marvin
653532a72a
Default node_id is {hostname}_{random-per-boot}, so every boot
inserted a new services row and the console probed stale ones (409
node_id mismatch -> 'not found' node pages). Pin TURNSTONE_NODE_ID
(one upserted row) and TURNSTONE_ADVERTISE_URL to loopback — the
guest's slirp IPv6 lands in the SSRF guard's never-allowed lane.
Also drop the futile /etc/hostname baking (podman regenerates it at
boco build).
82 lines
2.7 KiB
Docker
82 lines
2.7 KiB
Docker
FROM archlinux:latest
|
|
|
|
# Metadata
|
|
LABEL maintainer="marvin"
|
|
LABEL description="Turnstone agent server, built as a boco container-VM"
|
|
|
|
# Build-time arguments for UID/GID mapping
|
|
ARG USER_ID=1000
|
|
ARG GROUP_ID=1000
|
|
|
|
# Set environment variables
|
|
ENV HOME=/home/marvin
|
|
|
|
# Install system dependencies via pacman
|
|
RUN pacman -Syu --noconfirm && pacman -S --noconfirm --needed \
|
|
bash \
|
|
ca-certificates \
|
|
curl \
|
|
jq \
|
|
git \
|
|
github-cli \
|
|
tea \
|
|
helix \
|
|
nushell \
|
|
rust \
|
|
rust-analyzer \
|
|
rustfmt \
|
|
go \
|
|
podman \
|
|
base-devel \
|
|
openssl \
|
|
tar \
|
|
gzip \
|
|
openssh \
|
|
sudo \
|
|
python \
|
|
uv \
|
|
&& pacman -Sc --noconfirm
|
|
|
|
# Create the 'marvin' user and set up home directory with provided UID/GID
|
|
RUN groupadd -g ${GROUP_ID} marvin || true && \
|
|
useradd -m -u ${USER_ID} -g marvin -s /bin/bash marvin && \
|
|
mkdir -p /home/marvin/.local/bin /home/marvin/work && \
|
|
install -d -o ${USER_ID} -g ${GROUP_ID} -m 750 /home/marvin/.config && \
|
|
chown -R marvin:marvin /home/marvin && \
|
|
echo "marvin ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
|
|
|
|
# Rootless podman subuid/subgid mapping (deterministic single entry —
|
|
# duplicates make podman request overlapping uid_map ranges, which the
|
|
# kernel rejects with EINVAL)
|
|
RUN printf "marvin:100000:65536\n" > /etc/subuid && \
|
|
printf "marvin:100000:65536\n" > /etc/subgid
|
|
|
|
# NOTE: don't bake /etc/hostname or /etc/hosts here — podman regenerates
|
|
# both when boco creates the build container, so they never reach the
|
|
# qcow2. The entrypoint sets the hostname live; node identity comes from
|
|
# TURNSTONE_NODE_ID.
|
|
|
|
# SSH access for marvin (pubkey generated by scripts/build.sh)
|
|
COPY configs/ssh/authorized_keys /tmp/authorized_keys
|
|
RUN install -o ${USER_ID} -g ${GROUP_ID} -m 700 -d /home/marvin/.ssh && \
|
|
install -o ${USER_ID} -g ${GROUP_ID} -m 600 /tmp/authorized_keys \
|
|
/home/marvin/.ssh/authorized_keys && \
|
|
rm /tmp/authorized_keys
|
|
|
|
# Turnstone in a dedicated venv (Arch python is externally managed)
|
|
RUN uv venv /opt/turnstone --python /usr/bin/python && \
|
|
uv pip install --python /opt/turnstone/bin/python turnstone && \
|
|
for f in /opt/turnstone/bin/turnstone*; do ln -s "$f" /usr/local/bin/; done
|
|
|
|
# VM entrypoint (root: starts sshd, fixes share ownership, drops to marvin)
|
|
COPY start-turnstone.sh /usr/local/bin/start-turnstone.sh
|
|
RUN chmod 755 /usr/local/bin/start-turnstone.sh
|
|
|
|
# Optional: paru + openscad from AUR (slow builds)
|
|
# RUN git clone https://aur.archlinux.org/paru.git && \
|
|
# cd paru && makepkg -si --noconfirm && cd .. && rm -rf paru && \
|
|
# paru --removemake --cleanafter --aur -S openscad-git
|
|
|
|
WORKDIR /home/marvin
|
|
CMD ["/usr/local/bin/start-turnstone.sh"]
|