babbarc/workspaces
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: re-organize the code into clear separate sections and use acls

Browse Source
This commit is contained in:
yeti
2025-04-17 18:33:43 +01:00
parent bdc94735f2
commit 6d5018ab15
1 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
build-workspace.sh
View File

@ -14,16 +14,17 @@ ctr=$(buildah from archlinux)
buildah run "$ctr" -- bash -c "\ buildah run "$ctr" -- bash -c "\
pacman -Sy --noconfirm && pacman -S --noconfirm neovim git zsh tmux podman \ pacman -Sy --noconfirm && pacman -S --noconfirm neovim git zsh tmux podman \
fzf fd ripgrep jdk-openjdk && pacman -Scc --noconfirm && \ fzf fd ripgrep jdk-openjdk && pacman -Scc --noconfirm && \
useradd -ms /bin/zsh $DEV_USER && \ groupadd secproc && useradd -ms /bin/zsh -G secproc $DEV_USER && \
useradd --system --no-create-home --shell /usr/sbin/nologin viewer && \ useradd --system --no-create-home -s /usr/sbin/nologin -G $DEV_USER viewer && \
usermod -aG $DEV_USER viewer && mkdir -p /tmp/tmux-shared && \ mkdir -p /tmp/tmux-shared && chown -R $DEV_USER:$DEV_USER /tmp/tmux-shared && \
mkdir -p $DEV_HOME/.gnupg && mkdir -p $SECURE mkdir -p $SECURE && chmod -R 500 $SECURE && \
mkdir /app && chmod 700 /app && chown $DEV_USER:$DEV_USER /app
" "
# copy start script # copy start script
buildah copy "$ctr" start.sh /start.sh buildah copy "$ctr" start.sh $DEV_HOME/start.sh
# copy ssh setup # copy ssh setup
buildah copy "$ctr" ssh "$SECURE"/ssh buildah copy "$ctr" ssh $SECURE/ssh
# copy zshrc, neovim and tmux setup # copy zshrc, neovim and tmux setup
buildah copy "$ctr" zshrc $DEV_HOME/.zshrc buildah copy "$ctr" zshrc $DEV_HOME/.zshrc
@ -32,21 +33,17 @@ buildah copy "$ctr" local $DEV_HOME/.local
# zsh and tmux config (immutable) # zsh and tmux config (immutable)
buildah run "$ctr" -- bash -c " buildah run "$ctr" -- bash -c "
find $DEV_HOME -type f -exec chmod 400 {} + && \
find $DEV_HOME -type f -exec chattr +i {} + && \
find $DEV_HOME -type d -exec chmod 700 {} + && \
chmod 750 /tmp/tmux-shared && chmod -R 500 $SECURE && \
chmod +x /start.sh && \
chown -R $DEV_USER:$DEV_USER $DEV_HOME && \ chown -R $DEV_USER:$DEV_USER $DEV_HOME && \
chattr -R +x $DEV_HOME && chattr +x /tmp/tmux-shared && \ find $DEV_HOME -type f -exec chmod 750 {} + && \
chown -R $DEV_USER:$DEV_USER /tmp/tmux-shared find $DEV_HOME -type f -exec chown root:secproc {} + && \
setfacl -R -m u:devuser:--x $DEV_HOME && \
" "
buildah config \ buildah config \
--user $DEV_USER \ --user $DEV_USER \
--workingdir /app \ --workingdir /app \
--env CONTAINER_HOST=unix:///run/podman/podman.sock \ --env CONTAINER_HOST=unix:///run/podman/podman.sock \
--cmd "/start.sh" \ --cmd "$DEV_HOME/start.sh" \
"$ctr" "$ctr"
buildah commit "$ctr" $IMG_NAME buildah commit "$ctr" $IMG_NAME