27 lines
1.4 KiB
Docker
27 lines
1.4 KiB
Docker
# Firecracker orchestrator-VM image (PRD 0070).
|
|
#
|
|
# The control-plane rootfs the orchestrator microVM boots: the lean orchestrator
|
|
# image + the in-VM agent-image builder. The Firecracker backend builds users'
|
|
# agent Dockerfiles *inside this VM* with buildah (rootless, daemonless) instead
|
|
# of on the host — no host Docker daemon, no root-equivalent `docker` group. The
|
|
# gateway VM boots a *separate*, slimmer rootfs (bot-bottle-gateway:latest) that
|
|
# carries none of this build tooling — the exposed data plane stays minimal.
|
|
#
|
|
# `crun` is the OCI runtime; `netavark` + `aardvark-dns` are the network backend
|
|
# for `FROM` pulls + `RUN` egress. `vfs` + `chroot`: buildah works as root in the
|
|
# bare microVM (no fuse-overlayfs / overlay module / subuid maps). The trixie
|
|
# base (from Dockerfile.orchestrator's python:3.12-slim) carries buildah 1.39,
|
|
# which parses the Dockerfile heredocs agent images use (bookworm's 1.28 can't).
|
|
# Matches image_builder. There is deliberately no default: the build coordinator
|
|
# passes the exact local image ID returned by `docker image inspect`, so this
|
|
# stage cannot silently resolve a stale `:latest` tag.
|
|
ARG ORCHESTRATOR_BASE_IMAGE
|
|
FROM ${ORCHESTRATOR_BASE_IMAGE}
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
buildah crun netavark aardvark-dns \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
ENV STORAGE_DRIVER=vfs \
|
|
BUILDAH_ISOLATION=chroot
|