combine
This commit is contained in:
Anders Rytter Hansen
parent
d93b1efc43
commit
345720ad5e
5 changed files with 372 additions and 1 deletions
135
.github/workflows/base.yml
vendored
Normal file
135
.github/workflows/base.yml
vendored
Normal file
|
|
@ -0,0 +1,135 @@
|
|||
name: base
|
||||
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
# They are provided by a third-party and are governed by
|
||||
# separate terms of service, privacy policy, and support
|
||||
# documentation.
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 5 * * *' # 4 am every day
|
||||
push:
|
||||
branches: [ "main" ]
|
||||
# Publish semver tags as releases.
|
||||
tags: [ 'v*.*.*' ]
|
||||
pull_request:
|
||||
branches: [ "main" ]
|
||||
|
||||
env:
|
||||
# Use docker.io for Docker Hub if empty
|
||||
REGISTRY: ghcr.io
|
||||
# github.repository as <account>/<repo>
|
||||
IMAGE_NAME: ${{ github.repository_owner }}/my-ostree-os-base
|
||||
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
|
||||
|
||||
|
||||
jobs:
|
||||
build:
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
# This is used to complete the identity challenge
|
||||
# with sigstore/fulcio when running outside of PRs.
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Maximize build space
|
||||
uses: AdityaGarg8/remove-unwanted-software@v1
|
||||
with:
|
||||
remove-dotnet: 'true'
|
||||
remove-android: 'true'
|
||||
remove-haskell: 'true'
|
||||
|
||||
- name: Get current date
|
||||
id: date
|
||||
run: echo "::set-output name=date::$(date +'%Y%m%d')"
|
||||
|
||||
- name: Test with environment variables
|
||||
run: echo $DATE
|
||||
env:
|
||||
DATE: ${{ steps.date.outputs.date }}
|
||||
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v3
|
||||
|
||||
# Install the cosign tool except on PR
|
||||
# https://github.com/sigstore/cosign-installer
|
||||
- name: Install cosign
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
|
||||
with:
|
||||
cosign-release: 'v2.1.1'
|
||||
|
||||
# Login against a Docker registry except on PR
|
||||
# https://github.com/docker/login-action
|
||||
- name: Log into registry ${{ env.REGISTRY }}
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# Extract metadata (tags, labels) for Docker
|
||||
# https://github.com/docker/metadata-action
|
||||
- name: Extract Docker metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
|
||||
|
||||
# Build image using Buildah action
|
||||
- name: Build Image
|
||||
id: build_image
|
||||
uses: redhat-actions/buildah-build@v2
|
||||
with:
|
||||
containerfiles: |
|
||||
./base.Dockerfile
|
||||
image: ${{ env.IMAGE_NAME }}
|
||||
tags: ${{ steps.meta.outputs.tags }} ${{ steps.meta.outputs.tags }}-38 ${{ steps.meta.outputs.tags }}-38.${{ steps.date.outputs.date }}
|
||||
oci: false
|
||||
|
||||
# Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
|
||||
# https://github.com/macbre/push-to-ghcr/issues/12
|
||||
- name: Lowercase Registry
|
||||
id: registry_case
|
||||
uses: ASzc/change-string-case-action@v5
|
||||
with:
|
||||
string: ${{ env.IMAGE_REGISTRY }}
|
||||
|
||||
# Push the image to GHCR (Image Registry)
|
||||
- name: Push To GHCR
|
||||
uses: redhat-actions/push-to-registry@v2
|
||||
id: push
|
||||
if: github.event_name != 'pull_request'
|
||||
env:
|
||||
REGISTRY_USER: ${{ github.actor }}
|
||||
REGISTRY_PASSWORD: ${{ github.token }}
|
||||
with:
|
||||
image: ${{ steps.build_image.outputs.image }}
|
||||
tags: ${{ steps.build_image.outputs.tags }}
|
||||
registry: ${{ steps.registry_case.outputs.lowercase }}
|
||||
username: ${{ env.REGISTRY_USER }}
|
||||
password: ${{ env.REGISTRY_PASSWORD }}
|
||||
extra-args: |
|
||||
--disable-content-trust
|
||||
|
||||
|
||||
|
||||
# Sign the resulting Docker image digest except on PRs.
|
||||
# This will only write to the public Rekor transparency log when the Docker
|
||||
# repository is public to avoid leaking data. If you would like to publish
|
||||
# transparency data even for private images, pass --force to cosign below.
|
||||
# https://github.com/sigstore/cosign
|
||||
- name: Sign the published Docker image
|
||||
if: ${{ github.event_name != 'pull_request' }}
|
||||
env:
|
||||
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
|
||||
TAGS: ${{ steps.meta.outputs.tags }}
|
||||
DIGEST: ${{ steps.push.outputs.digest }}
|
||||
# This step uses the identity token to provision an ephemeral certificate
|
||||
# against the sigstore community Fulcio instance.
|
||||
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
|
||||
2
.github/workflows/docker-publish.yml
vendored
2
.github/workflows/docker-publish.yml
vendored
|
|
@ -7,7 +7,7 @@ name: Docker
|
|||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 5 * * 6' # 5 am on Saturdays
|
||||
- cron: '0 6 * * 6' # 6 am on Saturdays
|
||||
push:
|
||||
branches: [ "main", "testing", "testing-gpuscreenrecorder","testing-tags","newest-kernel", "lto-kernel", "lts-kernel" ]
|
||||
# Publish semver tags as releases.
|
||||
|
|
|
|||
135
.github/workflows/kernel-akmods.yml
vendored
Normal file
135
.github/workflows/kernel-akmods.yml
vendored
Normal file
|
|
@ -0,0 +1,135 @@
|
|||
name: kernel-akmods
|
||||
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
# They are provided by a third-party and are governed by
|
||||
# separate terms of service, privacy policy, and support
|
||||
# documentation.
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 4 * * *' # 4 am every day
|
||||
push:
|
||||
branches: [ "main" ]
|
||||
# Publish semver tags as releases.
|
||||
tags: [ 'v*.*.*' ]
|
||||
pull_request:
|
||||
branches: [ "main" ]
|
||||
|
||||
env:
|
||||
# Use docker.io for Docker Hub if empty
|
||||
REGISTRY: ghcr.io
|
||||
# github.repository as <account>/<repo>
|
||||
IMAGE_NAME: ${{ github.repository_owner }}/my-ostree-os-kernel-akmods
|
||||
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
|
||||
|
||||
|
||||
jobs:
|
||||
build:
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
# This is used to complete the identity challenge
|
||||
# with sigstore/fulcio when running outside of PRs.
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Maximize build space
|
||||
uses: AdityaGarg8/remove-unwanted-software@v1
|
||||
with:
|
||||
remove-dotnet: 'true'
|
||||
remove-android: 'true'
|
||||
remove-haskell: 'true'
|
||||
|
||||
- name: Get current date
|
||||
id: date
|
||||
run: echo "::set-output name=date::$(date +'%Y%m%d')"
|
||||
|
||||
- name: Test with environment variables
|
||||
run: echo $DATE
|
||||
env:
|
||||
DATE: ${{ steps.date.outputs.date }}
|
||||
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v3
|
||||
|
||||
# Install the cosign tool except on PR
|
||||
# https://github.com/sigstore/cosign-installer
|
||||
- name: Install cosign
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
|
||||
with:
|
||||
cosign-release: 'v2.1.1'
|
||||
|
||||
# Login against a Docker registry except on PR
|
||||
# https://github.com/docker/login-action
|
||||
- name: Log into registry ${{ env.REGISTRY }}
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# Extract metadata (tags, labels) for Docker
|
||||
# https://github.com/docker/metadata-action
|
||||
- name: Extract Docker metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
|
||||
|
||||
# Build image using Buildah action
|
||||
- name: Build Image
|
||||
id: build_image
|
||||
uses: redhat-actions/buildah-build@v2
|
||||
with:
|
||||
containerfiles: |
|
||||
./kernel-akmods.Dockerfile
|
||||
image: ${{ env.IMAGE_NAME }}
|
||||
tags: ${{ steps.meta.outputs.tags }} ${{ steps.meta.outputs.tags }}-38 ${{ steps.meta.outputs.tags }}-38.${{ steps.date.outputs.date }}
|
||||
oci: false
|
||||
|
||||
# Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
|
||||
# https://github.com/macbre/push-to-ghcr/issues/12
|
||||
- name: Lowercase Registry
|
||||
id: registry_case
|
||||
uses: ASzc/change-string-case-action@v5
|
||||
with:
|
||||
string: ${{ env.IMAGE_REGISTRY }}
|
||||
|
||||
# Push the image to GHCR (Image Registry)
|
||||
- name: Push To GHCR
|
||||
uses: redhat-actions/push-to-registry@v2
|
||||
id: push
|
||||
if: github.event_name != 'pull_request'
|
||||
env:
|
||||
REGISTRY_USER: ${{ github.actor }}
|
||||
REGISTRY_PASSWORD: ${{ github.token }}
|
||||
with:
|
||||
image: ${{ steps.build_image.outputs.image }}
|
||||
tags: ${{ steps.build_image.outputs.tags }}
|
||||
registry: ${{ steps.registry_case.outputs.lowercase }}
|
||||
username: ${{ env.REGISTRY_USER }}
|
||||
password: ${{ env.REGISTRY_PASSWORD }}
|
||||
extra-args: |
|
||||
--disable-content-trust
|
||||
|
||||
|
||||
|
||||
# Sign the resulting Docker image digest except on PRs.
|
||||
# This will only write to the public Rekor transparency log when the Docker
|
||||
# repository is public to avoid leaking data. If you would like to publish
|
||||
# transparency data even for private images, pass --force to cosign below.
|
||||
# https://github.com/sigstore/cosign
|
||||
- name: Sign the published Docker image
|
||||
if: ${{ github.event_name != 'pull_request' }}
|
||||
env:
|
||||
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
|
||||
TAGS: ${{ steps.meta.outputs.tags }}
|
||||
DIGEST: ${{ steps.push.outputs.digest }}
|
||||
# This step uses the identity token to provision an ephemeral certificate
|
||||
# against the sigstore community Fulcio instance.
|
||||
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
|
||||
20
base.Dockerfile
Normal file
20
base.Dockerfile
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
ARG IMAGE_NAME="${IMAGE_NAME:-kinoite}"
|
||||
ARG SOURCE_IMAGE="${SOURCE_IMAGE:-kinoite}"
|
||||
ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/${SOURCE_IMAGE}"
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-38}"
|
||||
|
||||
FROM ghcr.io/andersrh/my-ostree-os-kernel-akmods:main-38 AS builder
|
||||
|
||||
ARG IMAGE_NAME="${IMAGE_NAME}"
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION}"
|
||||
|
||||
|
||||
# 32-bit dependencies for the Nvidia driver.
|
||||
#RUN rpm-ostree install glibc.i686 mesa-dri-drivers.i686 mesa-filesystem.i686 mesa-libEGL.i686 mesa-libGL.i686 mesa-libgbm.i686 mesa-libglapi.i686 mesa-vulkan-drivers.i686
|
||||
# install nonfree codecs
|
||||
RUN rpm-ostree override remove libavcodec-free libavfilter-free libavformat-free libavutil-free libpostproc-free libswresample-free libswscale-free mesa-va-drivers --install libavcodec-freeworld
|
||||
RUN mv /etc/yum.repos.d/rpmfusion-free.repo /tmp/rpmfusion-free.repo && rpm-ostree install mesa-va-drivers-freeworld && mv /tmp/rpmfusion-free.repo /etc/yum.repos.d/rpmfusion-free.repo
|
||||
RUN rpm-ostree install ffmpeg ffmpeg-libs intel-media-driver pipewire-codec-aptx libva-intel-driver libva-utils
|
||||
|
||||
# install Nvidia software
|
||||
RUN rpm-ostree install nvidia-vaapi-driver nvidia-persistenced opencl-filesystem
|
||||
81
kernel-akmods.Dockerfile
Normal file
81
kernel-akmods.Dockerfile
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
ARG IMAGE_NAME="${IMAGE_NAME:-kinoite}"
|
||||
ARG SOURCE_IMAGE="${SOURCE_IMAGE:-kinoite}"
|
||||
ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/${SOURCE_IMAGE}"
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-38}"
|
||||
|
||||
FROM fedora:38 AS akmods-builder
|
||||
|
||||
RUN dnf -y update && dnf -y install wget
|
||||
|
||||
RUN dnf -y install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
|
||||
|
||||
# Update cachebust in case a rebuild is required without usage of cache.
|
||||
ARG CACHEBUST=9
|
||||
|
||||
RUN cd /etc/yum.repos.d/ && \
|
||||
wget https://copr.fedorainfracloud.org/coprs/bieszczaders/kernel-cachyos/repo/fedora-$(rpm -E %fedora)/bieszczaders-kernel-cachyos-fedora-$(rpm -E %fedora).repo && \
|
||||
wget https://copr.fedorainfracloud.org/coprs/bieszczaders/kernel-cachyos-addons/repo/fedora-$(rpm -E %fedora)/bieszczaders-kernel-cachyos-addons-fedora-$(rpm -E %fedora).repo && cd /tmp
|
||||
|
||||
RUN dnf -y install kernel-cachyos-bore-eevdf kernel-cachyos-bore-eevdf-headers kernel-cachyos-bore-eevdf-devel kernel-cachyos-bore-eevdf-modules kernel-cachyos-bore-eevdf-core kernel-cachyos-bore-eevdf-devel-matched
|
||||
RUN dnf -y install akmod-nvidia akmod-VirtualBox
|
||||
|
||||
COPY akmods.sh /tmp/akmods.sh
|
||||
RUN /tmp/akmods.sh
|
||||
|
||||
FROM ${BASE_IMAGE}:${FEDORA_MAJOR_VERSION} AS builder
|
||||
|
||||
ARG IMAGE_NAME="${IMAGE_NAME}"
|
||||
ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION}"
|
||||
|
||||
# install RPM-fusion
|
||||
RUN rpm-ostree install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
|
||||
|
||||
COPY --from=ghcr.io/ublue-os/akmods-nvidia:38-535 /rpms /tmp/akmods-rpms
|
||||
|
||||
RUN rpm-ostree install \
|
||||
/tmp/akmods-rpms/ublue-os/ublue-os-nvidia-addons-*.rpm
|
||||
|
||||
RUN mkdir /tmp/nvidia
|
||||
|
||||
COPY install-nvidia.sh /tmp/install-nvidia.sh
|
||||
|
||||
RUN cd /etc/yum.repos.d/ && wget https://copr.fedorainfracloud.org/coprs/bieszczaders/kernel-cachyos-addons/repo/fedora-$(rpm -E %fedora)/bieszczaders-kernel-cachyos-addons-fedora-$(rpm -E %fedora).repo
|
||||
|
||||
# add bore-sysctl and uksmd-lts
|
||||
RUN rpm-ostree install bore-sysctl uksmd
|
||||
|
||||
# enable systemd services
|
||||
|
||||
RUN systemctl enable uksmd.service
|
||||
|
||||
COPY --from=akmods-builder /var/cache/akmods/*/* /tmp/nvidia
|
||||
|
||||
RUN cd /etc/yum.repos.d/ && \
|
||||
wget https://copr.fedorainfracloud.org/coprs/bieszczaders/kernel-cachyos/repo/fedora-$(rpm -E %fedora)/bieszczaders-kernel-cachyos-fedora-$(rpm -E %fedora).repo && cd /tmp
|
||||
|
||||
# Enable cliwrap.
|
||||
RUN rpm-ostree cliwrap install-to-root / && \
|
||||
# Replace the kernel, kernel-core and kernel-modules packages.
|
||||
rpm-ostree override remove kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra --install kernel-cachyos-bore-eevdf
|
||||
|
||||
# install kernel headers
|
||||
RUN rpm-ostree override remove kernel-headers --install kernel-cachyos-bore-eevdf-headers
|
||||
|
||||
# install akmods
|
||||
RUN ls /tmp/nvidia && /tmp/install-nvidia.sh
|
||||
|
||||
RUN rpm-ostree install \
|
||||
xorg-x11-drv-nvidia{,-cuda,-devel,-kmodsrc} \
|
||||
xorg-x11-drv-nvidia-libs.i686 \
|
||||
nvidia-container-toolkit supergfxctl supergfxctl-plasmoid
|
||||
|
||||
RUN mv /etc/nvidia-container-runtime/config.toml{,.orig}
|
||||
RUN cp /etc/nvidia-container-runtime/config{-rootless,}.toml
|
||||
|
||||
RUN systemctl enable supergfxd.service
|
||||
|
||||
RUN rpm-ostree uninstall xorg-x11-drv-nvidia-power
|
||||
|
||||
RUN semodule --verbose --install /usr/share/selinux/packages/nvidia-container.pp
|
||||
RUN ln -s /usr/bin/ld.bfd /etc/alternatives/ld
|
||||
RUN ln -s /etc/alternatives/ld /usr/bin/ld
|
||||
Loading…
Add table
Add a link
Reference in a new issue