scratch.sh

#!/bin/bash
set -xeou pipefail

# setup centos repos
# these are based on the repos found in a centos-stream container
# but the $stream variable has been replaced with $releasever

centos_repo_path=/etc/yum.repos.d/centos.repo

if [ ! -f "${centos_repo_path}" ]; then
        cat << EOF > "${centos_repo_path}"
[centos-baseos]                                                                                                                                         name=CentOS Stream $releasever - BaseOS
metalink=https://mirrors.centos.org/metalink?repo=centos-baseos-$releasever&arch=$basearch&protocol=https,http
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
gpgcheck=1
repo_gpgcheck=0
metadata_expire=6h
countme=1
enabled=0

[centos-appstream]
name=CentOS Stream $releasever - AppStream
metalink=https://mirrors.centos.org/metalink?repo=centos-appstream-$releasever&arch=$basearch&protocol=https,http
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
gpgcheck=1
repo_gpgcheck=0
metadata_expire=6h
countme=1
enabled=0
EOF
fi

# fetch the CentOS key
centos_key_name=RPM-GPG-KEY-centosofficial-SHA256
centos_key_url=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official-SHA256
if [ ! -f "/etc/pki-rpm-gpg/${centos_key_name}" ]; then
        tmpdir=$(mktemp -d)
        curl -L -o "${tmpdir}/${centos_key_name}" "${centos_key_url}"
        cp "${tmpdir}/${centos_key_name}" "/etc/pki/rpm-gpg/${centos_key_name}"
fi

# init the scratch container and mountpoint
newctr=$(buildah from scratch)
scratchmnt=$(buildah mount $newctr)

# dnf args
## disable all the repos, but enable the centos ones
dnf_args=(--disablerepo=* --enablerepo=centos-baseos --enablerepo=centos-appstream)

## install root
dnf_args+=(--installroot="${scratchmnt}")

# releasever
dnf_args+=(--releasever=10-stream)

## disable countme + weak deps (Recommends/Supplements)
dnf_args+=(--setopt "*.countme=false" --setopt install_weak_deps=false)

## put it together
dnf "${dnf_args[@]}" -y install kernel systemd bootc

# create container image
buildah unmount "${newctr}"
buildah commit "${newctr}" centos-minimal