Containerfile.pc

ARG BASE_IMAGE=localhost/archlinux-bootc-base:latest

FROM ${BASE_IMAGE}

ARG USERNAME=bupd
ARG USER_UID=1000
ARG USER_GID=1000

# Minimal graphical laptop. Packages in this transaction come from the official
# Arch repositories; explicit AUR exceptions are handled in a separate layer.
RUN if grep -q '^\#\[multilib\]' /etc/pacman.conf; then \
        sed -i '/^#\[multilib\]/{s/^#//; n; s/^#//}' /etc/pacman.conf; \
    elif ! grep -q '^\[multilib\]' /etc/pacman.conf; then \
        printf '\n[multilib]\nInclude = /etc/pacman.d/mirrorlist\n' >> /etc/pacman.conf; \
    fi

RUN --mount=type=tmpfs,dst=/tmp --mount=type=cache,dst=/usr/lib/sysimage/cache/pacman \
    pacman -Syu --needed --noconfirm \
    amd-ucode \
    chromium \
    firefox \
    go-task \
    openssh \
    pacman-contrib \
    fastfetch \
    hyprland \
    hyprshot \
    hyprlock \
    xdg-desktop-portal-hyprland \
    waybar \
    gparted \
    rofi \
    rofi-calc \
    rofi-emoji \
    awww \
    dunst \
    wl-clipboard \
    cliphist \
    brightnessctl \
    bluez \
    bluez-utils \
    blueman \
    bluetui \
    crane \
    zoxide \
    fd \
    ripgrep \
    bat \
    obsidian \
    eza \
    tmux \
    tldr \
    jujutsu \
    fzf \
    yq \
    lazygit \
    httpie \
    curl \
    ncdu \
    wget \
    btop \
    nvtop \
    github-cli \
    jq \
    libqalculate \
    gdm \
    gnu-free-fonts \
    noto-fonts \
    noto-fonts-cjk \
    noto-fonts-emoji \
    gnome-bluetooth-3.0 \
    gnome-console \
    gnome-control-center \
    gnome-keyring \
    gnome-session \
    gnome-shell \
    gnome \
    linux \
    linux-firmware-realtek \
    zsh \
    ghostty \
    hyprpwcenter \
    kitty \
    papirus-icon-theme \
    ttf-jetbrains-mono-nerd \
    ttf-material-symbols-variable \
    git \
    git-delta \
    less \
    podman-docker \
    neovim \
    vim \
    stow \
    steam \
    nvidia-utils \
    lib32-nvidia-utils \
    libva-nvidia-driver \
    networkmanager \
    nvidia-open \
    pipewire \
    pipewire-alsa \
    pipewire-jack \
    pipewire-pulse \
    pavucontrol \
    pamixer \
    matugen \
    power-profiles-daemon \
    sudo \
    wireplumber \
    xdg-utils \
    xdg-desktop-portal-gnome \
    && pacman -Scc --noconfirm

RUN printf 'g %s %s\nu %s %s:%s "Local user" /var/home/%s /bin/bash\nm %s wheel\nm %s video\nm %s input\nm %s audio\nm %s storage\n' \
        "${USERNAME}" "${USER_GID}" \
        "${USERNAME}" "${USER_UID}" "${USER_GID}" "${USERNAME}" \
        "${USERNAME}" "${USERNAME}" "${USERNAME}" "${USERNAME}" "${USERNAME}" \
        > /usr/lib/sysusers.d/archlinux-local-user.conf && \
    printf 'd /var/home/%s 0700 %s %s -\n' \
        "${USERNAME}" "${USERNAME}" "${USERNAME}" \
        > /usr/lib/tmpfiles.d/archlinux-local-user.conf && \
    systemd-sysusers /usr/lib/sysusers.d/archlinux-local-user.conf && \
    install -d -m 0700 -o "${USERNAME}" -g "${USERNAME}" "/var/home/${USERNAME}" && \
    printf "%%wheel ALL=(ALL:ALL) ALL\n" > /etc/sudoers.d/wheel && \
    chmod 0440 /etc/sudoers.d/wheel

RUN install -d /etc/skel/.config/ghostty /etc/skel/.config/kitty && \
    printf 'font-family = JetBrainsMono Nerd Font Mono\n' \
        > /etc/skel/.config/ghostty/config && \
    printf 'font_family JetBrainsMono Nerd Font Mono\n' \
        > /etc/skel/.config/kitty/kitty.conf && \
    install -d -m 0700 -o "${USERNAME}" -g "${USERNAME}" \
        "/var/home/${USERNAME}/.config/ghostty" \
        "/var/home/${USERNAME}/.config/kitty" && \
    install -m 0644 -o "${USERNAME}" -g "${USERNAME}" \
        /etc/skel/.config/ghostty/config \
        "/var/home/${USERNAME}/.config/ghostty/config" && \
    install -m 0644 -o "${USERNAME}" -g "${USERNAME}" \
        /etc/skel/.config/kitty/kitty.conf \
        "/var/home/${USERNAME}/.config/kitty/kitty.conf"

# Explicit AUR exceptions. The final image keeps yay available for updating
# those exceptions through a bootc usr-overlay, but package state remains owned
# by the image build by default.
RUN --mount=type=tmpfs,dst=/tmp --mount=type=cache,dst=/usr/lib/sysimage/cache/pacman \
    printf "%%wheel ALL=(ALL:ALL) NOPASSWD: /usr/bin/pacman\n" > /etc/sudoers.d/zz-aur-build && \
    chmod 0440 /etc/sudoers.d/zz-aur-build && \
    runuser -u "${USERNAME}" -- bash -lc ' \
        git clone https://aur.archlinux.org/yay-bin.git /tmp/yay-bin && \
        cd /tmp/yay-bin && \
        makepkg -si --needed --noconfirm && \
        yay -S --needed --noconfirm \
            hyprwhspr \
            walker \
            elephant \
            elephant-providerlist \
            elephant-desktopapplications \
            elephant-websearch \
            elephant-symbols \
            elephant-clipboard \
            elephant-calc \
            elephant-files \
            elephant-runner \
            hyprmod \
            wlogout' && \
    rm -f /etc/sudoers.d/zz-aur-build && \
    rm -rf /tmp/yay-bin "/var/home/${USERNAME}/.cache" && \
    pacman -Scc --noconfirm

RUN install -d /usr/libexec && \
    printf '%s\n' \
        '#!/usr/bin/env bash' \
        'set -euo pipefail' \
        'config="${XDG_CONFIG_HOME:-${HOME}/.config}/hypr/hyprland.lua"' \
        'exec /usr/bin/start-hyprland -- --config "${config}"' \
        > /usr/libexec/start-hyprland-lua && \
    chmod 0755 /usr/libexec/start-hyprland-lua && \
    printf '%s\n' \
        '[Desktop Entry]' \
        'Name=Hyprland' \
        'Comment=An intelligent dynamic tiling Wayland compositor' \
        'Exec=/usr/libexec/start-hyprland-lua' \
        'Type=Application' \
        'DesktopNames=Hyprland' \
        'Keywords=tiling;wayland;compositor;' \
        > /usr/share/wayland-sessions/hyprland.desktop

# NetworkManager supplies the link and DHCP configuration while
# systemd-resolved owns the local DNS stub.  The tmpfiles rule is the
# container-image-safe equivalent of linking /etc/resolv.conf directly.
RUN install -d /usr/lib/NetworkManager/conf.d /usr/lib/tmpfiles.d && \
    printf '[main]\ndns=systemd-resolved\nrc-manager=symlink\n' \
        > /usr/lib/NetworkManager/conf.d/20-systemd-resolved.conf && \
    printf 'L! /etc/resolv.conf - - - - /run/systemd/resolve/stub-resolv.conf\n' \
        > /usr/lib/tmpfiles.d/resolv-conf.conf

# Keep the initramfs aligned with the final kernel, firmware, microcode, and
# NVIDIA modules by running the same generic builder as the Bootcrew-style
# base after the desktop package transaction.
RUN install -d /usr/lib/dracut/dracut.conf.d && \
    printf '%s\n' \
        'systemdsystemconfdir=/etc/systemd/system' \
        'systemdsystemunitdir=/usr/lib/systemd/system' \
        > /usr/lib/dracut/dracut.conf.d/30-archlinux-bootc-module.conf && \
    printf '%s\n' \
        'reproducible=yes' \
        'hostonly=no' \
        'compress=zstd' \
        'add_dracutmodules+=" ostree bootc crypt dm btrfs tpm2-tss "' \
        > /usr/lib/dracut/dracut.conf.d/30-archlinux-bootc-container-build.conf && \
    kernel_dir="$(find /usr/lib/modules -mindepth 1 -maxdepth 1 -type d | sort -V | tail -1)" && \
    test -n "$kernel_dir" && \
    dracut --force "${kernel_dir}/initramfs.img"

# Enable only the services required for the desktop, networking, clock, SSD
# maintenance. Bootc owns the composefs and systemd-boot lifecycle; no
# image-specific boot helper or ESP copying service is installed.
RUN systemctl enable \
    NetworkManager \
    NetworkManager-wait-online \
    NetworkManager-dispatcher \
    bluetooth \
    gdm \
    systemd-resolved \
    systemd-timesyncd \
    fstrim.timer

RUN ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime && \
    echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && \
    locale-gen && \
    echo "LANG=en_US.UTF-8" > /etc/locale.conf && \
    echo "archlinux-bootc" > /etc/hostname

# The initramfs already contains AMD microcode. Runtime and mutable state is
# created from tmpfiles rules on boot and must not leak into the image.
RUN rm -rf /boot /tmp /var && \
    find /run -mindepth 1 -maxdepth 1 ! -name .containerenv \
        -exec rm -rf -- {} + && \
    mkdir -p /boot /run /var && \
    install -d -m 1777 /tmp

LABEL containers.bootc=1
LABEL org.opencontainers.image.title="Minimal Arch Linux bootc laptop image"
LABEL org.opencontainers.image.description="Minimal Arch Linux bootc image with GNOME, Hyprland, AMD/NVIDIA support, official packages, and explicit AUR desktop exceptions"
LABEL org.opencontainers.image.source="https://github.com/oci-native/archlinux"
RUN bootc container lint --fatal-warnings