chore(base): upgrade to bookworm

duanhongyi · duanhongyi · commit c876e216a1e8 · 2023-06-16T08:58:00.000+08:00
diff --git a/.woodpecker/manifest.tmpl b/.woodpecker/manifest.tmpl
@@ -1,4 +1,4 @@
-image: registry.drycc.cc/drycc/{{project}}:bullseye
+image: registry.drycc.cc/drycc/{{project}}:bookworm
 {{#if build.tags}}
 tags:
 {{#each build.tags}}
@@ -7,12 +7,12 @@ tags:
 {{/if}}
 manifests:
   -
-    image: registry.drycc.cc/drycc/{{project}}:bullseye-amd64
+    image: registry.drycc.cc/drycc/{{project}}:bookworm-amd64
     platform:
       architecture: amd64
       os: linux
   -
-    image: registry.drycc.cc/drycc/{{project}}:bullseye-arm64
+    image: registry.drycc.cc/drycc/{{project}}:bookworm-arm64
     platform:
       architecture: arm64
       os: linux
diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-CODENAME ?= bullseye
+CODENAME ?= bookworm
 DEV_REGISTRY ?= registry.drycc.cc
 DRYCC_REGISTRY ?= ${DEV_REGISTRY}
 IMAGE = "${DRYCC_REGISTRY}"/drycc/base:"${CODENAME}"-"$(shell dpkg --print-architecture)"
diff --git a/README.md b/README.md
@@ -9,7 +9,7 @@ A slimmed-down Debian-based container image used as the basis of [Drycc Workflow
 Start your Dockerfile with this line:
 
 ```
-FROM registry.drycc.cc/drycc/base:bullseye
+FROM registry.drycc.cc/drycc/base:bookworm
 ```
 
 There isn't a `:latest` tag, because each debian version is a tag.
diff --git a/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/apt-retry b/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/apt-retry
@@ -0,0 +1,2 @@
+# Retry apt failures 3 times. See here for more information: https://linux.die.net/man/5/apt.conf
+Acquire::Retries 3;
diff --git a/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-autoremove-suggests b/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-autoremove-suggests
@@ -0,0 +1,16 @@
+# Since Docker users are looking for the smallest possible final images, the
+# following emerges as a very common pattern:
+
+#   RUN apt-get update \
+#       && apt-get install -y <packages> \
+#       && <do some compilation work> \
+#       && apt-get purge -y --auto-remove <packages>
+
+# By default, APT will actually _keep_ packages installed via Recommends or
+# Depends if another package Suggests them, even and including if the package
+# that originally caused them to be installed is removed.  Setting this to
+# "false" ensures that APT is appropriately aggressive about removing the
+# packages it added.
+
+# https://aptitude.alioth.debian.org/doc/en/ch02s05s05.html#configApt-AutoRemove-SuggestsImportant
+Apt::AutoRemove::SuggestsImportant "false";
diff --git a/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-clean b/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-clean
@@ -0,0 +1,19 @@
+# Since for most Docker users, package installs happen in "docker build" steps,
+# they essentially become individual layers due to the way Docker handles
+# layering, especially using CoW filesystems.  What this means for us is that
+# the caches that APT keeps end up just wasting space in those layers, making
+# our layers unnecessarily large (especially since we'll normally never use
+# these caches again and will instead just "docker build" again and make a brand
+# new image).
+
+# Ideally, these would just be invoking "apt-get clean", but in our testing,
+# that ended up being cyclic and we got stuck on APT's lock, so we get this fun
+# creation that's essentially just "apt-get clean".
+DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };
+APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };
+
+Dir::Cache::pkgcache "";
+Dir::Cache::srcpkgcache "";
+
+# Note that we do realize this isn't the ideal way to do this, and are always
+# open to better suggestions (https://github.com/docker/docker/issues).
diff --git a/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-gzip-indexes b/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-gzip-indexes
@@ -0,0 +1,11 @@
+# Since Docker users using "RUN apt-get update && apt-get install -y ..." in
+# their Dockerfiles don't go delete the lists files afterwards, we want them to
+# be as small as possible on-disk, so we explicitly request "gz" versions and
+# tell Apt to keep them gzipped on-disk.
+
+# For comparison, an "apt-get update" layer without this on a pristine
+# "debian:wheezy" base image was "29.88 MB", where with this it was only
+# "8.273 MB".
+
+Acquire::GzipIndexes "true";
+Acquire::CompressionTypes::Order:: "gz";
diff --git a/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-no-languages b/debootstrap/bookworm/rootfs/etc/apt/apt.conf.d/docker-no-languages
@@ -0,0 +1,5 @@
+# In Docker, we don't often need the "Translations" files, so we're just wasting
+# time and space by downloading them, and this inhibits that.  For users that do
+# need them, it's a simple matter to delete this file and "apt-get update". :)
+
+Acquire::Languages "none";
diff --git a/debootstrap/bookworm/rootfs/etc/machine-id b/debootstrap/bookworm/rootfs/etc/machine-id
@@ -0,0 +1 @@
+793274e99ef692a48f77ea0eea7bd0cb
diff --git a/debootstrap/bookworm/rootfs/etc/resolv.conf b/debootstrap/bookworm/rootfs/etc/resolv.conf
@@ -0,0 +1,2 @@
+nameserver 8.8.8.8
+nameserver 8.8.4.4
diff --git a/debootstrap/bookworm/rootfs/usr/bin/init-stack b/debootstrap/bookworm/rootfs/usr/bin/init-stack
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# check to see if this file is being run or sourced from another script
+_is_sourced() {
+	# https://unix.stackexchange.com/a/215279
+	[ "${#FUNCNAME[@]}" -ge 2 ] \
+		&& [ "${FUNCNAME[0]}" = '_is_sourced' ] \
+		&& [ "${FUNCNAME[1]}" = 'source' ]
+}
+
+env_list=$(find /opt/drycc/*/env/* 2>/dev/null || echo "")
+for env in ${env_list}
+do
+  key=$(echo "${env}" | awk -F "/" '{print $NF}')
+  value=$(<"${env}")
+  # shellcheck source=/dev/null
+  export "${key}=${value}"
+done
+
+env_launch_list=$(find /opt/drycc/*/env.launch/* 2>/dev/null || echo "")
+for env in ${env_launch_list}
+do
+  key=$(echo "${env}" | awk -F "/" '{print $NF}')
+  value=$(<"${env}")
+  # shellcheck source=/dev/null
+  export "${key}=${value}"
+done
+
+profile_list=$(find /opt/drycc/*/profile.d/* 2>/dev/null || echo "")
+for profile in ${profile_list}
+do
+  # shellcheck source=/dev/null
+  . "${profile}"
+done
+
+exec_list=$(find /opt/drycc/*/exec.d/* 2>/dev/null) || echo ""
+for _exec in ${exec_list}
+do
+  "${_exec}"
+done
+
+if ! _is_sourced; then
+  if [[ "$$" == "1" ]] ; then
+    exec tini -g -- "$@"
+  else
+    exec tini -sg -- "$@"
+  fi
+fi
diff --git a/debootstrap/bookworm/rootfs/usr/bin/install-stack b/debootstrap/bookworm/rootfs/usr/bin/install-stack
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+set -e
+set -u
+# Constants
+TMP_DIR=$(mktemp -d)
+STACK_CACHE_ROOT="/tmp/drycc/stack/cache"
+STACK_DOWNLOAD_URL="${STACK_DOWNLOAD_URL:-https://download.drycc.cc/stacks}"
+
+# OS Release
+# shellcheck source=/dev/null
+. /etc/os-release
+
+function clean {
+    # delay before exiting, so stdout/stderr flushes through the logging system
+    rm -rf "${TMP_DIR}"
+    sleep 3
+}
+trap clean EXIT
+
+function main() {
+    local name="${1:?name is required}"
+    local version="${2:?version is required}"
+
+    local os_name="${OS_NAME:-linux}"
+    local os_arch="${OS_ARCH:-$(dpkg --print-architecture)}"
+    local os_flavour="${OS_FLAVOUR:-${ID}-${VERSION_ID}}"
+
+    local stack_name="${name}-${version}-${os_name}-${os_arch}-${os_flavour}"
+    local stack_filename="${stack_name}".tar.gz
+    local stack_download_url="${STACK_DOWNLOAD_URL}/${name}/${stack_filename}"
+
+    echo "Downloading $stack_filename package"
+    if [ -f "${STACK_CACHE_ROOT}/${stack_filename}" ]; then
+        echo "${STACK_CACHE_ROOT}/${stack_filename} already exists, skipping download."
+        cp "${STACK_CACHE_ROOT}/${stack_filename}" "${TMP_DIR}/${stack_filename}"
+        rm "${STACK_CACHE_ROOT}/${stack_filename}"
+    else
+        curl --silent --show-error --fail "${stack_download_url}" -o "${TMP_DIR}/${stack_filename}"
+    fi
+    echo "Generate installation directory: /opt/drycc/${name}"
+    if [ -d /opt/drycc/"${name}" ]; then
+        rm -rf /opt/drycc/"${name}"
+    fi
+    mkdir -p /opt/drycc/"${name}"
+
+    tar --directory "${TMP_DIR}" --extract --gunzip --file "${TMP_DIR}"/"${stack_filename}" --no-same-owner
+    # shellcheck disable=SC2046,SC2086
+    install-packages $(< "${TMP_DIR}"/meta/dependencies)
+    "${TMP_DIR}"/meta/preinstall
+    cp -rf "${TMP_DIR}"/data/* /opt/drycc/"${name}"
+    "${TMP_DIR}"/meta/postinstall
+}
+
+main "$@"
diff --git a/debootstrap/bookworm/rootfs/usr/bin/scanelp b/debootstrap/bookworm/rootfs/usr/bin/scanelp
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+find "$1" -type f -executable -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \
+  | tr ',' '\n' \
+  | sort -u \
+  | xargs -rt dpkg -S 2>/dev/null \
+  | awk -F ": " '{print $1}' \
+  | sort -u
diff --git a/debootstrap/bookworm/rootfs/usr/sbin/initctl b/debootstrap/bookworm/rootfs/usr/sbin/initctl
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# For most Docker users, "apt-get install" only happens during "docker build",
+# where starting services doesn't work and often fails in humorous ways. This
+# prevents those failures by stopping the services from attempting to start.
+
+exit 0
diff --git a/debootstrap/bookworm/rootfs/usr/sbin/install-packages b/debootstrap/bookworm/rootfs/usr/sbin/install-packages
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+set -u
+
+export DEBIAN_FRONTEND=noninteractive
+
+function main {
+    n=0
+    max=2
+    until [ $n -gt $max ]; do
+        set +e
+        (
+        apt-get update -qq &&
+        apt-get install -y --no-install-recommends "$@"
+        )
+        CODE=$?
+        set -e
+        if [ $CODE -eq 0 ]; then
+            break
+        fi
+        if [ $n -eq $max ]; then
+            exit $CODE
+        fi
+        echo "apt failed, retrying"
+        n=$((n + 1))
+    done
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+}
+
+main "$@"
diff --git a/debootstrap/bookworm/rootfs/usr/sbin/policy-rc.d b/debootstrap/bookworm/rootfs/usr/sbin/policy-rc.d
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# For most Docker users, "apt-get install" only happens during "docker build",
+# where starting services doesn't work and often fails in humorous ways. This
+# prevents those failures by stopping the services from attempting to start.
+
+exit 101

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-CODENAME ?= bullseye`
	`1`	`+CODENAME ?= bookworm`
`2`	`2`	`DEV_REGISTRY ?= registry.drycc.cc`
`3`	`3`	`DRYCC_REGISTRY ?= ${DEV_REGISTRY}`
`4`	`4`	`IMAGE = "${DRYCC_REGISTRY}"/drycc/base:"${CODENAME}"-"$(shell dpkg --print-architecture)"`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+# Retry apt failures 3 times. See here for more information: https://linux.die.net/man/5/apt.conf`
	`2`	`+Acquire::Retries 3;`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+nameserver 8.8.8.8`
	`2`	`+nameserver 8.8.4.4`