Containerfile.overlay

# Containerfile.overlay — Unified hardware-specific image overlays.
#
# Parameterized by OVERLAY_TYPE
# (hwe|nvidia|cachyos|asahi|hardware) and DESKTOP_FLAVOR. OVERLAY_TYPE=hardware
# applies the [hardware.<id>] profile named by HARDWARE_PROFILE
# (build_scripts/overlay/hardware-profile.sh).
#
# Usage (via Justfile):
#   buildah build --build-arg OVERLAY_TYPE=hwe --target=desktop ...
#   buildah build --build-arg OVERLAY_TYPE=nvidia --target=desktop ...
#   buildah build --build-arg OVERLAY_TYPE=asahi --target=desktop ...   # aarch64 only
#   buildah build --build-arg OVERLAY_TYPE=hardware --build-arg HARDWARE_PROFILE=<id> --target=desktop ...

ARG BASE_IMAGE
ARG IMAGE_NAME
ARG IMAGE_VENDOR
ARG SHA_HEAD_SHORT
ARG ENABLE_HWE="${ENABLE_HWE:-0}"
ARG ENABLE_NVIDIA="${ENABLE_NVIDIA:-0}"
ARG ENABLE_SSHD="${ENABLE_SSHD:-0}"
ARG DESKTOP_FLAVOR="${DESKTOP_FLAVOR:-gnome}"
ARG TUNAOS_IMAGE_FLAVOR
ARG AKMODS_VERSION="${AKMODS_VERSION:-centos-10}"
ARG AKMODS_NVIDIA_VERSION="${AKMODS_NVIDIA_VERSION:-${AKMODS_VERSION}}"
ARG OVERLAY_TYPE="hwe"
ARG HARDWARE_PROFILE
ARG COMMON_IMAGE_REF
ARG BREW_IMAGE_REF
ARG AKMODS_BASE="ghcr.io/ublue-os"
ARG IMAGE_REGISTRY="ghcr.io"
ARG IMAGE_NAME_VARIANT

FROM ${AKMODS_BASE}/akmods-nvidia-open:${AKMODS_NVIDIA_VERSION} AS akmods_nvidia_open
FROM ${COMMON_IMAGE_REF} AS common
FROM ${BREW_IMAGE_REF} AS brew

FROM scratch as context
COPY system_files /files
COPY --from=brew /system_files /files
COPY --from=common /system_files/shared /files
COPY system_files_overrides /overrides
COPY build_scripts /build_scripts

# ==============================================================================
# Overlay base stage — applies HWE or NVIDIA packages to the parent image.
# The parent (${BASE_IMAGE}) is typically a DE image (e.g. yellowfin:gnome)
# that already has the desktop environment installed. This stage only adds
# the kernel/driver layer.
# ==============================================================================
FROM ${BASE_IMAGE} AS overlay-base

ARG BASE_IMAGE
ARG IMAGE_NAME
ARG IMAGE_VENDOR
ARG IMAGE_NAME_VARIANT
ARG SHA_HEAD_SHORT
ARG ENABLE_HWE
ARG ENABLE_NVIDIA
ARG ENABLE_SSHD
ARG DESKTOP_FLAVOR
ARG TUNAOS_IMAGE_FLAVOR
ENV TUNAOS_IMAGE_FLAVOR=${TUNAOS_IMAGE_FLAVOR}
ARG OVERLAY_TYPE
ARG HARDWARE_PROFILE
ENV IMAGE_REGISTRY=${IMAGE_REGISTRY}
ENV BASE_IMAGE=${BASE_IMAGE}
ENV IMAGE_NAME=${IMAGE_NAME}
ENV IMAGE_VENDOR=${IMAGE_VENDOR}
ENV IMAGE_NAME_VARIANT=${IMAGE_NAME_VARIANT}
ENV SHA_HEAD_SHORT=${SHA_HEAD_SHORT}
ENV ENABLE_HWE=${ENABLE_HWE}
ENV ENABLE_NVIDIA=${ENABLE_NVIDIA}
ENV ENABLE_SSHD=${ENABLE_SSHD}
ENV DESKTOP_FLAVOR=${DESKTOP_FLAVOR}

RUN rm -rf /opt && mkdir /opt

RUN \
  --mount=type=tmpfs,dst=/opt \
  --mount=type=tmpfs,dst=/tmp \
  --mount=type=tmpfs,dst=/boot \
  --mount=type=bind,from=akmods_nvidia_open,src=/rpms,dst=/tmp/akmods-nvidia-open-rpms \
  --mount=type=bind,from=akmods_nvidia_open,src=/kernel-rpms,dst=/tmp/kernel-rpms \
  --mount=type=bind,from=context,source=/,target=/run/context \
    bash -c 'case "${OVERLAY_TYPE}" in \
      hwe) /run/context/build_scripts/overlay/hwe.sh ;; \
      cachyos) /run/context/build_scripts/overlay/cachyos.sh ;; \
      asahi) /run/context/build_scripts/overlay/asahi.sh ;; \
      hardware) /run/context/build_scripts/overlay/hardware-profile.sh "${HARDWARE_PROFILE}" ;; \
      nvidia) /run/context/build_scripts/overlay/nvidia.sh ;; \
      *) printf "unsupported overlay type: %s\n" "${OVERLAY_TYPE}" >&2; exit 2 ;; \
    esac'
# The second akmods mount above is the kmod↔kernel alignment mechanism: every
# ublue akmods image ships BOTH /rpms (the kmods) and /kernel-rpms (the exact
# kernel those kmods were built against — akmods' Containerfile.in copies
# both into the final scratch stage). The nvidia overlay swaps the image's
# kernel to that one (overrides/nvidia/10-kernel-swap.sh) BEFORE installing
# the kmod, so the exact-EVR install cannot miss: equality by construction,
# the same shape bluefin-lts uses (its base build runs kernel-swap.sh from
# the akmods kernel-rpms mount). First-contact evidence for why hoping the
# base kernel matches does not work: yellowfin ships AlmaLinux Kitten
# 6.12.0-250.el10 while akmods-nvidia-open:centos-10 carried kmods for a
# different CentOS kernel, and the kde-nvidia proof build died on the glob
# (run 31189433990).

# ==============================================================================
# Desktop target — single parameterized stage replaces the per-DE copy-paste.
# The Justfile passes --target=desktop and --build-arg DESKTOP_FLAVOR=<de>.
# ==============================================================================
FROM overlay-base AS desktop

ARG DESKTOP_FLAVOR
ARG TUNAOS_IMAGE_FLAVOR
ENV TUNAOS_IMAGE_FLAVOR=${TUNAOS_IMAGE_FLAVOR}
ARG TUNAOS_PUBLISHED_IMAGE_REF
ENV TUNAOS_PUBLISHED_IMAGE_REF=${TUNAOS_PUBLISHED_IMAGE_REF}
ENV DESKTOP_FLAVOR=${DESKTOP_FLAVOR}

# The published base image may predate the sudo addition in Containerfile.arch.
# Install it here so the live ISO's e2e harness (which runs sudo podman load)
# works on Arch-based overlays until new base images are published.
# fuse-overlayfs is the live ISO storage.conf's hardcoded mount_program
# (customize-live.sh) — without it podman fails with "can't stat program
# /usr/bin/fuse-overlayfs".
#
# `&>/dev/null` is bash-only redirection syntax. This RUN has no `bash -c`
# wrapper (unlike the OVERLAY_TYPE dispatch above), so it runs under the
# image's default shell — dash on a Debian base, which does not understand
# `&>` and mis-parses it as `command -v pacman &` (backgrounded, exits 0
# immediately) followed by a separate, argument-less `>/dev/null`
# redirection. The `if` then sees that trivial success and ALWAYS enters the
# `then` branch, regardless of whether pacman actually exists — invoking a
# `pacman` that is not installed on non-Arch bases and killing the whole
# build with "pacman: not found" (exit 127). Measured on flounder:gnome-asahi
# linux-arm64, build 93057902527, 2026-08-08. `>/dev/null 2>&1` is the
# POSIX-portable equivalent and needs no shell-specific wrapper.
RUN if command -v pacman >/dev/null 2>&1; then \
        pacman -S --needed --noconfirm sudo fuse-overlayfs; \
    fi

# Re-lay the repo's system_files, for the same reason 90-image-info.sh is
# re-run below: an overlay flavor does NOT rebuild its parent. It chains on
# the PUBLISHED parent tag (Justfile: `localhost/<variant>:<parent>` when
# present, else `<parent>-candidate` from ghcr), so every file the base stage
# copies is frozen at whatever that published image happened to carry —
# while the desktop scripts, live-ISO adapters and contracts that read those
# files are always current-tree.
#
# Measured, not assumed: ghcr.io/tuna-os/yellowfin:niri-testing
# (IMAGE_VERSION niri-3505bf2) ships /usr/bin/niri but has no
# /usr/share/niri/ directory and no /usr/share/backgrounds/tunaos/ — its
# commit is not a descendant of 453f15b7, which added both. So the
# niri-nvidia and niri-hwe LUKS cells (run 31226672079) died in live
# customize on "config.kdl missing; cannot arrange installer autostart",
# while plain niri passed: the dev ISO rebuilds THAT one from the current
# tree. Same staleness applies to hwe/cachyos/asahi overlays, and to every
# system_files asset, not just niri's.
#
# Ordering: before 90-image-info.sh, which reads assets this copy provides
# (the logo it asserts lives at /usr/share/pixmaps/tunaos.svg, from
# system_files).
RUN --mount=type=tmpfs,dst=/tmp \
    --mount=type=bind,from=context,source=/,target=/run/context \
    /run/context/build_scripts/00-copy-files.sh

RUN --mount=type=bind,from=context,source=/,target=/run/context \
    /run/context/build_scripts/90-image-info.sh

# Recompile glib schemas and dconf databases: 00-copy-files.sh refreshes system_files
# and package transactions during the overlay (e.g. nvidia/hwe drivers) may lay down
# gschema overrides or dconf keyfiles (e.g. /etc/dconf/db/gdm.d). Without recompiling,
# GDM and GNOME services ignore the keyfiles at runtime and verify-desktop-experience
# / verify-branding fail on uncompiled databases (#1751, #1820).
RUN if command -v glib-compile-schemas >/dev/null 2>&1; then glib-compile-schemas /usr/share/glib-2.0/schemas; fi && \
    if command -v dconf >/dev/null 2>&1 && compgen -G "/etc/dconf/db/*.d/*" >/dev/null 2>&1; then dconf update || true; fi

# SELinux home labels (tunaOS#4047), the same fix-then-gate pair
# install-desktop.sh runs. Needed here as well: the overlay chains on the
# PUBLISHED parent rather than rebuilding it, and its kernel/driver
# transactions can replace selinux-policy, which rewrites
# file_contexts.subs_dist. Runs after every package transaction and file copy
# in this build, for every OVERLAY_TYPE (-hwe, -nvidia, -gdx); both scripts
# no-op on an image without an SELinux policy.
RUN --mount=type=bind,from=context,source=/,target=/run/context \
    /run/context/build_scripts/selinux-home-labels.sh && \
    /run/context/build_scripts/checks/verify-selinux-home-labels.sh

RUN dnf versionlock add glib2 2>/dev/null || true
RUN rm -rf /opt && ln -s /var/opt /opt