rmcguireandClaude Opus 5
1878df96ac
Set up this repo as a base image registry. Each image is self-contained in
its own directory under images/ (Dockerfile + README.md + optional test.sh);
CI discovers them by glob, so adding an image needs no workflow changes.
template/ is the skeleton to copy.
The Makefile is the single entry point for both local work and CI, so a green
`make all` locally means a green pipeline.
Workflows:
* lint.yaml — layout check, hadolint, shellcheck
* build.yaml — diffs against the base commit to build only the images that
changed, smoke-tests each one before anything is published, then pushes.
Releases are per-image tags (<image>/vX.Y.Z); main publishes :edge.
First image, node-agent: node:22-alpine plus a GNU userland (Alpine ships
BusyBox, whose applets take narrower flags than scripts and models expect),
helm, kubectl, jq, yq, bind-tools, curl, git, ripgrep, fd and friends.
Nothing is version-pinned — rebuilding is how upstream updates land, and the
published tag is what pins things for consumers.
Its smoke test asserts the deployment contract as well as tool presence: the
image must work non-root, with a read-only root filesystem and all
capabilities dropped, which is how ToolHive runs it.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
30 lines
863 B
Bash
Executable File
30 lines
863 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Smoke-test skeleton. Optional, but CI runs it whenever it exists and is
|
|
# executable, so it is the cheapest place to assert what the image promises.
|
|
#
|
|
# Usage: test.sh [image-ref]
|
|
set -euo pipefail
|
|
|
|
REF="${1:?usage: test.sh <image-ref>}"
|
|
echo "==> smoke-testing ${REF}"
|
|
|
|
# Run the checks in one container. Mirror the securityContext the image is
|
|
# actually deployed with, so CI catches read-only or non-root breakage.
|
|
docker run --rm --interactive \
|
|
--read-only \
|
|
--tmpfs /tmp:rw,size=64m \
|
|
"$REF" bash -s <<'INNER'
|
|
set -uo pipefail
|
|
fail=0
|
|
|
|
ok() { printf ' \033[32mok\033[0m %s\n' "$1"; }
|
|
bad() { printf ' \033[31mFAIL\033[0m %s\n' "$1"; fail=1; }
|
|
|
|
for t in bash; do
|
|
command -v "$t" >/dev/null 2>&1 && ok "$t" || bad "$t (not on PATH)"
|
|
done
|
|
|
|
[ "$fail" = 0 ] && echo "all checks passed" || echo "FAILURES above"
|
|
exit "$fail"
|
|
INNER
|