Skip to content

Commit 0d08bb1

Browse files
author
SUSE Update Bot
committed
Test build for #3166 
1 parent 9fac84f commit 0d08bb1

File tree

18 files changed

+359
-242
lines changed

18 files changed

+359
-242
lines changed

‎base-fips-image/Dockerfile‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,25 @@ FROM bci/bci-base:16.1
2323

2424
RUN set -euo pipefail; \
2525
zypper -n install --no-recommends SLES-release coreutils crypto-policies-scripts patterns-base-fips
26-
27-
# cleanup logs and temporary files
26+
# image cleanup
2827
RUN set -euo pipefail; zypper -n clean -a; \
29-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
30-
rm -rf {/target,}/run/*; \
31-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
32-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
33-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
34-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
35-
36-
# set the day of last password change to empty
37-
RUN set -euo pipefail; sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
28+
rm -vrf /var/log/alternatives.log; \
29+
rm -vrf /var/log/lastlog; \
30+
rm -vrf /var/log/tallylog; \
31+
rm -vrf /var/log/zypper.log; \
32+
rm -vrf /var/log/zypp/history; \
33+
rm -vrf /var/log/YaST2; \
34+
rm -vrf /var/lib/zypp/AnonymousUniqueId; \
35+
rm -vrf /var/cache/zypp/*; \
36+
rm -vrf /run/*; \
37+
rm -vrf /etc/shadow-; \
38+
rm -vrf /etc/group-; \
39+
rm -vrf /etc/passwd-; \
40+
rm -vrf /etc/.pwd.lock; \
41+
rm -vrf /usr/lib/sysimage/rpm/.rpm.lock; \
42+
rm -vrf /var/cache/ldconfig/aux-cache; \
43+
[ -f /var/lib/zypp/AutoInstalled ] && sed -i '1d' /var/lib/zypp/AutoInstalled; \
44+
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
3845

3946
# Define labels according to https://en.opensuse.org/Building_derived_containers
4047
# labelprefix=com.suse.bci.base-fips

‎base-image/config.sh‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -50,59 +50,9 @@ zypper -n ar --refresh --gpgcheck --priority 100 --enable 'https://public-dl.sus
5050
zypper -n ar --refresh --gpgcheck --priority 100 --disable 'https://public-dl.suse.com/SUSE/Products/SLE-BCI/$releasever_major.$releasever_minor/$basearch/product_debug/' SLE_BCI_debug
5151
zypper -n ar --refresh --gpgcheck --priority 100 --disable 'https://public-dl.suse.com/SUSE/Products/SLE-BCI/$releasever_major.$releasever_minor/$basearch/product_source/' SLE_BCI_source
5252

53-
#======================================
54-
# Remove zypp uuid (bsc#1098535)
55-
#--------------------------------------
56-
rm -f /var/lib/zypp/AnonymousUniqueId
57-
58-
# Remove the entire zypper cache content (not the dir itself, owned by libzypp)
59-
rm -rf /var/cache/zypp/*
60-
61-
# drop timestamp
62-
tail -n +2 /var/lib/zypp/AutoInstalled > /var/lib/zypp/AutoInstalled.new && mv /var/lib/zypp/AutoInstalled.new /var/lib/zypp/AutoInstalled
63-
64-
# drop useless device/inode specific cache file (see https://github.com/docker-library/official-images/issues/16044)
65-
rm -vf /var/cache/ldconfig/aux-cache
66-
67-
# remove backup of /etc/{shadow,group,passwd} and lock file
68-
rm -vf /etc/{shadow-,group-,passwd-,.pwd.lock}
69-
70-
# drop pid and lock files
71-
rm -vrf /run/*
72-
rm -vf /usr/lib/sysimage/rpm/.rpm.lock
73-
74-
# set the day of last password change to empty
75-
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
76-
77-
#==========================================
78-
# Hack! The go container management tools can't handle sparse files:
79-
# https://github.com/golang/go/issues/13548
80-
# If lastlog doesn't exist, useradd doesn't attempt to reserve space,
81-
# also in derived containers.
82-
#------------------------------------------
83-
rm -f /var/log/lastlog
84-
8553
#======================================
8654
# Remove locale files
8755
#--------------------------------------
8856
(shopt -s globstar; rm -f /usr/share/locale/**/*.mo)
8957

90-
#=======================================
91-
# Clean up after zypper if it is present
92-
#---------------------------------------
93-
if command -v zypper > /dev/null; then
94-
zypper -n clean -a
95-
fi
96-
97-
#=============================================
98-
# Clean up logs and temporary files if present
99-
#---------------------------------------------
100-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
101-
rm -rf {/target,}/run/*; \
102-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
103-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
104-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
105-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
106-
107-
10858
exit 0

‎base-image/images.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
# SPDX-License-Identifier: MIT
3+
# SPDX-FileCopyrightText: (c) 2022-2025 SUSE LLC
4+
5+
set -euo pipefail
6+
7+
#======================================
8+
# Image Cleanup
9+
#--------------------------------------
10+
if command -v zypper > /dev/null; then
11+
zypper -n clean -a
12+
# drop timestamp
13+
tail -n +2 /var/lib/zypp/AutoInstalled > /var/lib/zypp/AutoInstalled.new && mv /var/lib/zypp/AutoInstalled.new /var/lib/zypp/AutoInstalled
14+
else
15+
# it does not make sense in a zypper-free image
16+
rm -vrf /var/lib/zypp/AutoInstalled
17+
rm -vrf /usr/lib/sysimage/rpm/Index.db
18+
fi
19+
20+
# set the day of last password change to empty
21+
# prefer sed if available
22+
if command -v sed > /dev/null; then
23+
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
24+
else
25+
while IFS=: read -r username password last_change min_age max_age warn inactive expire reserved; do
26+
echo "$username:$password::$min_age:$max_age:$warn:$inactive:$expire:$reserved" >> /etc/shadow.new
27+
done < /etc/shadow
28+
mv /etc/shadow.new /etc/shadow
29+
chmod 640 /etc/shadow
30+
fi
31+
32+
# remove logs and temporary files
33+
rm -vrf /var/log/alternatives.log
34+
rm -vrf /var/log/lastlog
35+
rm -vrf /var/log/tallylog
36+
rm -vrf /var/log/zypper.log
37+
rm -vrf /var/log/zypp/history
38+
rm -vrf /var/log/YaST2
39+
rm -vrf /var/lib/zypp/AnonymousUniqueId
40+
rm -vrf /var/cache/zypp/*
41+
rm -vrf /run/*
42+
rm -vrf /etc/shadow-
43+
rm -vrf /etc/group-
44+
rm -vrf /etc/passwd-
45+
rm -vrf /etc/.pwd.lock
46+
rm -vrf /usr/lib/sysimage/rpm/.rpm.lock
47+
rm -vrf /var/cache/ldconfig/aux-cache
48+
49+
50+
exit 0

‎busybox-image/config.sh‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,35 +19,5 @@ fi
1919

2020
sed -i 's|/bin/bash|/bin/sh|' /etc/passwd
2121

22-
# not making sense in a zypper-free image
23-
rm -vf /var/lib/zypp/AutoInstalled
24-
25-
# includes device and inode numbers that change on deploy
26-
rm -vf /var/cache/ldconfig/aux-cache
27-
28-
# Will be recreated by the next rpm(1) run as root user
29-
rm -vf /usr/lib/sysimage/rpm/Index.db
30-
31-
# set the day of last password change to empty
32-
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
33-
34-
35-
#=======================================
36-
# Clean up after zypper if it is present
37-
#---------------------------------------
38-
if command -v zypper > /dev/null; then
39-
zypper -n clean -a
40-
fi
41-
42-
#=============================================
43-
# Clean up logs and temporary files if present
44-
#---------------------------------------------
45-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
46-
rm -rf {/target,}/run/*; \
47-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
48-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
49-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
50-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
51-
5222

5323
exit 0

‎busybox-image/images.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/sh
2+
# SPDX-License-Identifier: MIT
3+
# SPDX-FileCopyrightText: (c) 2022-2025 SUSE LLC
4+
5+
set -euo pipefail
6+
7+
#======================================
8+
# Image Cleanup
9+
#--------------------------------------
10+
if command -v zypper > /dev/null; then
11+
zypper -n clean -a
12+
# drop timestamp
13+
tail -n +2 /var/lib/zypp/AutoInstalled > /var/lib/zypp/AutoInstalled.new && mv /var/lib/zypp/AutoInstalled.new /var/lib/zypp/AutoInstalled
14+
else
15+
# it does not make sense in a zypper-free image
16+
rm -vrf /var/lib/zypp/AutoInstalled
17+
rm -vrf /usr/lib/sysimage/rpm/Index.db
18+
fi
19+
20+
# set the day of last password change to empty
21+
# prefer sed if available
22+
if command -v sed > /dev/null; then
23+
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
24+
else
25+
while IFS=: read -r username password last_change min_age max_age warn inactive expire reserved; do
26+
echo "$username:$password::$min_age:$max_age:$warn:$inactive:$expire:$reserved" >> /etc/shadow.new
27+
done < /etc/shadow
28+
mv /etc/shadow.new /etc/shadow
29+
chmod 640 /etc/shadow
30+
fi
31+
32+
# remove logs and temporary files
33+
rm -vrf /var/log/alternatives.log
34+
rm -vrf /var/log/lastlog
35+
rm -vrf /var/log/tallylog
36+
rm -vrf /var/log/zypper.log
37+
rm -vrf /var/log/zypp/history
38+
rm -vrf /var/log/YaST2
39+
rm -vrf /var/lib/zypp/AnonymousUniqueId
40+
rm -vrf /var/cache/zypp/*
41+
rm -vrf /run/*
42+
rm -vrf /etc/shadow-
43+
rm -vrf /etc/group-
44+
rm -vrf /etc/passwd-
45+
rm -vrf /etc/.pwd.lock
46+
rm -vrf /usr/lib/sysimage/rpm/.rpm.lock
47+
rm -vrf /var/cache/ldconfig/aux-cache
48+
49+
50+
exit 0

‎init-image/Dockerfile‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,25 @@ RUN set -euo pipefail; install -d -m 0755 /etc/systemd/system.conf.d/ \
3030
RUN set -euo pipefail; systemctl disable [email protected]
3131
RUN set -euo pipefail; useradd --no-create-home --uid 497 systemd-coredump
3232

33-
34-
# cleanup logs and temporary files
33+
# image cleanup
3534
RUN set -euo pipefail; zypper -n clean -a; \
36-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
37-
rm -rf {/target,}/run/*; \
38-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
39-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
40-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
41-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
42-
43-
# set the day of last password change to empty
44-
RUN set -euo pipefail; sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
35+
rm -vrf /var/log/alternatives.log; \
36+
rm -vrf /var/log/lastlog; \
37+
rm -vrf /var/log/tallylog; \
38+
rm -vrf /var/log/zypper.log; \
39+
rm -vrf /var/log/zypp/history; \
40+
rm -vrf /var/log/YaST2; \
41+
rm -vrf /var/lib/zypp/AnonymousUniqueId; \
42+
rm -vrf /var/cache/zypp/*; \
43+
rm -vrf /run/*; \
44+
rm -vrf /etc/shadow-; \
45+
rm -vrf /etc/group-; \
46+
rm -vrf /etc/passwd-; \
47+
rm -vrf /etc/.pwd.lock; \
48+
rm -vrf /usr/lib/sysimage/rpm/.rpm.lock; \
49+
rm -vrf /var/cache/ldconfig/aux-cache; \
50+
[ -f /var/lib/zypp/AutoInstalled ] && sed -i '1d' /var/lib/zypp/AutoInstalled; \
51+
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
4552

4653
# Define labels according to https://en.opensuse.org/Building_derived_containers
4754
# labelprefix=com.suse.bci.init

‎micro-fips-image/Dockerfile‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,28 @@ RUN set -euo pipefail; \
2929

3030
RUN set -euo pipefail; zypper -n install jdupes \
3131
&& jdupes -1 -L -r /target/usr/
32-
33-
# cleanup logs and temporary files
32+
# image cleanup
3433
RUN set -euo pipefail; zypper -n --installroot /target clean -a; \
35-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
36-
rm -rf {/target,}/run/*; \
37-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
38-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
39-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
40-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
34+
rm -vrf /target/var/log/alternatives.log; \
35+
rm -vrf /target/var/log/lastlog; \
36+
rm -vrf /target/var/log/tallylog; \
37+
rm -vrf /target/var/log/zypper.log; \
38+
rm -vrf /target/var/log/zypp/history; \
39+
rm -vrf /target/var/log/YaST2; \
40+
rm -vrf /target/var/lib/zypp/AnonymousUniqueId; \
41+
rm -vrf /target/var/cache/zypp/*; \
42+
rm -vrf /target/run/*; \
43+
rm -vrf /target/etc/shadow-; \
44+
rm -vrf /target/etc/group-; \
45+
rm -vrf /target/etc/passwd-; \
46+
rm -vrf /target/etc/.pwd.lock; \
47+
rm -vrf /target/usr/lib/sysimage/rpm/.rpm.lock; \
48+
rm -vrf /target/var/cache/ldconfig/aux-cache; \
49+
rm -vrf /target/var/lib/zypp/AutoInstalled; \
50+
rm -vrf /target/usr/lib/sysimage/rpm/Index.db; \
51+
[ -f /var/lib/zypp/AutoInstalled ] && sed -i '1d' /var/lib/zypp/AutoInstalled; \
52+
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /target/etc/shadow
4153

42-
# set the day of last password change to empty
43-
RUN set -euo pipefail; sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /target/etc/shadow
4454
FROM scratch
4555
COPY --from=builder /target /
4656
# Define labels according to https://en.opensuse.org/Building_derived_containers

‎micro-image/Dockerfile‎

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,28 @@ RUN set -euo pipefail; \
2929
RUN set -euo pipefail; rpm --root /target --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-67c856ee.asc
3030
RUN set -euo pipefail; zypper -n install jdupes \
3131
&& jdupes -1 -L -r /target/usr/
32-
33-
# cleanup logs and temporary files
32+
# image cleanup
3433
RUN set -euo pipefail; zypper -n --installroot /target clean -a; \
35-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
36-
rm -rf {/target,}/run/*; \
37-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
38-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
39-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
40-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
34+
rm -vrf /target/var/log/alternatives.log; \
35+
rm -vrf /target/var/log/lastlog; \
36+
rm -vrf /target/var/log/tallylog; \
37+
rm -vrf /target/var/log/zypper.log; \
38+
rm -vrf /target/var/log/zypp/history; \
39+
rm -vrf /target/var/log/YaST2; \
40+
rm -vrf /target/var/lib/zypp/AnonymousUniqueId; \
41+
rm -vrf /target/var/cache/zypp/*; \
42+
rm -vrf /target/run/*; \
43+
rm -vrf /target/etc/shadow-; \
44+
rm -vrf /target/etc/group-; \
45+
rm -vrf /target/etc/passwd-; \
46+
rm -vrf /target/etc/.pwd.lock; \
47+
rm -vrf /target/usr/lib/sysimage/rpm/.rpm.lock; \
48+
rm -vrf /target/var/cache/ldconfig/aux-cache; \
49+
rm -vrf /target/var/lib/zypp/AutoInstalled; \
50+
rm -vrf /target/usr/lib/sysimage/rpm/Index.db; \
51+
[ -f /var/lib/zypp/AutoInstalled ] && sed -i '1d' /var/lib/zypp/AutoInstalled; \
52+
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /target/etc/shadow
4153

42-
# set the day of last password change to empty
43-
RUN set -euo pipefail; sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /target/etc/shadow
4454
FROM scratch
4555
COPY --from=builder /target /
4656
# Define labels according to https://en.opensuse.org/Building_derived_containers
@@ -65,8 +75,3 @@ LABEL com.suse.release-stage="beta"
6575
LABEL io.artifacthub.package.readme-url="%SOURCEURL_WITH(README.md)%"
6676
LABEL io.artifacthub.package.logo-url="https://opensource.suse.com/bci/SLE_BCI_logomark_green.svg"
6777
CMD ["/bin/sh"]
68-
69-
# not making sense in a zypper-free image
70-
RUN set -euo pipefail; rm -vf /var/lib/zypp/AutoInstalled
71-
# includes device and inode numbers that change on deploy
72-
RUN set -euo pipefail; rm -vf /var/cache/ldconfig/aux-cache

‎minimal-image/config.sh‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -28,36 +28,5 @@ fi
2828
jdupes -1 -L -r /usr/share/licenses
2929
rpm -e jdupes
3030

31-
# set the day of last password change to empty
32-
sed -i 's/^\([^:]*:[^:]*:\)[^:]*\(:.*\)$/\1\2/' /etc/shadow
33-
rpm -e sed
34-
35-
# not making sense in a zypper-free image
36-
rm -vf /var/lib/zypp/AutoInstalled
37-
38-
# includes device and inode numbers that change on deploy
39-
rm -vf /var/cache/ldconfig/aux-cache
40-
41-
# Will be recreated by the next rpm(1) run as root user
42-
rm -vf /usr/lib/sysimage/rpm/Index.db
43-
44-
45-
#=======================================
46-
# Clean up after zypper if it is present
47-
#---------------------------------------
48-
if command -v zypper > /dev/null; then
49-
zypper -n clean -a
50-
fi
51-
52-
#=============================================
53-
# Clean up logs and temporary files if present
54-
#---------------------------------------------
55-
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; \
56-
rm -rf {/target,}/run/*; \
57-
rm -f {/target,}/etc/{shadow-,group-,passwd-,.pwd.lock}; \
58-
rm -f {/target,}/usr/lib/sysimage/rpm/.rpm.lock; \
59-
rm -f {/target,}/var/cache/ldconfig/aux-cache; \
60-
command -v zypper >/dev/null 2>&1 || rm -f /var/lib/zypp/AutoInstalled
61-
6231

6332
exit 0

0 commit comments

Comments
 (0)