Add a buildkit-cache workspace for preserving the buildkit cache between builds.

task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml

@@ -1,184 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: buildah
-  labels:
-    app.kubernetes.io/version: "0.1"
-  annotations:
-    tekton.dev/categories: Image Build
-    tekton.dev/pipelines.minVersion: "0.12.1"
-    tekton.dev/tags: image-build
-    tekton.dev/displayName: "Build a docker image with buildah."
-    tekton.dev/platforms: "linux/amd64"
-    container.apparmor.security.beta.kubernetes.io/step-build-and-push: unconfined
-spec:
-  description: >-
-    This task will build a docker image using buildah and push the result to an image registry.
-  workspaces:
-    - name: source
-      mountPath: /source
-      readOnly: true
-    - name: dockerconfig
-      description: Includes credentials for the docker image registry.
-      optional: true
-      mountPath: /home/build/.docker
-  params:
-    - name: OUTPUT
-      type: string
-      description: Argument to output flag for `buildctl build`
-      # Examples:
-      #   type=image,name=harbor.mydomain.example/private/foo:3.45,push=true,compression=zstd,compression-level=22
-      #   type=image,"name=harbor.mydomain.example/private/foo:latest,harbor.mydomain.example/private/foo:3.45",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
-    - name: CONTEXT
-      type: string
-      description: Path to the docker context.
-      default: "."
-    - name: DOCKERFILE
-      type: string
-      description: Path to the Dockerfile relative to the context.
-      default: "Dockerfile"
-    - name: BUILDER_IMAGE
-      type: string
-      description: Docker image containing Buildah.
-      default: "quay.io/buildah/stable:v1"
-    - name: EXTRA_ARGS
-      type: array
-      description: Arguments passed to the build command.
-      default: []
-    - name: REGISTRIES_CONF
-      type: string
-      description: Contents of registries.conf.
-      default: ""
-  results:
-    - name: IMAGE_DIGEST
-      description: Digest of the docker image.
-    - name: IMAGE_URL
-      description: Full URL to the docker image.
-      type: array
-  volumes:
-    - name: config-containers
-      emptyDir: {}
-    - name: metadata-out
-      emptyDir: {}
-  steps:
-    - name: write-config
-      image: $(params.BUILDER_IMAGE)
-      workingDir: "$(workspaces.source.path)"
-      script: |
-        #!/usr/bin/env sh
-        set -euo pipefail
-        echo ""
-        # ls -l /home/build/.local/share/containers
-        echo ""
-        tee /home/build/.config/containers/registries.conf <<EOF
-        $(params.REGISTRIES_CONF)
-        EOF
-
-        cat > /home/build/.config/containers/entrypoint.sh <<EOF
-        #!/usr/bin/env sh
-        #
-        set -xeuo pipefail
-
-        echo "Running as `id`"
-
-        # mkdir -p /home/build/.local/share/containers
-        # ln -s /workspace/buildah-storage /home/build/.local/share/containers/storage
-        # ln -s $(workspaces.buildah-storage.path) /home/build/.local/share/containers/storage
-        # ls -lR /home/build/.local/share/containers
-
-        cp /home/build/.config/containers_mount/registries.conf /home/build/.config/containers/
-
-        additional_args=(--source-date-epoch 100
-                         --layers
-                         --storage-driver overlay)
-
-        if [ -n "\$(find /tekton/creds/.ssh -maxdepth 1 -name 'id_*' -print -quit)" ]; then
-            eval \$(ssh-agent)
-            ssh-add /tekton/creds/.ssh/id_*
-            additional_args+=(--ssh default=\$SSH_AUTH_SOCK)
-        fi
-
-        buildah build "\${additional_args[@]}" "\${@}"
-        exec buildah push --storage-driver overlay $(params.OUTPUT)
-
-        EOF
-        chmod +x /home/build/.config/containers/entrypoint.sh
-      volumeMounts:
-        - name: config-containers
-          mountPath: /home/build/.config/containers
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-    - name: build-and-push
-      image: $(params.BUILDER_IMAGE)
-      workingDir: "$(workspaces.source.path)"
-      command: ["/home/build/.config/containers_mount/entrypoint.sh"]
-      args:
-        - --file
-        - $(params.DOCKERFILE)
-        - --tag
-        - $(params.OUTPUT)
-        - --iidfile
-        - /home/build/.metadata/image_id
-        - $(params.EXTRA_ARGS)
-        - $(workspaces.source.path)/$(params.CONTEXT)
-      volumeMounts:
-        - name: config-containers
-          mountPath: /home/build/.config/containers_mount
-          readOnly: true
-        - name: metadata-out
-          mountPath: /home/build/.metadata
-      # computeResources:
-      #   requests:
-      #     # cpu: 10m
-      #     # memory: 600Mi
-      #     ephemeral-storage: 100Mi
-      securityContext:
-        seccompProfile:
-          type: Unconfined
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        # capabilities:
-        #   add:
-        #     - all
-        #     # - SETUID
-        #     # - SETGID
-        #     # - SYS_CHROOT
-        #     # - SETFCAP
-        # appArmorProfile:
-        #   type: Unconfined
-      computeResources:
-        requests:
-          ephemeral-storage: 1200Mi
-      env:
-        - name: DOCKER_CONFIG
-          value: $(workspaces.dockerconfig.path)
-        # - name: BUILDAH_ISOLATION
-        #   value: chroot
-        - name: STORAGE_DRIVER
-          value: overlay
-          # value: vfs
-    - name: read-metadata
-      image: python:3.13-alpine3.20
-      workingDir: "$(workspaces.source.path)"
-      # at this point /home/build/.metadata/image_id has contents like:
-      #   sha256:7102ad507cf1b0c8adfa99a081ddfd0b5dc11e2d971162316753a58ce2b7f6ca
-      script: |
-        #!/usr/bin/env python
-        import json
-        with open("/home/build/.metadata/image_id", "r") as f:
-            image_id = f.read()
-        with open("$(results.IMAGE_DIGEST.path)", "w") as f:
-            print(json.dumps([image_id]), file=f, end="")
-        with open("$(results.IMAGE_URL.path)", "w") as f:
-            print(json.dumps(["$(params.OUTPUT)"]), file=f, end="")
-      volumeMounts:
-        - name: metadata-out
-          mountPath: /home/build/.metadata
-          readOnly: true
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000

task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml

@@ -22,6 +22,10 @@ spec:
       description: Includes credentials for the docker image registry.
       optional: true
       mountPath: /home/user/.docker
+    - name: buildkit-cache
+      description: For preserving buildkit type=cache mounts between builds.
+      optional: true
+      mountPath: /home/user/.local/share/buildkit
   params:
     - name: OUTPUT
       type: string
@@ -40,7 +44,8 @@ spec:
     - name: BUILDER_IMAGE
       type: string
       description: Docker image containing BuildKit.
-      default: "moby/buildkit:v0.31.1-rootless"
+      default: "moby/buildkit:v0.17.0-rc1-rootless"
+      # or v0.16.0-rootless
     - name: EXTRA_ARGS
       type: array
       description: Arguments passed to the build command.
@@ -61,6 +66,18 @@ spec:
     - name: metadata-out
       emptyDir: {}
   steps:
+    - name: setup-cache-ownership
+      image: $(params.BUILDER_IMAGE)
+      workingDir: "$(workspaces.source.path)"
+      script: |
+        #!/usr/bin/env sh
+        set -euo pipefail
+        chown 1000:1000 /home/user/.local/share/buildkit
+        chmod 0777 /home/user/.local/share/buildkit
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+        runAsGroup: 0
     - name: write-config
       image: $(params.BUILDER_IMAGE)
       workingDir: "$(workspaces.source.path)"

task/git-clone/0.1/git-clone.yaml

@@ -1,60 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: git-clone
-  labels:
-    app.kubernetes.io/version: "0.1"
-  annotations:
-    tekton.dev/categories: SCM
-    tekton.dev/pipelines.minVersion: "1.12.1"
-    tekton.dev/tags: scm
-    tekton.dev/displayName: "Clone a git repository."
-    tekton.dev/platforms: "linux/amd64"
-spec:
-  description: >-
-    This task will clone a git repository.
-  workspaces:
-    - name: output
-      mountPath: /output
-      readOnly: false
-  params:
-    - name: url
-      type: string
-      description: The repository url to clone.
-    - name: revision
-      type: string
-      description: The revision to clone.
-    - name: IMAGE
-      type: string
-      description: Docker image to use for performing the clone.
-      default: "alpine/git:v2.54.0"
-  results:
-    - name: commit
-      type: string
-      description: The commit hash that was cloned.
-    - name: url
-      type: string
-      description: The URL to the git repo.
-    - name: committer-date
-      type: string
-      description: The time of the git commit in unix timestamp format.
-  steps:
-    - name: fetch-repository-step
-      image: $(params.IMAGE)
-      workingDir: "$(workspaces.output.path)"
-      script: |
-        #!/usr/bin/env sh
-        set -euo pipefail
-        export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new"
-        git init --initial-branch=main
-        git remote add origin $(params.url)
-        git fetch -v origin $(params.revision)
-        git checkout FETCH_HEAD
-
-        echo -n $(git rev-parse HEAD) > $(results.commit.path)
-        echo -n "$(params.url)" > $(results.url.path)
-        echo -n "$(git log -1 --pretty=%ct)" > $(results.committer-date.path)
-      # securityContext:
-      #   runAsNonRoot: true
-      #   runAsUser: 1000
-      #   runAsGroup: 1000