RHEL PoC #991
RHEL PoC #991
Conversation
| @@ -1,30 +0,0 @@ | |||
| # syntax=docker/dockerfile:1 | |||
There was a problem hiding this comment.
This one may be in use by IBM?
| RUN subscription-manager register --username=$RH_USER --password=$RH_PASS | ||
| RUN subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms |
There was a problem hiding this comment.
Didn't this produce a subscription-file, so something we could run in CI, and --mount ? Passing these as argument means they leak into the image produced (and build-cache).
There was a problem hiding this comment.
This is somewhat intentional for now; the cleanup step is "manual" (read: a cron job elsewhere) as a stopgap while I work on lifecycle robustness. That being said, I hadn't considered build cache issues since we don't actually clean the cache on the Jenkins nodes, as best I can tell...
Given that, maybe it would be better to use fixed certificates; this is somewhat messier (mostly for containerd-packaging) and introduces the manual update process/point of failure, but I can mock it up as an alternative (and it does obviate the runtime lifecycle issues).
neersighted
force-pushed
the
rhel-poc
branch
from
af4d718
to
2bb1964
Compare
| ARG RH_USER | ||
| ARG RH_PASS | ||
| RUN rm /etc/rhsm-host | ||
| RUN subscription-manager register --username=$RH_USER --password=$RH_PASS |
There was a problem hiding this comment.
This should use RUN --mount=type=secret to avoid leaking the password in the image history (although the image is never pushed to public)
neersighted
force-pushed
the
rhel-poc
branch
2 times, most recently
from
98a8275
to
6485b2d
Compare
neersighted
force-pushed
the
rhel-poc
branch
6 times, most recently
from
3739fa8
to
a1e3656
Compare
Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com> Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com> Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
|
Rebased |
This is a PoC for building RHEL packages assuming that a RHEL username/password is available in the environment.
This is mostly intended for internal use by Docker, as it is assumed that the main utility is performing builds with a 'real RHEL' for enterprise customers.
However, when a unencumbered RHEL-equivalent distribution (e.g. Rocky) is supported, it will make sense to generalize the 'rhel' infrastructure in this repo.