Phase 1 toolchain: pinned dev container (prereqs not all Python)

Per operator rule: OpenTofu/age/sops/flux are Go binaries, so bake the toolchain into a pinned Fedora-44 dev container (matches host libvirt 12) instead of a venv. infra/devcontainer/: Containerfile + versions.env (tofu 1.9.0, age 1.2.1, sops 3.9.4, flux 2.4.0, kubectl 1.32.0, helm 3.16.0) + dev.sh (runs with host libvirt socket + repo + ssh mounted) + README. Built & validated: all tools resolve; virsh reaches host libvirt from inside the container. Also record resolved Phase 1 decisions in PHASE1-SCOPE.md (6GiB/4vCPU x3; k3s-dev NAT 10.73.0.0/24; container toolchain). Gate green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:59:47 -05:00
1 parent 814029f2da
commit 5d2b248b68
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# infra/devcontainer/dev.sh — build & enter the pinned dev toolbox.
+#
+# Mounts the host libvirt socket and the repo so OpenTofu (dmacvicar/libvirt) and Ansible
+# drive the local KVM cluster from inside the container. Rootless podman by default
+# (ENGINE=docker to switch). SELinux label is disabled for the run so the container can
+# use the host libvirt socket without relabeling it.
+#
+#   ./dev.sh build           # build the image only
+#   ./dev.sh                 # build (if needed) + open a shell
+#   ./dev.sh run tofu -version   # run one command in the toolbox
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${HERE}/../.." && pwd)"
+IMAGE="${IMAGE:-home-k3s-dev:local}"
+ENGINE="${ENGINE:-podman}"
+# shellcheck disable=SC1091
+source "${HERE}/versions.env"
+
+build() {
+  "$ENGINE" build \
+    --build-arg FEDORA_VERSION="$FEDORA_VERSION" \
+    --build-arg OPENTOFU_VERSION="$OPENTOFU_VERSION" \
+    --build-arg AGE_VERSION="$AGE_VERSION" \
+    --build-arg SOPS_VERSION="$SOPS_VERSION" \
+    --build-arg FLUX_VERSION="$FLUX_VERSION" \
+    --build-arg KUBECTL_VERSION="$KUBECTL_VERSION" \
+    --build-arg HELM_VERSION="$HELM_VERSION" \
+    -t "$IMAGE" -f "${HERE}/Containerfile" "${HERE}"
+}
+
+run() {
+  "$ENGINE" run --rm -it \
+    --network host \
+    --security-opt label=disable \
+    -v /run/libvirt:/run/libvirt \
+    -v "${REPO_ROOT}:/work" -w /work \
+    -v "${HOME}/.ssh:/root/.ssh:ro" \
+    -e LIBVIRT_DEFAULT_URI=qemu:///system \
+    "$IMAGE" "$@"
+}
+
+case "${1:-shell}" in
+  build) build ;;
+  run)   shift; run "$@" ;;
+  shell) build; shift 2>/dev/null || true; run ;;
+  *)     build; run "$@" ;;
+esac