Pin container toolchains for local module builds

build.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  printf 'Usage: %s {client|server} [Gradle arguments...]\n' "$0"
+}
+
+case "${1:-}" in
+  client | server) module=$1; shift ;;
+  -h | --help) usage; exit 0 ;;
+  *) usage >&2; exit 2 ;;
+esac
+
+engine_mode() {
+  local state
+  case "$1" in
+    podman)
+      state=$("$1" info --format '{{.Host.Security.Rootless}}') || return
+      [[ $state == true ]] && printf rootless || printf rootful
+      ;;
+    docker | nerdctl)
+      state=$("$1" info --format '{{json .SecurityOptions}}') || return
+      [[ $state == *'"name=rootless"'* ]] && printf rootless || printf rootful
+      ;;
+  esac
+}
+
+engine=${CONTAINER_ENGINE:-}
+if [[ -n $engine ]]; then
+  case "$engine" in
+    podman | nerdctl | docker) ;;
+    *) printf 'Unsupported container engine: %s\n' "$engine" >&2; exit 2 ;;
+  esac
+  kind=$(engine_mode "$engine")
+else
+  fallback=
+  for candidate in podman nerdctl docker; do
+    command -v "$candidate" >/dev/null || continue
+    kind=$(engine_mode "$candidate" 2>/dev/null) || continue
+    if [[ $kind == rootless ]]; then
+      engine=$candidate
+      break
+    fi
+    [[ -n $fallback ]] || fallback=$candidate
+  done
+  if [[ -z $engine ]]; then
+    engine=$fallback
+    kind=rootful
+  fi
+fi
+if [[ -z $engine ]]; then
+  printf 'No working Podman, nerdctl or Docker engine found.\n' >&2
+  exit 1
+fi
+
+printf 'Building %s with %s (%s)\n' "$module" "$engine" "$kind" >&2
+repo=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+cache="${XDG_CACHE_HOME:-$HOME/.cache}/saltatory/gradle"
+mkdir -p -- "$cache"
+image_file=$(mktemp)
+trap 'rm -f -- "$image_file"' EXIT
+build=(build --quiet --iidfile "$image_file" --tag localhost/saltatory-build --file "$repo/Containerfile")
+[[ $engine != podman ]] || build+=(--layers)
+"$engine" "${build[@]}" "$repo" >/dev/null
+image=$(<"$image_file")
+rm -- "$image_file"
+trap - EXIT
+
+user=(--user "$(id -u):$(id -g)")
+if [[ $kind == rootless ]]; then
+  case "$engine" in
+    podman) user=(--userns keep-id "${user[@]}") ;;
+    docker | nerdctl) user=(--user 0:0) ;;
+  esac
+fi
+exec "$engine" run --rm --init \
+  --label saltatory.build=true \
+  "${user[@]}" \
+  --cap-drop ALL --security-opt no-new-privileges \
+  --mount "type=bind,src=$repo,dst=/workspace" \
+  --mount "type=bind,src=$cache,dst=/cache/gradle" \
+  "$image" ":$module:build" "$@"