From 4b3cd2c1d4fd373c81395f8fa7a7a0be54d0889c Mon Sep 17 00:00:00 2001
From: Julian Wefers <julian@wefers.page>
Date: Sat, 27 Jun 2026 22:27:31 +0200
Subject: [PATCH] use chunkah for final image

---
 .gitignore    |  1 +
 Containerfile | 16 ++++++++++++++--
 commands.sh   |  5 ++++-
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 53752db..01d3eac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 output
+out
diff --git a/Containerfile b/Containerfile
index 8d414c0..b4a3c15 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,4 +1,6 @@
-FROM quay.io/fedora/fedora-bootc:44
+ARG CHUNKAH_CONFIG_STR
+
+FROM quay.io/fedora/fedora-bootc:44 AS builder
 
 # Install ZFS
 # we want to keep ALL dnf downloaded packages in dnf cache,
@@ -11,7 +13,17 @@ RUN --mount=type=cache,target=/var/cache/libdnf5 <<EOF
 # dnf install -y kernel-devel-$(uname -r | awk -F'-' '{print $1}')
 dnf install -y https://zfsonlinux.org/fedora/zfs-release-3-1$(rpm --eval "%{dist}").noarch.rpm
 dnf install -y zfs btop borgbackup
-dnf clean all && rm -rf /run/dnf && rm -rf /tmp/*
+rm -rf /run/dnf && rm -rf /tmp/*
 EOF
 
 RUN bootc container lint
+
+FROM quay.io/coreos/chunkah AS chunkah
+ARG CHUNKAH_CONFIG_STR
+RUN --mount=from=builder,src=/,target=/chunkah,ro \
+    --mount=type=bind,target=/run/src,rw \
+        chunkah build --prune /sysroot/ --max-layers 128 \
+          --label ostree.commit- --label ostree.final-diffid- \
+          --output oci:/run/src/out
+
+FROM oci:out
diff --git a/commands.sh b/commands.sh
index b1fd0fa..ac094cb 100755
--- a/commands.sh
+++ b/commands.sh
@@ -2,12 +2,15 @@ REPO="gitea.wefers.page/julian/backup-server"
 TAG="latest"
 
 build() {
-    # ABSOLUTELY DO NOT USE --squash, as ostree NEEDS the layers
+	    # --no-cache \
     sudo buildah build \
         -t ${REPO}:${TAG} \
+        --build-arg CHUNKAH_CONFIG_STR="$(sudo podman inspect "quay.io/fedora/fedora-bootc:44")" \
         --pull \
         --layers \
         --format oci \
+        --skip-unused-stages=false \
+        -v $(pwd):/run/src --security-opt=label=disable \
         --network=host \
         .