csjayp · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
@@ -1,11 +1,11 @@
 #
 # Build the cblock client on the runner, then use it to build this
-# repository's Cblockfile on vmcall.sqrt.ca over ssh.
+# repository's Cblockfile on prod.cblock.sqrt.ca over ssh.
 #
 # Repository settings:
 #   secrets.CBLOCK_SSH_KEY          private key for the ssh user
-#   secrets.CBLOCK_SSH_KNOWN_HOSTS  vmcall.sqrt.ca's known_hosts line(s)
-#   vars.CBLOCK_SSH_USER            ssh user on vmcall (default: ci); it
+#   secrets.CBLOCK_SSH_KNOWN_HOSTS  prod.cblock.sqrt.ca's known_hosts line(s)
+#   vars.CBLOCK_SSH_USER            ssh user on prod (default: ci); it
 #                                   must be in the cblock group
 #
 name: freebsd
@@ -16,16 +16,16 @@ on:
   pull_request:
   workflow_dispatch:
 
-# vmcall is a single build host, so run one build at a time.
+# prod is a single build host, so run one build at a time.
 concurrency:
-  group: cblock-vmcall
+  group: cblock-prod
   cancel-in-progress: false
 
 jobs:
   build:
     runs-on: ubuntu-latest
     env:
-      CBLOCK_HOST: ssh://vmcall.sqrt.ca
+      CBLOCK_HOST: ssh://prod.cblock.sqrt.ca
     steps:
       - uses: actions/checkout@v4
 
@@ -39,7 +39,7 @@ jobs:
           make client-only
           sudo make client-only-install
           command -v cblock
-          # The checkout is also the build context sent to vmcall. Remove
+          # The checkout is also the build context sent to prod. Remove
           # the Linux objects, or make in the FreeBSD build will see
           # libcblock.a as up to date and link it into cblockd.
           make -C src/libcblock clean
@@ -59,7 +59,7 @@ jobs:
           # connection between them so the job does not trip the rate
           # limit on the ssh port.
           cat > ~/.ssh/config <<EOF
-          Host vmcall.sqrt.ca
+          Host prod.cblock.sqrt.ca
               User $SSH_USER
               IdentityFile ~/.ssh/cblock
               IdentitiesOnly yes
@@ -83,4 +83,4 @@ jobs:
 
       - name: Close the ssh connection
         if: always()
-        run: ssh -O exit vmcall.sqrt.ca || true
+        run: ssh -O exit prod.cblock.sqrt.ca || true
@@ -0,0 +1,44 @@
+#
+# A minimal FreeBSD 15-STABLE image built from source, using the knobs in
+# src.conf. The source and object trees stay behind in the build image;
+# ROOTPIVOT makes the freshly installed /new/root the image.
+#
+# Build from this directory:
+#
+#   cblock build -n fbsd-lite .
+#
+FROM base
+
+ENV ASSUME_ALWAYS_YES = "YES"
+ENV IGNORE_OSVERSION = "yes"
+#
+# Install git-lite so we can pull down a fresh freebsd -stable
+RUN "pkg install git-lite"
+RUN "git clone --depth 1 --branch stable/15 https://git.freebsd.org/src.git /usr/src"
+
+#
+# Copy our configuration for a stripped out freebsd userspace
+COPY src.conf /usr/src/src-lite.conf
+
+#
+# Do the dirty
+WORKDIR "/usr/src"
+RUN "make -j $(sysctl -n hw.ncpu) buildworld SRCCONF=/usr/src/src-lite.conf"
+RUN "mkdir -p /new/root"
+RUN "make installworld SRCCONF=/usr/src/src-lite.conf DESTDIR=/new/root"
+
+#
+# Prepare /etc
+RUN "make distribution SRCCONF=/usr/src/src-lite.conf DESTDIR=/new/root"
+
+#
+# Create base databases required by a lot of things
+RUN "cp /etc/resolv.conf /new/root/etc/"
+RUN "cap_mkdb /new/root/usr/share/misc/termcap"
+RUN "cap_mkdb /new/root/etc/login.conf"
+RUN "pwd_mkdb -p -d /new/root/etc /new/root/etc/master.passwd"
+
+ROOTPIVOT /new
+OSRELEASE 15.1-STABLE
+
+ENTRYPOINT [ "/bin/sh" ]
@@ -0,0 +1,118 @@
+#
+# src.conf -- WITHOUT knobs for a minimal FreeBSD container base image.
+#
+# Keeps: OpenSSL, fetch(1), libarchive, the CA root store, vi(1), basic
+# shell utilities, and everything pkg needs to bootstrap and run.
+#
+# Knobs checked against tools/build/options on stable/15.
+#
+# Usage:
+#   make -j$(sysctl -n hw.ncpu) buildworld SRCCONF=/path/to/src.conf
+#   make installworld distribution SRCCONF=/path/to/src.conf DESTDIR=...
+#
+
+# Compiler toolchain -- not needed inside a container image. TOOLCHAIN
+# also turns off CLANG, LLD, LLDB and LLVM_BINUTILS. It only changes what
+# is installed: buildworld still builds what it needs to compile.
+WITHOUT_TOOLCHAIN=yes
+WITHOUT_OPENMP=yes
+WITHOUT_GOOGLETEST=yes
+
+# Documentation
+WITHOUT_MAN=yes
+WITHOUT_HTML=yes
+WITHOUT_DICT=yes
+WITHOUT_EXAMPLES=yes
+WITHOUT_SHAREDOCS=yes
+
+# Locales -- pkg does not need them; add WITH_LOCALES if ports require them
+WITHOUT_LOCALES=yes
+WITHOUT_ICONV=yes
+
+# Mail -- MAIL also turns off SENDMAIL, DMAGENT and MAILWRAPPER
+WITHOUT_MAIL=yes
+
+# Authentication / directory services
+WITHOUT_NIS=yes
+WITHOUT_KERBEROS=yes
+
+# Network services and tools not needed in a container
+WITHOUT_OPENSSH=yes
+WITHOUT_BLUETOOTH=yes
+WITHOUT_WIRELESS=yes
+WITHOUT_WIRELESS_SUPPORT=yes
+WITHOUT_OFED=yes
+WITHOUT_PPP=yes
+WITHOUT_RADIUS_SUPPORT=yes
+WITHOUT_BOOTPARAMD=yes
+WITHOUT_BOOTPD=yes
+WITHOUT_BSNMP=yes
+WITHOUT_FINGER=yes
+WITHOUT_INETD=yes
+WITHOUT_NETGRAPH=yes
+WITHOUT_NTP=yes
+WITHOUT_RBOOTD=yes
+WITHOUT_ROUTED=yes
+WITHOUT_TALK=yes
+WITHOUT_TELNET=yes
+WITHOUT_TFTP=yes
+WITHOUT_UNBOUND=yes
+WITHOUT_NETCAT=yes
+
+# Firewalling -- handled by host
+WITHOUT_IPFW=yes
+WITHOUT_PF=yes
+WITHOUT_IPFILTER=yes
+WITHOUT_AUTHPF=yes
+
+# Storage / clustering -- not needed in container. CDDL also turns off
+# ZFS and DTrace.
+WITHOUT_HAST=yes
+WITHOUT_ISCSI=yes
+WITHOUT_CDDL=yes
+WITHOUT_AUTOFS=yes
+WITHOUT_CCD=yes
+WITHOUT_QUOTAS=yes
+
+# Hardware, boot and console -- the host owns these
+WITHOUT_BOOT=yes
+WITHOUT_EFI=yes
+WITHOUT_ACPI=yes
+WITHOUT_APM=yes
+WITHOUT_BHYVE=yes
+WITHOUT_HYPERV=yes
+WITHOUT_CUSE=yes
+WITHOUT_CXGBETOOL=yes
+WITHOUT_MLX5TOOL=yes
+WITHOUT_FLOPPY=yes
+WITHOUT_GPIO=yes
+WITHOUT_USB=yes
+WITHOUT_SOUND=yes
+WITHOUT_PMC=yes
+WITHOUT_LEGACY_CONSOLE=yes
+WITHOUT_SYSCONS=yes
+WITHOUT_VT=yes
+
+# Installer and updates -- images are rebuilt, not updated in place
+WITHOUT_BSDINSTALL=yes
+WITHOUT_FREEBSD_UPDATE=yes
+WITHOUT_NUAGEINIT=yes
+
+# 32-bit compatibility -- not needed in a container image
+WITHOUT_LIB32=yes
+
+# Shells and editors -- /bin/sh and vi(1) stay
+WITHOUT_TCSH=yes
+WITHOUT_NLS_CATALOGS=yes
+WITHOUT_EE=yes
+
+# Misc
+WITHOUT_ACCT=yes
+WITHOUT_BLOCKLIST=yes
+WITHOUT_CALENDAR=yes
+WITHOUT_GAMES=yes
+WITHOUT_LOCATE=yes
+WITHOUT_LPR=yes
+WITHOUT_TESTS=yes
+WITHOUT_RESCUE=yes
+WITHOUT_DEBUG_FILES=yes