mirror of
https://github.com/Dasharo/heads.git
synced 2026-06-13 10:16:29 -07:00
Thierry Laurion
4df98748ba
- Add HEADS_FORCE_DOCKER_REBUILD=1 to force rebuild from flake.nix/flake.lock
- Delete cached nix store result when forcing rebuild
- Add --print-build-logs to nix build for visibility
- Use docker load -i instead of docker load < for consistency
- Improve reproducibility check: explain config vs manifest digests
- Show method used (registry+jq, registry+sed, or pulled)
- Add tip to install jq and curl for faster registry checks
- Add get_remote_manifest_digest() with correct Docker Hub URL format
- Update doc/docker.md explaining config vs manifest digests
- Normalize indentation to tabs across docker scripts
- Use script-relative paths for deterministic nix build (--out-link)
- Add shared _parse_docker_image helper for consistent registry parsing
- Handle localhost as registry hostname (not Docker Hub)
Fixes:
- local result_target declaration in force rebuild
- handle regular file case for result (not just symlink)
- use printf instead of echo in hash computation
- fall back to shasum when sha256sum unavailable
- ensure temp directory cleanup on all paths
- handle @digest references in get_remote_manifest_digest
- restrict sha256 regex to exactly 64 hex chars
- use remote_method instead of hardcoded message
- Docker Hub URL uses sha256-{digest} not sha256:{digest}
- fix regex in get_remote_config_digest: use \. not \. for dot matching
- remove unused get_local_manifest_digest function
- move End marker to actual end points
- distinguish fetch_failed from mismatch in fallback message
- update documentation mismatch example to match current output
- check curl availability in get_remote_config_digest
- only show Docker Hub URL for Docker Hub images
- add curl availability check to get_remote_manifest_digest
- fix readlink -f fallback to use quoted variable
- fix pin-and-run.sh: strip :tag before appending @digest for valid Docker ref
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
80 lines
3.1 KiB
Bash
Executable File
80 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Source shared docker helper functions
|
|
# shellcheck source=docker/common.sh
|
|
source "$(dirname "$0")/docker/common.sh"
|
|
|
|
#locally build docker name is linuxboot/heads:dev-env
|
|
DOCKER_IMAGE="linuxboot/heads:dev-env"
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Usage: ./docker_local_dev.sh [COMMAND...]
|
|
|
|
Run the local dev image (linuxboot/heads:dev-env). If flake.nix/flake.lock are dirty,
|
|
rebuilds the image first.
|
|
|
|
Environment:
|
|
HEADS_FORCE_DOCKER_REBUILD=1 Force rebuild from flake.nix/flake.lock
|
|
HEADS_SKIP_DOCKER_REBUILD=1 Skip rebuild even if flake files changed
|
|
HEADS_CHECK_REPRODUCIBILITY=1 Compare local image ID to maintainer image
|
|
HEADS_CHECK_REPRODUCIBILITY_REMOTE=... Override remote image for the check
|
|
HEADS_DISABLE_USB=1 Disable USB passthrough
|
|
HEADS_X11_XAUTH=1 Force mounting ~/.Xauthority
|
|
|
|
Nix (only when rebuild is required):
|
|
HEADS_AUTO_INSTALL_NIX=1 Auto-install Nix (requires HEADS_NIX_INSTALLER_SHA256)
|
|
HEADS_NIX_INSTALLER_SHA256=... Expected sha256 for the installer
|
|
HEADS_NIX_INSTALLER_VERSION=... Use a pinned Nix installer version
|
|
HEADS_NIX_INSTALLER_URL=... Override installer URL
|
|
HEADS_AUTO_ENABLE_FLAKES=1 Auto-enable flakes in nix.conf
|
|
HEADS_SKIP_DISK_CHECK=1 Skip disk preflight check
|
|
HEADS_MIN_DISK_GB=... Override disk free threshold (GB)
|
|
|
|
Examples:
|
|
./docker_local_dev.sh
|
|
HEADS_CHECK_REPRODUCIBILITY=1 ./docker_local_dev.sh
|
|
USAGE
|
|
}
|
|
|
|
if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
|
|
usage
|
|
exit 0
|
|
fi
|
|
|
|
trap 'echo "Script interrupted. Exiting..."; exit 1' SIGINT
|
|
|
|
# Inform the user succinctly about the Docker image being used
|
|
echo "Developer helper: ./docker_local_dev.sh (local image: linuxboot/heads:dev-env)"
|
|
echo "Rebuilds local image when flake.nix/flake.lock have uncommitted changes. Opt-out: HEADS_SKIP_DOCKER_REBUILD=1"
|
|
echo "Force rebuild: HEADS_FORCE_DOCKER_REBUILD=1"
|
|
echo "For published images use: ./docker_latest.sh; for reproducible builds use: ./docker_repro.sh"
|
|
echo ""
|
|
|
|
# Ensure docker is available
|
|
require_docker || exit $?
|
|
|
|
# Rebuild the local image from flake.nix/flake.lock when uncommitted changes are present.
|
|
# Nix is only required if rebuild is needed; ensure_nix_and_flakes is called from _build_nix_docker_image.
|
|
# Opt-out with HEADS_SKIP_DOCKER_REBUILD=1
|
|
maybe_rebuild_local_image "$DOCKER_IMAGE"
|
|
echo "Using local dev image: $DOCKER_IMAGE" >&2
|
|
|
|
# Optional: verify reproducibility against docker.io latest
|
|
# Requires HEADS_CHECK_REPRODUCIBILITY=1 and either skopeo or curl installed
|
|
if [ "${HEADS_CHECK_REPRODUCIBILITY:-0}" = "1" ]; then
|
|
compare_image_reproducibility "$DOCKER_IMAGE" || {
|
|
echo "Note: Reproducibility check failed (expected if Nix versions or flake.lock differs from maintainer build)" >&2
|
|
}
|
|
fi
|
|
|
|
# Only perform host-side side-effects when executed directly (not when sourced)
|
|
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
|
# If USB passthrough is possible, clean up host processes that may hold tokens (interactive abort allowed).
|
|
kill_usb_processes
|
|
|
|
# Execute the docker run command with the provided parameters
|
|
# Delegate to shared run_docker so all docker_* scripts share identical device/X11/KVM handling
|
|
run_docker "$DOCKER_IMAGE" "$@"
|
|
fi
|