From 7a776fd0d3e57f803fcc3ffb490d605c9ae7147b Mon Sep 17 00:00:00 2001
From: Pierre Le Fevre <hello@pierrelf.com>
Date: Thu, 27 Nov 2025 21:13:25 +0100
Subject: [PATCH] refactor: use umoci+skopeo for rootless OCI image creation

---
 .tangled/workflows/build.yml | 49 +++++++++++++++++++++---------------
 1 file changed, 29 insertions(+), 20 deletions(-)

diff --git a/.tangled/workflows/build.yml b/.tangled/workflows/build.yml
index f6f1644..ddce551 100644
--- a/.tangled/workflows/build.yml
+++ b/.tangled/workflows/build.yml
@@ -13,8 +13,9 @@ dependencies:
     - gcc
     - pkg-config
     - curl
-    - podman
     - skopeo
+    - umoci
+    - jq
     - bash
     - coreutils
     - findutils
@@ -33,28 +34,36 @@ steps:
     command: |
       set -ex
       
-      # Create a simple Dockerfile for podman build
-      cat > Dockerfile.ci << 'DOCKERFILEEND'
-      FROM gcr.io/distroless/cc-debian12:nonroot
-      WORKDIR /app
-      COPY target/release/grain /app/grain
-      COPY target/release/grainctl /app/grainctl
-      ENV RUST_LOG=info
-      EXPOSE 8888
-      CMD ["/app/grain", "--host", "0.0.0.0:8888", "--users-file", "/data/users.json"]
-      LABEL org.opencontainers.image.source="https://tangled.org/@pierrelf.com/grain"
-      LABEL org.opencontainers.image.description="Grain OCI Registry"
-      LABEL org.opencontainers.image.version="${TANGLED_COMMIT_SHA:0:7}"
-      DOCKERFILEEND
-      
-      echo "Building image with podman..."
-      podman build --isolation=chroot -t grain:latest -t grain:${TANGLED_COMMIT_SHA:0:7} -f Dockerfile.ci .
+      # Use umoci to create OCI image from distroless base
+      echo "Pulling distroless base..."
+      skopeo copy docker://gcr.io/distroless/cc-debian12:nonroot oci:base:latest
+      
+      echo "Unpacking base image..."
+      umoci unpack --image base:latest bundle
+      
+      echo "Adding binaries to rootfs..."
+      mkdir -p bundle/rootfs/app
+      cp target/release/grain bundle/rootfs/app/grain
+      cp target/release/grainctl bundle/rootfs/app/grainctl
+      chmod +x bundle/rootfs/app/grain bundle/rootfs/app/grainctl
+      
+      echo "Repacking with modifications..."
+      umoci repack --image grain-oci:latest bundle
+      
+      echo "Configuring image..."
+      umoci config --image grain-oci:latest \
+        --config.workingdir /app \
+        --config.env RUST_LOG=info \
+        --config.exposedports 8888 \
+        --config.cmd /app/grain --config.cmd --host --config.cmd 0.0.0.0:8888 --config.cmd --users-file --config.cmd /data/users.json \
+        --author "Grain CI" \
+        --created "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
       
       echo "Logging in to Docker Hub..."
-      echo "$DOCKER_PASS" | podman login --username "$DOCKER_USER" --password-stdin docker.io
+      skopeo login --username "$DOCKER_USER" --password "$DOCKER_PASS" docker.io
       
       echo "Pushing to Docker Hub..."
-      podman push grain:latest docker://docker.io/pierrelf/grain:latest
-      podman push grain:${TANGLED_COMMIT_SHA:0:7} docker://docker.io/pierrelf/grain:${TANGLED_COMMIT_SHA:0:7}
+      skopeo copy oci:grain-oci:latest docker://docker.io/pierrelf/grain:latest
+      skopeo copy oci:grain-oci:latest docker://docker.io/pierrelf/grain:${TANGLED_COMMIT_SHA:0:7}
       
       echo "Build and push completed successfully!"
-- 
2.51.2