config/nvim/README.md \
$DEV_HOME/.config/nvim/LICENSE \
$DEV_HOME/.config/tmux/tmux.conf \
$DEV_HOME/.config/tmux/tmux.conf.local \
$DEV_HOME/.config/zsh/fzf-git.sh && \
setfacl -m u:devuser:--x $DEV_HOME/start.sh \
$DEV_HOME/.config/lazygit/config.yml \
$DEV_HOME/.config/nvim/lua/config/lazy.lua \
$DEV_HOME/.config/nvim/lazyvim.json \
$DEV_HOME/.config/nvim/lazy-lock.json \
$DEV_HOME/.config/nvim/init.lua \
$DEV_HOME/.config/nvim/README.md \
$DEV_HOME/.config/nvim/LICENSE \
$DEV_HOME/.config/tmux/tmux.conf \
$DEV_HOME/.config/tmux/tmux.conf.local \
$DEV_HOME/.config/zsh/fzf-git.sh && \
chown root:secproc $DEV_HOME/start.sh \
$DEV_HOME/.config/lazygit/config.yml \
$DEV_HOME/.config/nvim/lua/config/lazy.lua \
$DEV_HOME/.config/nvim/lazyvim.json \
$DEV_HOME/.config/nvim/lazy-lock.json \
$DEV_HOME/.config/nvim/init.lua \
$DEV_HOME/.config/nvim/README.md \
$DEV_HOME/.config/nvim/LICENSE \
$DEV_HOME/.config/tmux/tmux.conf \
$DEV_HOME/.config/tmux/tmux.conf.local \
$DEV_HOME/.config/zsh/fzf-git.sh && \
chmod -R 750 $DEV_HOME/.config/zsh/ohmyzsh && \
setfacl -R -m u:devuser:--x $DEV_HOME/.config/zsh/ohmyzsh && \
chown -R root:secproc $DEV_HOME/.config/zsh/ohmyzsh
" "
buildah config \ buildah config \
--user $DEV_USER \ --user $DEV_USER \
--workingdir /app \ --workingdir /app \
--env CONTAINER_HOST=unix:///run/podman/podman.sock \ --env CONTAINER_HOST=unix:///run/podman/podman.sock \
--cmd "$DEV_HOME/start.sh" \ --cmd '["/home/devuser/start.sh"]' \
"$ctr" "$ctr"
buildah commit "$ctr" $IMG_NAME buildah commit "$ctr" $IMG_NAME