projectbluefin/common/containerfile

Containerfile — common OCI layer build

When to Use

Use when modifying the Containerfile, adding new external binaries, updating wallpaper sources, changing the umotd/uwelcome version pins, or running just overlay to test system_files/ changes locally.

When Not to Use

Do not use this skill for changes that only affect system_files/ content without touching the Containerfile build stages, or for downstream image Containerfiles outside projectbluefin/common.

Build Stages Overview

The Containerfile uses four named stages:

See `references/build-stages.md` for the full stage details, wallpaper source caveat, and ujust completions.

Key Rules

• Never download a pre-built binary for umotd/uwelcome — use the Go builder stage pattern.
• Never add a curl download without a paired sha256sum -c check.
• Git checkout pins must be commit SHAs, not tags or branch names.
• Place shared binaries in /out/shared/, Bluefin-specific in /out/bluefin/.

Red Flags

• checkout tags/... or --branch in a Go builder stage — tags are mutable.
• A curl block without an inline sha256sum -c.
• Reintroducing a just --completions | sed generator for ujust completions, or shipping files at the ujust completion paths from /out/shared/, instead of editing the checked-in files under system_files/shared/ — the build stage RUN gate fails the build.
• Pulling the wallpaper source from the old ublue-os org; it now lives under projectbluefin.

Verification

• [ ] New binary has a builder stage or inline SHA check.
• [ ] Commit SHAs (not tags) used for umotd/uwelcome checkout.
• [ ] just overlay succeeds locally without SELinux AVC denials.
• [ ] Renovate OCI digest pins updated when FROM base images change.

References