2.4. 使用 podman build 构建自定义镜像

流程

1. 创建 Containerfile，例如：

   $ cat Containerfile
   FROM registry.redhat.io/rhel9/rhel-bootc:9.6
   
   # Packages
   RUN dnf install -y zsh && dnf clean all
   
   # Group install
   RUN dnf group -y install "Development Tools"
   
   # Hostname
   RUN echo "rock.paper.scissor" > /etc/hostname
   
   # Kernel
   RUN mkdir -p /usr/lib/bootc/kargs.d
   RUN cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml
   kargs = ["console=ttyS0,114800n8","kernel-debug"]
   match-architectures = ["x86_64"]
   EOF
   
   # Subscription-manager
   RUN dnf install subscription-manager
   
   # RPM config
   RUN mkdir -p /etc/pki/rpm-gpg/
   COPY <host_path>/gpg_key /etc/pki/rpm-gpg/gpg_key
   
   # Timezones
   RUN cat <<EOF >> /etc/localtime
   Asia/Bangkok
   EOF
   
   
   # Locale
   RUN cat <<EOF >> /etc/locale.conf
   LANG="en_US.UTF-8"
   EOF && \
   cat <<EOF >> /etc/vconsole.conf
   KEYMAP=us
   EOF
   
   
   # firewall
   RUN dnf install -y firewalld && \
       mkdir -p /etc/firewalld/zones
   RUN cat <<EOF >> /etc/firewalld/zones/customzone.xml
   <?xml version="1.0" encoding="utf-8"?>
   <zone>
       <short>Customzone</short>
       <description>Custom firewall rules for the container.</description>
   
       <!-- Allowed services -->
       <service name="ftp"/>
       <service name="ntp"/>
       <service name="dhcp"/>
   
       <!-- Blocked services (not explicitly listed) -->
       <!-- Removing telnet explicitly is unnecessary if it is not included -->
   
       <!-- Open specific ports -->
       <port protocol="tcp" port="22"/>
       <port protocol="tcp" port="80"/>
       <port protocol="tcp" port="53"/>
       <port protocol="udp" port="53"/>
       <port protocol="tcp" port="30000-32767"/>
       <port protocol="udp" port="30000-32767"/>
   </zone>
   EOF
   RUN firewall-offline-cmd --set-default-zone=customzone
   
   # systemd services
   RUN systemctl enable sshd
   
   #ignition
   RUN mkdir -p /usr/lib/bootc/kargs.d && \
   cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml
   kargs = ["ignition.config.url=http://192.168.122.1/fiot.ign","rd.neednet=1"]
   EOF
   
   #fdo
   RUN dnf install -y fdo-init fdo-client && \
   systemctl enable fdo-client-linuxapp.service
   
   #Repositories
   RUN mkdir -p /etc/yum.repos.d
   COPY custom.repo /etc/yum.repos.d/custom.repo
   
   #fips
   RUN mkdir -p /usr/lib/bootc/kargs.d && \
   cat <<EOF >>  /usr/lib/bootc/kargs.d/01-fips.toml
   kargs = ["fips=1"]
   EOF
   RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS

   Copy to Clipboard

2. 使用当前目录中的 Containerfile 构建 <image> 镜像：

   $ podman build -t quay.io/<namespace>/<image>:<tag> .

   Copy to Clipboard

流程

1. 创建 Containerfile。以下示例包含多个可以用作示例的自定义，如果它不适合您的要求，可以删除它。

   $ cat Containerfile
   FROM registry.redhat.io/rhel10/rhel-bootc:10.0
   
   # Packages
   RUN dnf install -y zsh && dnf clean all
   
   # Group install
   RUN dnf group -y install "Development Tools"
   
   # Kernel
   RUN mkdir -p /usr/lib/bootc/kargs.d
   RUN cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml
   kargs = ["console=ttyS0,114800n8","kernel-debug"]
   match-architectures = ["x86_64"]
   EOF
   
   # Subscription-manager
   COPY ./rhsm.conf /etc/rhsm/rhsm.conf
   
   # RPM config
   RUN mkdir -p /etc/pki/rpm-gpg/
   COPY <host_path>/gpg_key /etc/pki/rpm-gpg//gpg_key
   
   # Additional groups
   RUN groupadd -g 1001 widget
   
   # Timezones
   RUN ln -sf /usr/share/zoneinfo/Asia/Bangkok /etc/localtime
   
   # Locale
   RUN cat <<EOF >> /etc/locale.conf
   LANG="en_US.UTF-8"
   EOF && \
   cat <<EOF >> /etc/vconsole.conf
   KEYMAP=us
   EOF
   
   
   # firewall
   RUN dnf install -y firewalld && \
       dnf clean all && \
       firewall-offline-cmd --new-zone=customzone && \
       firewall-offline-cmd --zone=customzone --set-description="Custom firewall rules for the container" && \
       firewall-offline-cmd --zone=customzone --add-service=ftp && \
       firewall-offline-cmd --zone=customzone --add-service=ntp && \
       firewall-offline-cmd --zone=customzone --add-service=dhcp && \
       firewall-offline-cmd --zone=customzone --add-port=22/tcp && \
       firewall-offline-cmd --zone=customzone --add-port=80/tcp && \
       firewall-offline-cmd --zone=customzone --add-port=53/tcp && \
       firewall-offline-cmd --zone=customzone --add-port=53/udp && \
       firewall-offline-cmd --zone=customzone --add-port=30000-32767/tcp && \
       firewall-offline-cmd --zone=customzone --add-port=30000-32767/udp && \
       firewall-offline-cmd --set-default-zone=customzone
   
   # systemd services
   RUN systemctl enable httpd sshd && \
   systemctl disable telnetd && \
   systemctl mask rcpbind

   Copy to Clipboard

2. 使用当前目录中的 Containerfile 构建 <image> 镜像：

   $ podman build -t quay.io/<namespace>/<image>:<tag> .

   Copy to Clipboard