Get image id.

BuildKit is having issues with caching which is causing issues with the long builds like compiling emacs from source.

task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml

@@ -0,0 +1,184 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: buildah
+  labels:
+    app.kubernetes.io/version: "0.1"
+  annotations:
+    tekton.dev/categories: Image Build
+    tekton.dev/pipelines.minVersion: "0.12.1"
+    tekton.dev/tags: image-build
+    tekton.dev/displayName: "Build a docker image with buildah."
+    tekton.dev/platforms: "linux/amd64"
+    container.apparmor.security.beta.kubernetes.io/step-build-and-push: unconfined
+spec:
+  description: >-
+    This task will build a docker image using buildah and push the result to an image registry.
+  workspaces:
+    - name: source
+      mountPath: /source
+      readOnly: true
+    - name: dockerconfig
+      description: Includes credentials for the docker image registry.
+      optional: true
+      mountPath: /home/build/.docker
+  params:
+    - name: OUTPUT
+      type: string
+      description: Argument to output flag for `buildctl build`
+      # Examples:
+      #   type=image,name=harbor.mydomain.example/private/foo:3.45,push=true,compression=zstd,compression-level=22
+      #   type=image,"name=harbor.mydomain.example/private/foo:latest,harbor.mydomain.example/private/foo:3.45",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
+    - name: CONTEXT
+      type: string
+      description: Path to the docker context.
+      default: "."
+    - name: DOCKERFILE
+      type: string
+      description: Path to the Dockerfile relative to the context.
+      default: "Dockerfile"
+    - name: BUILDER_IMAGE
+      type: string
+      description: Docker image containing Buildah.
+      default: "quay.io/buildah/stable:v1"
+    - name: EXTRA_ARGS
+      type: array
+      description: Arguments passed to the build command.
+      default: []
+    - name: REGISTRIES_CONF
+      type: string
+      description: Contents of registries.conf.
+      default: ""
+  results:
+    - name: IMAGE_DIGEST
+      description: Digest of the docker image.
+    - name: IMAGE_URL
+      description: Full URL to the docker image.
+      type: array
+  volumes:
+    - name: config-containers
+      emptyDir: {}
+    - name: metadata-out
+      emptyDir: {}
+  steps:
+    - name: write-config
+      image: $(params.BUILDER_IMAGE)
+      workingDir: "$(workspaces.source.path)"
+      script: |
+        #!/usr/bin/env sh
+        set -euo pipefail
+        echo ""
+        # ls -l /home/build/.local/share/containers
+        echo ""
+        tee /home/build/.config/containers/registries.conf <<EOF
+        $(params.REGISTRIES_CONF)
+        EOF
+
+        cat > /home/build/.config/containers/entrypoint.sh <<EOF
+        #!/usr/bin/env sh
+        #
+        set -xeuo pipefail
+
+        echo "Running as `id`"
+
+        # mkdir -p /home/build/.local/share/containers
+        # ln -s /workspace/buildah-storage /home/build/.local/share/containers/storage
+        # ln -s $(workspaces.buildah-storage.path) /home/build/.local/share/containers/storage
+        # ls -lR /home/build/.local/share/containers
+
+        cp /home/build/.config/containers_mount/registries.conf /home/build/.config/containers/
+
+        additional_args=(--source-date-epoch 100
+                         --layers
+                         --storage-driver overlay)
+
+        if [ -n "\$(find /tekton/creds/.ssh -maxdepth 1 -name 'id_*' -print -quit)" ]; then
+            eval \$(ssh-agent)
+            ssh-add /tekton/creds/.ssh/id_*
+            additional_args+=(--ssh default=\$SSH_AUTH_SOCK)
+        fi
+
+        buildah build "\${additional_args[@]}" "\${@}"
+        exec buildah push --storage-driver overlay $(params.OUTPUT)
+
+        EOF
+        chmod +x /home/build/.config/containers/entrypoint.sh
+      volumeMounts:
+        - name: config-containers
+          mountPath: /home/build/.config/containers
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+    - name: build-and-push
+      image: $(params.BUILDER_IMAGE)
+      workingDir: "$(workspaces.source.path)"
+      command: ["/home/build/.config/containers_mount/entrypoint.sh"]
+      args:
+        - --file
+        - $(params.DOCKERFILE)
+        - --tag
+        - $(params.OUTPUT)
+        - --iidfile
+        - /home/build/.metadata/image_id
+        - $(params.EXTRA_ARGS)
+        - $(workspaces.source.path)/$(params.CONTEXT)
+      volumeMounts:
+        - name: config-containers
+          mountPath: /home/build/.config/containers_mount
+          readOnly: true
+        - name: metadata-out
+          mountPath: /home/build/.metadata
+      # computeResources:
+      #   requests:
+      #     # cpu: 10m
+      #     # memory: 600Mi
+      #     ephemeral-storage: 100Mi
+      securityContext:
+        seccompProfile:
+          type: Unconfined
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        # capabilities:
+        #   add:
+        #     - all
+        #     # - SETUID
+        #     # - SETGID
+        #     # - SYS_CHROOT
+        #     # - SETFCAP
+        # appArmorProfile:
+        #   type: Unconfined
+      computeResources:
+        requests:
+          ephemeral-storage: 1200Mi
+      env:
+        - name: DOCKER_CONFIG
+          value: $(workspaces.dockerconfig.path)
+        # - name: BUILDAH_ISOLATION
+        #   value: chroot
+        - name: STORAGE_DRIVER
+          value: overlay
+          # value: vfs
+    - name: read-metadata
+      image: python:3.13-alpine3.20
+      workingDir: "$(workspaces.source.path)"
+      # at this point /home/build/.metadata/image_id has contents like:
+      #   sha256:7102ad507cf1b0c8adfa99a081ddfd0b5dc11e2d971162316753a58ce2b7f6ca
+      script: |
+        #!/usr/bin/env python
+        import json
+        with open("/home/build/.metadata/image_id", "r") as f:
+            image_id = f.read()
+        with open("$(results.IMAGE_DIGEST.path)", "w") as f:
+            print(json.dumps([image_id]), file=f, end="")
+        with open("$(results.IMAGE_URL.path)", "w") as f:
+            print(json.dumps(["$(params.OUTPUT)"]), file=f, end="")
+      volumeMounts:
+        - name: metadata-out
+          mountPath: /home/build/.metadata
+          readOnly: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000

task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml

@@ -40,8 +40,7 @@ spec:
     - name: BUILDER_IMAGE
       type: string
       description: Docker image containing BuildKit.
-      default: "moby/buildkit:v0.17.0-rc1-rootless"
+      default: "moby/buildkit:v0.31.1-rootless"
-      # or v0.16.0-rootless
     - name: EXTRA_ARGS
       type: array
       description: Arguments passed to the build command.
@@ -57,8 +56,6 @@ spec:
       description: Full URL to the docker image.
       type: array
   volumes:
-    - name: buildkitd
-      emptyDir: {}
     - name: buildkitd-toml
       emptyDir: {}
     - name: metadata-out
@@ -87,8 +84,6 @@ spec:
         EOF
         chmod +x /home/user/.config/buildkit/entrypoint.sh
       volumeMounts:
-        - name: buildkitd
-          mountPath: /home/user/.local/share/buildkit
         - name: buildkitd-toml
           mountPath: /home/user/.config/buildkit
       securityContext:
@@ -112,8 +107,6 @@ spec:
         - /home/user/.metadata/build.json
         - $(params.EXTRA_ARGS)
       volumeMounts:
-        - name: buildkitd
-          mountPath: /home/user/.local/share/buildkit
         - name: buildkitd-toml
           mountPath: /home/user/.config/buildkit
           readOnly: true

task/git-clone/0.1/git-clone.yaml

@@ -0,0 +1,60 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: git-clone
+  labels:
+    app.kubernetes.io/version: "0.1"
+  annotations:
+    tekton.dev/categories: SCM
+    tekton.dev/pipelines.minVersion: "1.12.1"
+    tekton.dev/tags: scm
+    tekton.dev/displayName: "Clone a git repository."
+    tekton.dev/platforms: "linux/amd64"
+spec:
+  description: >-
+    This task will clone a git repository.
+  workspaces:
+    - name: output
+      mountPath: /output
+      readOnly: false
+  params:
+    - name: url
+      type: string
+      description: The repository url to clone.
+    - name: revision
+      type: string
+      description: The revision to clone.
+    - name: IMAGE
+      type: string
+      description: Docker image to use for performing the clone.
+      default: "alpine/git:v2.54.0"
+  results:
+    - name: commit
+      type: string
+      description: The commit hash that was cloned.
+    - name: url
+      type: string
+      description: The URL to the git repo.
+    - name: committer-date
+      type: string
+      description: The time of the git commit in unix timestamp format.
+  steps:
+    - name: fetch-repository-step
+      image: $(params.IMAGE)
+      workingDir: "$(workspaces.output.path)"
+      script: |
+        #!/usr/bin/env sh
+        set -euo pipefail
+        export GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new"
+        git init --initial-branch=main
+        git remote add origin $(params.url)
+        git fetch -v origin $(params.revision)
+        git checkout FETCH_HEAD
+
+        echo -n $(git rev-parse HEAD) > $(results.commit.path)
+        echo -n "$(params.url)" > $(results.url.path)
+        echo -n "$(git log -1 --pretty=%ct)" > $(results.committer-date.path)
+      # securityContext:
+      #   runAsNonRoot: true
+      #   runAsUser: 1000
+      #   runAsGroup: 1000