From 3dbb84b068f383ec559e75d28208e1e77ad78528 Mon Sep 17 00:00:00 2001 From: "Christian S.J. Peron" Date: Thu, 8 Oct 2026 19:17:53 -0500 Subject: [PATCH 1/2] Add a builder for small footprint bsd --- examples/fbsd-lite/Cblockfile | 44 +++++++++++++ examples/fbsd-lite/src.conf | 118 ++++++++++++++++++++++++++++++++++ 2 files changed, 162 insertions(+) create mode 100644 examples/fbsd-lite/Cblockfile create mode 100644 examples/fbsd-lite/src.conf diff --git a/examples/fbsd-lite/Cblockfile b/examples/fbsd-lite/Cblockfile new file mode 100644 index 0000000..e652726 --- /dev/null +++ b/examples/fbsd-lite/Cblockfile @@ -0,0 +1,44 @@ +# +# A minimal FreeBSD 15-STABLE image built from source, using the knobs in +# src.conf. The source and object trees stay behind in the build image; +# ROOTPIVOT makes the freshly installed /new/root the image. +# +# Build from this directory: +# +# cblock build -n fbsd-lite . +# +FROM base + +ENV ASSUME_ALWAYS_YES = "YES" +ENV IGNORE_OSVERSION = "yes" +# +# Install git-lite so we can pull down a fresh freebsd -stable +RUN "pkg install git-lite" +RUN "git clone --depth 1 --branch stable/15 https://git.freebsd.org/src.git /usr/src" + +# +# Copy our configuration for a stripped out freebsd userspace +COPY src.conf /usr/src/src-lite.conf + +# +# Do the dirty +WORKDIR "/usr/src" +RUN "make -j $(sysctl -n hw.ncpu) buildworld SRCCONF=/usr/src/src-lite.conf" +RUN "mkdir -p /new/root" +RUN "make installworld SRCCONF=/usr/src/src-lite.conf DESTDIR=/new/root" + +# +# Prepare /etc +RUN "make distribution SRCCONF=/usr/src/src-lite.conf DESTDIR=/new/root" + +# +# Create base databases required by a lot of things +RUN "cp /etc/resolv.conf /new/root/etc/" +RUN "cap_mkdb /new/root/usr/share/misc/termcap" +RUN "cap_mkdb /new/root/etc/login.conf" +RUN "pwd_mkdb -p -d /new/root/etc /new/root/etc/master.passwd" + +ROOTPIVOT /new +OSRELEASE 15.1-STABLE + +ENTRYPOINT [ "/bin/sh" ] diff --git a/examples/fbsd-lite/src.conf b/examples/fbsd-lite/src.conf new file mode 100644 index 0000000..393a5be --- /dev/null +++ b/examples/fbsd-lite/src.conf @@ -0,0 +1,118 @@ +# +# src.conf -- WITHOUT knobs for a minimal FreeBSD container base image. +# +# Keeps: OpenSSL, fetch(1), libarchive, the CA root store, vi(1), basic +# shell utilities, and everything pkg needs to bootstrap and run. +# +# Knobs checked against tools/build/options on stable/15. +# +# Usage: +# make -j$(sysctl -n hw.ncpu) buildworld SRCCONF=/path/to/src.conf +# make installworld distribution SRCCONF=/path/to/src.conf DESTDIR=... +# + +# Compiler toolchain -- not needed inside a container image. TOOLCHAIN +# also turns off CLANG, LLD, LLDB and LLVM_BINUTILS. It only changes what +# is installed: buildworld still builds what it needs to compile. +WITHOUT_TOOLCHAIN=yes +WITHOUT_OPENMP=yes +WITHOUT_GOOGLETEST=yes + +# Documentation +WITHOUT_MAN=yes +WITHOUT_HTML=yes +WITHOUT_DICT=yes +WITHOUT_EXAMPLES=yes +WITHOUT_SHAREDOCS=yes + +# Locales -- pkg does not need them; add WITH_LOCALES if ports require them +WITHOUT_LOCALES=yes +WITHOUT_ICONV=yes + +# Mail -- MAIL also turns off SENDMAIL, DMAGENT and MAILWRAPPER +WITHOUT_MAIL=yes + +# Authentication / directory services +WITHOUT_NIS=yes +WITHOUT_KERBEROS=yes + +# Network services and tools not needed in a container +WITHOUT_OPENSSH=yes +WITHOUT_BLUETOOTH=yes +WITHOUT_WIRELESS=yes +WITHOUT_WIRELESS_SUPPORT=yes +WITHOUT_OFED=yes +WITHOUT_PPP=yes +WITHOUT_RADIUS_SUPPORT=yes +WITHOUT_BOOTPARAMD=yes +WITHOUT_BOOTPD=yes +WITHOUT_BSNMP=yes +WITHOUT_FINGER=yes +WITHOUT_INETD=yes +WITHOUT_NETGRAPH=yes +WITHOUT_NTP=yes +WITHOUT_RBOOTD=yes +WITHOUT_ROUTED=yes +WITHOUT_TALK=yes +WITHOUT_TELNET=yes +WITHOUT_TFTP=yes +WITHOUT_UNBOUND=yes +WITHOUT_NETCAT=yes + +# Firewalling -- handled by host +WITHOUT_IPFW=yes +WITHOUT_PF=yes +WITHOUT_IPFILTER=yes +WITHOUT_AUTHPF=yes + +# Storage / clustering -- not needed in container. CDDL also turns off +# ZFS and DTrace. +WITHOUT_HAST=yes +WITHOUT_ISCSI=yes +WITHOUT_CDDL=yes +WITHOUT_AUTOFS=yes +WITHOUT_CCD=yes +WITHOUT_QUOTAS=yes + +# Hardware, boot and console -- the host owns these +WITHOUT_BOOT=yes +WITHOUT_EFI=yes +WITHOUT_ACPI=yes +WITHOUT_APM=yes +WITHOUT_BHYVE=yes +WITHOUT_HYPERV=yes +WITHOUT_CUSE=yes +WITHOUT_CXGBETOOL=yes +WITHOUT_MLX5TOOL=yes +WITHOUT_FLOPPY=yes +WITHOUT_GPIO=yes +WITHOUT_USB=yes +WITHOUT_SOUND=yes +WITHOUT_PMC=yes +WITHOUT_LEGACY_CONSOLE=yes +WITHOUT_SYSCONS=yes +WITHOUT_VT=yes + +# Installer and updates -- images are rebuilt, not updated in place +WITHOUT_BSDINSTALL=yes +WITHOUT_FREEBSD_UPDATE=yes +WITHOUT_NUAGEINIT=yes + +# 32-bit compatibility -- not needed in a container image +WITHOUT_LIB32=yes + +# Shells and editors -- /bin/sh and vi(1) stay +WITHOUT_TCSH=yes +WITHOUT_NLS_CATALOGS=yes +WITHOUT_EE=yes + +# Misc +WITHOUT_ACCT=yes +WITHOUT_BLOCKLIST=yes +WITHOUT_CALENDAR=yes +WITHOUT_GAMES=yes +WITHOUT_LOCATE=yes +WITHOUT_LPR=yes +WITHOUT_TESTS=yes +WITHOUT_RESCUE=yes +WITHOUT_DEBUG_FILES=yes From 41b6da1472a208d6d3c22bf458ff8e2ef36dbabf Mon Sep 17 00:00:00 2001 From: "Christian S.J. Peron" Date: Thu, 8 Oct 2026 19:20:13 -0500 Subject: [PATCH 2/2] Fix hostname --- .github/workflows/cblock.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/cblock.yml b/.github/workflows/cblock.yml index fae21a7..4685b56 100644 --- a/.github/workflows/cblock.yml +++ b/.github/workflows/cblock.yml @@ -1,11 +1,11 @@ # # Build the cblock client on the runner, then use it to build this -# repository's Cblockfile on vmcall.sqrt.ca over ssh. +# repository's Cblockfile on prod.cblock.sqrt.ca over ssh. # # Repository settings: # secrets.CBLOCK_SSH_KEY private key for the ssh user -# secrets.CBLOCK_SSH_KNOWN_HOSTS vmcall.sqrt.ca's known_hosts line(s) -# vars.CBLOCK_SSH_USER ssh user on vmcall (default: ci); it +# secrets.CBLOCK_SSH_KNOWN_HOSTS prod.cblock.sqrt.ca's known_hosts line(s) +# vars.CBLOCK_SSH_USER ssh user on prod (default: ci); it # must be in the cblock group # name: freebsd @@ -16,16 +16,16 @@ on: pull_request: workflow_dispatch: -# vmcall is a single build host, so run one build at a time. +# prod is a single build host, so run one build at a time. concurrency: - group: cblock-vmcall + group: cblock-prod cancel-in-progress: false jobs: build: runs-on: ubuntu-latest env: - CBLOCK_HOST: ssh://vmcall.sqrt.ca + CBLOCK_HOST: ssh://prod.cblock.sqrt.ca steps: - uses: actions/checkout@v4 @@ -39,7 +39,7 @@ jobs: make client-only sudo make client-only-install command -v cblock - # The checkout is also the build context sent to vmcall. Remove + # The checkout is also the build context sent to prod. Remove # the Linux objects, or make in the FreeBSD build will see # libcblock.a as up to date and link it into cblockd. make -C src/libcblock clean @@ -59,7 +59,7 @@ jobs: # connection between them so the job does not trip the rate # limit on the ssh port. cat > ~/.ssh/config <