deploy/Containerfile.ci

 1# The image gitbay's own CI jobs run in, once the runner isolates builds
 2# (#144). Without it a job runs in the runner's default image, which has
 3# no toolchain, and the suite's prerequisite check fails immediately.
 4#
 5# Build it on the runner host, where podman keeps it:
 6#
 7#   ssh -p 2222 root@bay1 'su - ci-runner -s /bin/sh -c \
 8#     "podman build -t localhost/gitbay-ci:1 -f - ." ' < deploy/Containerfile.ci
 9#
10# Tagged, not :latest, so a change to this file is a deliberate bump in
11# .gitbay/ci.yml rather than a silent change under a running branch.
12FROM docker.io/library/golang:1.27-trixie
13
14# The suite drives real git, ssh, sshd and gpg rather than mocking them,
15# and asserts they are present before running. git-lfs has its own tests;
16# sshd must be the binary at /usr/sbin/sshd that the tests exec.
17RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
18        git-lfs \
19        gnupg \
20        openssh-server \
21        openssh-client \
22        ca-certificates \
23        curl \
24        unzip \
25    && rm -rf /var/lib/apt/lists/*
26
27# A build runs as this image's root inside its own user namespace, mapped
28# to the runner's unprivileged user on the host. The workspace arrives
29# bind mounted at /workspace.
30WORKDIR /workspace