"Readable" and "idempotent" OCI container build script PoC for Arch Linux and Python

build.sh

#!/bin/bash
set -ex

BUILD_DIR=.build
ROOTFS_DIR=$BUILD_DIR/image/rootfs
STATE_DIR=$BUILD_DIR/state

mkdir -p $BUILD_DIR $ROOTFS_DIR $STATE_DIR
cp $BUILD_DIR/templates/config.json $ROOTFS_DIR/../

test -f $STATE_DIR/pacstraped || sudo pacstrap -c -d $ROOTFS_DIR \
    bzip2 coreutils device-mapper filesystem gcc-libs \
    gettext glibc grep gzip inetutils iproute2 pacman \
    shadow sysfsutils util-linux \
    gcc \
    python2-pillow python2-pip python2-setuptools python2-psycopg2 python2-twisted \
&& touch $STATE_DIR/pacstraped

sudo tee $ROOTFS_DIR/etc/securetty <<EOF
console
tty1
ttyS0
hvc0
pts/0
EOF

mount | grep $ROOTFS_DIR/proc || sudo mount -t proc none $ROOTFS_DIR/proc
mount | grep $ROOTFS_DIR/dev  || sudo mount -o bind /dev $ROOTFS_DIR/dev

test -f $STATE_DIR/pacman-key-init || sudo chroot $ROOTFS_DIR pacman-key --init && touch $STATE_DIR/pacman-key-init
test -f $STATE_DIR/pacman-key-populate || sudo chroot $ROOTFS_DIR pacman-key --populate && touch $STATE_DIR/pacman-key-populate

mkdir -p $BUILD_DIR/cache/pip $ROOTFS_DIR/cache/pip
mount | grep $ROOTFS_DIR/cache/pip || sudo mount -o bind $BUILD_DIR/cache/pip $ROOTFS_DIR/cache/pip

mkdir -p $ROOTFS_DIR/app/src
mount | grep $ROOTFS_DIR/app/src || sudo mount -o bind src $ROOTFS_DIR/app/src
for i in setup.py tox.ini; do
    test -f $ROOTFS_DIR/app/$i || ln setup.py $ROOTFS_DIR/app/$i
done
sudo chroot $ROOTFS_DIR pip2 install --cache-dir /var/cache/pip --upgrade pip
sudo chroot $ROOTFS_DIR pip2 install --cache-dir /var/cache/pip --editable /app