# alloy-nvidia — Alloy plus the open NVIDIA kernel module, aarch64.
#
# Derived, not a build ARG on the shipped Containerfile. Max chose option (c)
# on alloy `2a382a75` (2026-08-30) and the reason is structural rather than
# stylistic: the kernel and the module come from the same digest by
# construction, so the kernel-lock failure the ARG option had is impossible
# here. There is no build-time assertion to write and no way for
# build/refresh-base-digests.sh to ship a machine that boots with no GPU and no
# signal, because moving the base digest cannot reach an image built from the
# old one.
#
# It also keeps the shipped image out of it. An aarch64 NVIDIA card is not a
# role almost all Alloy users have, and wiki `alloy-selection-discipline` says
# the shipped image should not serve one by default.
#
# WHAT ASTRA NEEDS THIS FOR: an RTX 5070 Ti, Blackwell GB203, which the
# proprietary module does not drive. `akmod-nvidia` on aarch64 IS the open
# build -- `modinfo` reports `license: Dual MIT/GPL`, where the proprietary one
# reports `NVIDIA`. There is no separate `akmod-nvidia-open` for this arch, so
# do not go looking for one.
#
# Usage: build/build-nvidia.sh. It resolves the digest, so this file names none.

ARG ALLOY_DIGEST
FROM localhost/alloy@${ALLOY_DIGEST}

# RPM Fusion nonfree, which is where the akmod lives. `--nogpgcheck` on the
# release package alone and nothing else: it is the package that installs the
# key every later transaction is then checked against, which is the one
# bootstrap that cannot itself be checked.
#
# `$releasever` resolves to 43 without help, because the base image already
# pins it in /etc/dnf/vars/releasever -- Alloy re-brands os-release, so dnf
# would otherwise expand it to Alloy's own VERSION_ID and ask for a nonexistent
# Fedora.
RUN dnf install -y --nogpgcheck \
      "https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm" \
      "https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm" \
    && dnf clean all

# The akmod source and the userspace it pairs with.
#
# NOT `kmod-nvidia`, which exists prebuilt in the repo and is built against RPM
# Fusion's own kernel rather than this image's. Installing it would put a
# module in the image whose vermagic does not match the kernel beside it, which
# is the failure this whole derived shape exists to make impossible -- and it
# would look installed.
#
# Weak deps off, as everywhere else in this project.
RUN dnf install -y --setopt=install_weak_deps=False \
      akmod-nvidia \
      xorg-x11-drv-nvidia-cuda \
    && dnf clean all

# Build the module against THIS image's kernel, now, at build time.
#
# akmods normally runs on the machine after a kernel update, which a bootc
# image does not do: the filesystem is immutable and the kernel only changes by
# taking a new image. So the build happens here, against the one kernel this
# image has, and the result ships inside it.
#
# The kernel is read out of /usr/lib/modules rather than passed in. There is
# exactly one, it came with the digest above, and a number written here by hand
# is the drift this file exists to avoid.
RUN set -eux; \
    kernel="$(ls /usr/lib/modules | head -1)"; \
    akmods --force --kernels "$kernel"; \
    # The check, and it is the done condition. A build that produced nothing,
    # or produced a module for a different kernel, fails here rather than at
    # boot on a machine with no display.
    module="/usr/lib/modules/$kernel/extra/nvidia/nvidia.ko.xz"; \
    [ -f "$module" ] || module="/usr/lib/modules/$kernel/extra/nvidia/nvidia.ko"; \
    test -f "$module"; \
    vermagic="$(modinfo -F vermagic "$module" | awk '{print $1}')"; \
    test "$vermagic" = "$kernel" \
      || { echo "vermagic $vermagic is not this image's kernel $kernel" >&2; exit 1; }; \
    # Open, not proprietary. Blackwell GB203 needs the open module, and the two
    # are told apart by their licence: the open one is Dual MIT/GPL.
    licence="$(modinfo -F license "$module")"; \
    case "$licence" in \
      *MIT*) : ;; \
      *) echo "nvidia.ko reports licence '$licence'; expected the open Dual MIT/GPL build" >&2; exit 1 ;; \
    esac; \
    echo "built $module: vermagic $vermagic, licence $licence"

# The initramfs has to carry it, or the module is present and not loaded early
# enough to drive the console.
RUN set -eux; \
    kernel="$(ls /usr/lib/modules | head -1)"; \
    depmod -a "$kernel"; \
    dracut --force --no-hostonly \
      --kver "$kernel" \
      "/usr/lib/modules/$kernel/initramfs.img"

# `nouveau` and the nvidia module cannot both drive the card, and nouveau wins
# by loading first. Blacklisted here rather than as a kernel argument so the
# fact travels with the image that needs it.
RUN printf 'blacklist nouveau\noptions nouveau modeset=0\n' \
      > /etc/modprobe.d/alloy-nvidia-blacklist.conf

# The build host's leavings, on the same rule the shipped image applies to
# itself. This step is why: the derived image builds a kernel module, which
# means dnf, akmods and dracut all run here, and every one of them leaves
# something behind.
#
# It matters more here than it looks. astra installs and boots THIS image, not
# the Alloy underneath it, so a bar the shipped image enforces and this one does
# not is a bar that does not apply to the only machine that runs it. Measured
# 2026-09-04 on the first build that reached this far: /run/akmods, akmods and
# dnf logs, the libdnf5 and akmods caches, and dnf's countme files, all of them
# payload on a machine that will never run akmods again -- the module is built
# here precisely because the installed system cannot rebuild it.
#
# Everything the shipped image sweeps, plus the two akmods adds. authselect is
# not touched: this image runs no authselect, so its checksum is whatever the
# base already validated.
RUN set -eux; \
    find /run /tmp -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true; \
    rm -f /var/log/dnf5.log*; \
    rm -rf /var/lib/dnf /var/cache/libdnf5; \
    rm -rf /var/cache/akmods /var/log/akmods; \
    rm -f /var/cache/ldconfig/aux-cache; \
    echo "sweep: build-host caches, logs and /run content removed"

# The same gate the shipped image ends on, and for the same reason.
#
# `bootc container lint` alone stood here and reported three warnings that
# nothing read, which is the exact failure the shipped Containerfile records
# fixing on 2026-08-26: a detector whose output reaches no one is not a control.
# A derived image is not a reason to keep a weaker gate -- it is the image that
# boots.
RUN bootc container lint --fatal-warnings --no-truncate