feat: unionize Ubuntu Containerfile with the one for Alpine by rwaffen · Pull Request #141 · OpenVoxProject/container-openvoxserver

rwaffen · 2026-06-12T14:29:45Z

Short description

unionize Ubuntu Containfile with the one for Alpine. One step more to rootless containers. One step more to only one container file again.

Checklist

I have:

read the CONTRIBUTING.md document
read and accepted the Developer Certificate of Origin document and added a Signed-off-by annotation to each of my commits
read and accepted the AI Policy document and added Generated-by or Assisted-by annotations to each of my commits created with the help of an AI agent
tested this code
included documentation (including possible behaviour changes)
documented the code
added or modified regression test(s)
added or modified unit test(s)

Signed-off-by: Robert Waffen <rw@betadots.de> Co-authored-by: ChatGPT Codex <codex@openai.com>

rwaffen · 2026-06-12T14:34:03Z

I would like to have this PR a bit longer open, so that people might discuss or have opinions... like in #124

Signed-off-by: Robert Waffen <rw@betadots.de>

miharp

LGTM, +1

…penVoxProject#148) Since OpenVoxProject#141, gems installed by prep_release_container.sh land in the system CRuby gem path (e.g. /var/lib/gems/3.x), which is not on puppetserver's JRuby gem-path. As a result hiera-eyaml was invisible to puppetserver and eyaml-encrypted Hiera lookups failed at runtime. Install the gems puppetserver's JRuby loads at runtime (hiera-eyaml, hocon, openvoxserver-ca) into the JRuby gem-home via `puppetserver gem install`, alongside the existing openvox install. Split the two gem paths by consumer to avoid redundant installs: - CRuby (distro Ruby) gets only the gems backing CLI tools run inside the container: openvox (puppet/facter, e.g. `puppet config print`), hiera-eyaml (eyaml symlink), r10k and its native rugged dependency, plus racc/syslog as Ruby 3.4+ stdlib replacements. These run fast under CRuby; JRuby binstubs would pay JVM start-up per call and are not on PATH anyway. - JRuby gets the gems the server loads at runtime: openvox, hiera-eyaml, and hocon/openvoxserver-ca (which back `puppetserver ca`). openvox and hiera-eyaml are needed by both runtimes so are installed in both; hocon and openvoxserver-ca have no CRuby consumer and are now JRuby-only, removing the previous duplicate system installs. r10k/rugged stay CRuby-only. Fixes OpenVoxProject#148 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…roject#148) Since OpenVoxProject#141, gems installed by prep_release_container.sh land in the system CRuby gem path (e.g. /var/lib/gems/3.x), which is not on puppetserver's JRuby gem-path. As a result hiera-eyaml was invisible to the puppetserver JVM and eyaml-encrypted Hiera lookups failed during catalog compilation. Install hiera-eyaml into the JRuby gem-home via `puppetserver gem install`, alongside the existing openvox install. These two gems are the only ones the puppetserver JVM loads at runtime. All other gems stay in the system CRuby gem path, where they are needed: they back tools that run under the distro Ruby, not the JVM. In particular `puppetserver ca` runs the cli/apps/ca app under /opt/puppetlabs/puppet/bin/ruby (the distro Ruby), so openvoxserver-ca and its hocon dependency must remain on the CRuby path; r10k/rugged and the puppet/facter/eyaml CLIs likewise. Fixes OpenVoxProject#148 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…roject#148) Since OpenVoxProject#141, gems installed by prep_release_container.sh land in the system CRuby gem path (e.g. /var/lib/gems/3.x), which is not on puppetserver's JRuby gem-path. As a result hiera-eyaml was invisible to the puppetserver JVM and eyaml-encrypted Hiera lookups failed during catalog compilation. Install hiera-eyaml into the JRuby gem-home via `puppetserver gem install`, alongside the existing openvox install. These two gems are the only ones the puppetserver JVM loads at runtime, and hiera-eyaml has no other consumer, so it is no longer installed under the distro Ruby at all. The `eyaml` CLI is exposed via a thin wrapper that runs through `puppetserver ruby` (a plain symlink would resolve the gem against the distro gem path, where it no longer lives); the CLI is effectively never used in-container, so the per-call JVM start-up is acceptable. All other gems stay in the system CRuby gem path, where they are needed: they back tools that run under the distro Ruby, not the JVM. In particular `puppetserver ca` runs the cli/apps/ca app under /opt/puppetlabs/puppet/bin/ruby (the distro Ruby), so openvoxserver-ca and its hocon dependency must remain on the CRuby path; r10k/rugged and the puppet/facter CLIs likewise. Fixes OpenVoxProject#148 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…roject#148) Since OpenVoxProject#141, gems installed by prep_release_container.sh land in the system CRuby gem path (e.g. /var/lib/gems/3.x), which is not on puppetserver's JRuby gem-path. As a result hiera-eyaml was invisible to the puppetserver JVM and eyaml-encrypted Hiera lookups failed during catalog compilation. Install hiera-eyaml into the JRuby gem-home via `puppetserver gem install`, alongside the existing openvox install. These two gems are the only ones the puppetserver JVM loads at runtime, and hiera-eyaml has no other consumer, so it is no longer installed under the distro Ruby at all. The `eyaml` CLI is exposed via a thin wrapper that runs the JRuby gem-home binstub under the distro Ruby with GEM_PATH pointed at the JRuby gem-home (hiera-eyaml is a pure-Ruby gem, so it loads fine there); a plain symlink would resolve the gem against the distro gem path, where it no longer lives. All other gems stay in the system CRuby gem path, where they are needed: they back tools that run under the distro Ruby, not the JVM. In particular `puppetserver ca` runs the cli/apps/ca app under /opt/puppetlabs/puppet/bin/ruby (the distro Ruby), so openvoxserver-ca and its hocon dependency must remain on the CRuby path; r10k/rugged and the puppet/facter CLIs likewise. Fixes OpenVoxProject#148 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…roject#148) Since OpenVoxProject#141, gems installed by prep_release_container.sh land in the system CRuby gem path (e.g. /var/lib/gems/3.x), which is not on puppetserver's JRuby gem-path. As a result hiera-eyaml was invisible to the puppetserver JVM and eyaml-encrypted Hiera lookups failed during catalog compilation. Install hiera-eyaml into the JRuby gem-home via `puppetserver gem install`, alongside the existing openvox install. These two gems are the only ones the puppetserver JVM loads at runtime, and hiera-eyaml has no other consumer, so it is no longer installed under the distro Ruby at all. The `eyaml` CLI is exposed via a thin wrapper that runs the JRuby gem-home binstub under the distro Ruby with GEM_PATH pointed at the JRuby gem-home (hiera-eyaml is a pure-Ruby gem, so it loads fine there); a plain symlink would resolve the gem against the distro gem path, where it no longer lives. All other gems stay in the system CRuby gem path, where they are needed: they back tools that run under the distro Ruby, not the JVM. In particular `puppetserver ca` runs the cli/apps/ca app under /opt/puppetlabs/puppet/bin/ruby (the distro Ruby), so openvoxserver-ca and its hocon dependency must remain on the CRuby path; r10k/rugged and the puppet/facter CLIs likewise. Fixes OpenVoxProject#148 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Chris Boot <bootc@boo.tc>

Colocate the puppetdb termini with the openvox gem lib so Puppet's Pops system loader finds puppetdb_query during compilation. Since OpenVoxProject#141 the images gem-install openvox instead of using the OS packages, so the termini in vendor_ruby are no longer on the loader's root. Fixes OpenVoxProject#159. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Chris Boot <bootc@boo.tc>

feat: unionize Ubuntu Containfile with the one for Alpine

111e867

Signed-off-by: Robert Waffen <rw@betadots.de> Co-authored-by: ChatGPT Codex <codex@openai.com>

rwaffen requested a review from a team as a code owner June 12, 2026 14:29

rwaffen added enhancement New feature or request backwards-incompatible labels Jun 12, 2026

github-project-automation Bot added this to Container Todos Jun 12, 2026

rwaffen changed the title ~~feat: unionize Ubuntu Containfile with the one for Alpine~~ feat: unionize Ubuntu Containerfile with the one for Alpine Jun 12, 2026

bastelfreak previously approved these changes Jun 12, 2026

View reviewed changes

rwaffen mentioned this pull request Jun 12, 2026

Discussion: consolidate Alpine and Ubuntu images? #124

Open

rwaffen marked this pull request as draft June 12, 2026 14:34

miharp reviewed Jun 16, 2026

View reviewed changes

Comment thread openvoxserver/prep_release_container.sh Resolved

miharp reviewed Jun 16, 2026

View reviewed changes

Comment thread Containerfile.ubuntu Resolved

rwaffen added 2 commits June 16, 2026 14:48

fix: add git, make alpine package list more readable

2055846

Signed-off-by: Robert Waffen <rw@betadots.de>

fix: use rugged version and add --with-ssh again

43fb861

Signed-off-by: Robert Waffen <rw@betadots.de>

rwaffen dismissed bastelfreak’s stale review via 43fb861 June 16, 2026 12:49

rwaffen marked this pull request as ready for review June 16, 2026 12:49

fix: add cmake, sort package list

fe00209

Signed-off-by: Robert Waffen <rw@betadots.de>

miharp reviewed Jun 16, 2026

View reviewed changes

Comment thread openvoxserver/prep_release_container.sh Resolved

fix: get deps straight and make em work again

f69c6a3

Signed-off-by: Robert Waffen <rw@betadots.de>

miharp approved these changes Jun 16, 2026

View reviewed changes

rwaffen moved this to In Progress in Container Todos Jun 17, 2026

bastelfreak approved these changes Jun 17, 2026

View reviewed changes

rwaffen merged commit cd74576 into main Jun 18, 2026
20 checks passed

rwaffen deleted the unionize_containerfiles branch June 18, 2026 07:10

github-project-automation Bot moved this from In Progress to Done in Container Todos Jun 18, 2026

bootc mentioned this pull request Jun 26, 2026

[Bug]: puppetdb_query function fails with "Unknown function" in built images #159

Closed

bootc mentioned this pull request Jun 26, 2026

fix: make puppetdb_query function available in built images #160

Merged

4 of 8 tasks

MirandaStreeter mentioned this pull request Jul 1, 2026

[Bug]: Vendored modules are missing #163

Closed

1 task done

MirandaStreeter mentioned this pull request Jul 28, 2026

[Discussion] Non-root interferes with helm chart #181

Open

Navigation Menu

Repository navigation

feat: unionize Ubuntu Containerfile with the one for Alpine - #141

feat: unionize Ubuntu Containerfile with the one for Alpine#141
rwaffen merged 5 commits into
mainfrom
unionize_containerfiles

rwaffen commented Jun 12, 2026 •

edited

Loading

Uh oh!

rwaffen commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miharp left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

rwaffen commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Short description

Checklist

Uh oh!

rwaffen commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miharp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rwaffen commented Jun 12, 2026 •

edited

Loading