[PATCH e2e-tests 18/38] plans,scripts: build a minimal OCI image onto pve1

["Michael Köppl" <m.koeppl@proxmox.com>]

Build the image for the OCI container test during setup instead of
pulling one from a registry. The test then depends neither on the
registry nor on how a third-party image behaves.

The image consists of a static BusyBox and an entrypoint that only
exits on the image's stop signal. Its config sets the fields that
pve-container takes over into the container config, so the entrypoint
and command, environment, user, working directory, stop signal and a
volume.

The image is built on the test runner, so umoci and busybox-static
become dependencies of the test package.

Signed-off-by: Michael Köppl <m.koeppl@proxmox.com>
---
 debian/control             |  4 ++-
 plans/complete.ron         |  1 +
 scripts/build-oci-image.sh | 69 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100755 scripts/build-oci-image.sh

diff --git a/debian/control b/debian/control
index b7abfdf..56a1185 100644
--- a/debian/control
+++ b/debian/control
@@ -11,7 +11,9 @@ Depends: ${misc:Depends}, ${perl:Depends},
          libjson-perl,
          libio-socket-ssl-perl,
          libnet-openssh-perl,
-         jq
+         busybox-static,
+         jq,
+         umoci
 Description: Proxmox End-to-End Tests and Helpers
  This package contains the end-to-end test suite and Perl helper
  modules for Proxmox projects. It requires proxmox-test-runner
diff --git a/plans/complete.ron b/plans/complete.ron
index 75cd5b1..dd299fe 100644
--- a/plans/complete.ron
+++ b/plans/complete.ron
@@ -15,6 +15,7 @@ Plan(
             post_setup: [
                 "./scripts/update-packages.sh pve staging",
                 "./scripts/download-container-image.sh local debian-12-standard_12.12-1_amd64.tar.zst",
+                "./scripts/build-oci-image.sh local e2e-oci",
                 "./scripts/setup-pebble.sh",
             ],
         ),
diff --git a/scripts/build-oci-image.sh b/scripts/build-oci-image.sh
new file mode 100755
index 0000000..81ddabc
--- /dev/null
+++ b/scripts/build-oci-image.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/bash
+# Builds a minimal OCI image for the application container tests and stores it as a container
+# template. The image sets various image config fields that pve-container takes over into the
+# container config. It also only exits on the configured stop signal.
+set -e
+
+SSH_KEY=$(jq -r '.ssh_private_keyfile' "$CONFIG_PATH")
+HOST=$(jq -r '.host' "$CONFIG_PATH")
+USER=$(jq -r '.ssh_user' "$CONFIG_PATH")
+
+STORAGE=$1
+FILENAME=$2
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+umask 022
+
+# Root filesystem
+rootfs="$workdir/rootfs"
+mkdir -p "$rootfs"/{bin,dev,etc,home/e2e,proc,run,sys,tmp}
+chmod 1777 "$rootfs/tmp"
+cp "$(command -v busybox)" "$rootfs/bin/"
+for applet in $("$rootfs/bin/busybox" --list); do
+    [ "$applet" = busybox ] || ln -s busybox "$rootfs/bin/$applet"
+done
+
+# User database for the image's User field
+cat > "$rootfs/etc/passwd" <<'PASSWD'
+root:x:0:0:root:/root:/bin/sh
+e2e:x:1000:1000:e2e:/home/e2e:/bin/sh
+PASSWD
+cat > "$rootfs/etc/group" <<'GROUP'
+root:x:0:
+e2e:x:1000:
+GROUP
+
+# Entrypoint that exits on the image's stop signal only, so that stopping the container with any
+# other signal times out. The shell ignores all signals it has no trap for
+cat > "$rootfs/entrypoint.sh" <<'ENTRYPOINT'
+#!/bin/sh
+trap 'exit 0' USR1
+while :; do
+    sleep 1
+done
+ENTRYPOINT
+chmod 755 "$rootfs/entrypoint.sh"
+
+umoci init --layout "$workdir/layout"
+umoci new --image "$workdir/layout:e2e"
+umoci unpack --rootless --image "$workdir/layout:e2e" "$workdir/bundle"
+cp -a "$rootfs/." "$workdir/bundle/rootfs/"
+umoci repack --image "$workdir/layout:e2e" "$workdir/bundle"
+umoci config --image "$workdir/layout:e2e" \
+    --config.entrypoint /entrypoint.sh \
+    --config.cmd e2e-cmd \
+    --config.env PATH=/bin \
+    --config.env E2E_IMAGE_ENV=from-image \
+    --config.stopsignal SIGUSR1 \
+    --config.user e2e:e2e \
+    --config.workingdir /home/e2e \
+    --config.volume /data
+umoci gc --layout "$workdir/layout"
+
+# Required for pve-container to detect the archive as OCI format
+tar -C "$workdir/layout" -cf "$workdir/$FILENAME.tar" oci-layout index.json blobs
+
+ssh -i "$SSH_KEY" "$USER"@"$HOST" -o StrictHostKeyChecking=no \
+    "cat > \"\$(pvesm path '$STORAGE:vztmpl/$FILENAME.tar')\"" \
+    < "$workdir/$FILENAME.tar"
-- 
2.47.3