mi/werkator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

werkdock: import the rootfs archive, fall back to load -i on an older werkdock

Browse Source 
Werkdock's docker-compat branch names the verb for rootfs archives
'import' (docker import semantics) and keeps 'load -i --name' only as
a compatibility path. Werkator now runs 'werkdock import ARCHIVE IMAGE'
and falls back to 'load -i --name' on exactly the unknown-verb
signature (exit 125, 'unknown command' on stderr), so Werkator and
werkdock can be updated in either order. Any other import failure
propagates as before. The image name stays untagged: it equals
werkator-buildenv-<hash>:latest in werkdock's naming, and the existing
store needs no re-import. PR-doc under docs/prs/ with the PR#000
placeholder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
mhoennig
2026-09-05 22:49:46 +02:00
co-authored by Claude Fable 5.1
parent 0f9f119687
commit b8600bb556
5 changed files with 184 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration.md
+3 -1
View File
@@ -475,7 +475,9 @@ The section was called `bwrap` and its binary key `bwrap.werkdock` until v1.2.0;
`werkdock.rootfs` names the prepared root filesystem archive — a Debian-base rootfs with the build tools (JDK, git, locales, project-specific tooling) built elsewhere, since `debootstrap` is unavailable on the target.
It is a local path or an `http(s)` URL; a URL is downloaded once into `.git/werkator/buildenv/`.
Build the archive with `tools/build-bwrap-rootfs.sh` on any machine with Docker.
The archive is loaded once per source as the werkdock image `werkator-buildenv-<hash>` into werkdock's store (`$WERKDOCK_HOME`, default `~/.werkdock`) — shared by every repository of this OS user; the hash derives from the source string, so a changed `rootfs` loads a fresh image and stale ones can be removed from the store.
The archive is imported once per source as the werkdock image `werkator-buildenv-<hash>` into werkdock's store (`$WERKDOCK_HOME`, default `~/.werkdock`) — shared by every repository of this OS user; the hash derives from the source string, so a changed `rootfs` imports a fresh image and stale ones can be removed from the store.
Werkator uses `werkdock import ARCHIVE IMAGE` (docker import semantics) and falls back to the older `werkdock load -i ARCHIVE --name IMAGE` when the installed werkdock does not know the verb yet, so Werkator and werkdock can be updated in either order.
The image keeps its untagged name (it equals `werkator-buildenv-<hash>:latest` in werkdock's docker-style naming), so an existing store needs no re-import.
Per-repo Gradle caches persist in `.git/werkator/buildenv/home`, bound as `/root`.
`werkdock.env` adds environment variables inside the sandbox; the environment is otherwise cleared (docker semantics) — the server's environment does not leak in.
Files created inside the sandbox are owned by the host user, because uid 0 maps back to the unprivileged webspace user.