[PATCH v2 11/13] app-container-curl: use multilayer mode; container-nonroot-user

From: Tim Orling <[email protected]>

* Move to recipes-containers/images to show maintenance intent
* Switch to multilayer mode to more like the other "library"/"official"
  container recipes.
* Change OCI_IMAGE_TAG to "latest" for similar reasons.
* Change OCI_IMAGE_ENTRYPOINT_ARGS to "--help" to be more like upstream
  containers.
* Install ca-certificates to enable handling https:// sites
* Inherit container-nonroot-user to run as 'nonroot' with UID 65532 by
  default.
* Inherit container-volatile-fixup to fix 'log' and 'tmp' in
  /var/volatile.
* Inherit container-dev-mode to optionally build a "-dev" image.
  Set PACKAGECONFIG:pn-app-container-curl = "dev" in local.conf or
  distro/image config to run as `root` and include a CONTAINER_SHELL.

Signed-off-by: Tim Orling <[email protected]>
---
 .../images/app-container-curl.bb              | 39 ++++++++++++++++
 recipes-demo/images/app-container-curl.bb     | 46 -------------------
 2 files changed, 39 insertions(+), 46 deletions(-)
 create mode 100644 recipes-containers/images/app-container-curl.bb
 delete mode 100644 recipes-demo/images/app-container-curl.bb

diff --git a/recipes-containers/images/app-container-curl.bb b/recipes-containers/images/app-container-curl.bb
new file mode 100644
index 00000000..bfa3e708
--- /dev/null
+++ b/recipes-containers/images/app-container-curl.bb
@@ -0,0 +1,39 @@
+SUMMARY = "Curl Application container image"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+# Multi-layer mode: create explicit layers instead of single rootfs layer
+OCI_LAYER_MODE = "multi"
+
+# Optional 'dev' mode:
+#   - adds a shell to the container
+#   - runs the container as root (UID 0)
+# Enable with: PACKAGECONFIG:pn-app-container-curl = "dev"
+PACKAGECONFIG ??= ""
+PACKAGECONFIG[dev] = ""
+inherit container-dev-mode
+
+# Define layers: each layer contains specific packages
+# Format: "name:type:content" where content uses + as delimiter for multiple items
+OCI_LAYERS = "\
+    base:packages:base-files+base-passwd+netbase \
+    ${@bb.utils.contains('PACKAGECONFIG', 'dev', 'shell:packages:${CONTAINER_SHELL}', '', d)} \
+    curl:packages:curl+ca-certificates \
+"
+
+IMAGE_FSTYPES = "container oci"
+inherit image
+inherit image-oci
+inherit container-nonroot-user
+inherit container-volatile-fixup
+
+IMAGE_FEATURES = ""
+IMAGE_LINGUAS = ""
+NO_RECOMMENDATIONS = "1"
+
+# Allow build with or without a specific kernel
+IMAGE_CONTAINER_NO_DUMMY = "1"
+
+OCI_IMAGE_ENTRYPOINT = "curl"
+OCI_IMAGE_TAG = "latest"
+OCI_IMAGE_ENTRYPOINT_ARGS = "--help"
diff --git a/recipes-demo/images/app-container-curl.bb b/recipes-demo/images/app-container-curl.bb
deleted file mode 100644
index ddeb3022..00000000
--- a/recipes-demo/images/app-container-curl.bb
+++ /dev/null
@@ -1,46 +0,0 @@
-SUMMARY = "Curl Application container image"
-LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
-
-IMAGE_FSTYPES = "container oci"
-inherit image
-inherit image-oci
-
-IMAGE_FEATURES = ""
-IMAGE_LINGUAS = ""
-NO_RECOMMENDATIONS = "1"
-
-IMAGE_INSTALL = " \
-       base-files \
-       base-passwd \
-       netbase \
-       ${CONTAINER_SHELL} \
-"
-
-# If the following is configured in local.conf (or the distro):
-#      PACKAGE_EXTRA_ARCHS:append = " container-dummy-provides"
-# 
-# it has been explicitly # indicated that we don't want or need a shell, so we'll
-# add the dummy provides.
-# 
-# This is required, since there are postinstall scripts in base-files and base-passwd
-# that reference /bin/sh and we'll get a rootfs error if there's no shell or no dummy
-# provider.
-CONTAINER_SHELL ?= "${@bb.utils.contains('PACKAGE_EXTRA_ARCHS', 'container-dummy-provides', 'container-dummy-provides', 'busybox', d)}"
-
-# Allow build with or without a specific kernel
-IMAGE_CONTAINER_NO_DUMMY = "1"
-
-# Workaround /var/volatile for now
-ROOTFS_POSTPROCESS_COMMAND += "rootfs_fixup_var_volatile ; "
-rootfs_fixup_var_volatile () {
-    install -m 1777 -d ${IMAGE_ROOTFS}/${localstatedir}/volatile/tmp
-    install -m 755 -d ${IMAGE_ROOTFS}/${localstatedir}/volatile/log
-}
-
-OCI_IMAGE_ENTRYPOINT = "curl"
-OCI_IMAGE_TAG = "easy"
-OCI_IMAGE_ENTRYPOINT_ARGS = "http://localhost:80"
-CONTAINER_SHELL = "busybox"
-
-IMAGE_INSTALL:append = " curl"
-- 
2.54.0