Español · Українська

B19 / Ubuntu

Reproducible, single-layer, non-root Ubuntu base image — digest-pinned, multi-series and multi-arch, with the hook library downstream images inherit.

Features

• Persistent APT cache across builds
• Service process management with log routing (b19-exec)
• Cached artifact downloads with integrity verification
• Timed command execution with failure reporting (b19-run)
• Run-once initialization (bootstrap.d)
• Modular build hooks (build.d)
• Compromised certificate authorities distrusted ahead of upstream
• Automatic CPU count detection
• Declarative dependency management (b19-deps)
• Pluggable startup system (entrypoint.d)
• Feature toggles for all subsystems
• Built-in health monitoring (healthcheck.d)
• Multilingual shell output (b19-i18n)
• Image lineage tracking
• Structured, level-filtered logging (b19-log)
• Non-root container by default
• Air-gapped / offline build and runtime support
• Runtime overlay injection
• Reproducible base image (pinned by digest)
• Port validation
• Unified lifecycle runner family
• Docker secrets auto-loading
• Interactive shell hooks
• Graceful signal handling
• Jinja2 configuration templates (minijinja-cli)
• Built-in test framework (test.d)
• Nothing hangs forever
• Pre-installed utility tools
• XDG Base Directory paths

See Features for the full list.

What this provides

• Container image ghcr.io/damian-buho/b19/ubuntu:resolute
• Container image ghcr.io/damian-buho/b19/ubuntu:noble
• Container image damianbuho/b19-ubuntu:resolute
• Container image damianbuho/b19-ubuntu:noble

Installation

Pull the published container image:

Pull from GHCR — linux/amd64, linux/arm64, linux/riscv64

docker pull ghcr.io/damian-buho/b19/ubuntu:resolute

Pull from DockerHub — linux/amd64

docker pull damianbuho/b19-ubuntu:resolute

Series: resolute | noble

Stable releases also publish X.Y.Z, X.Y and X tags — pull the precision you want to pin.

If the registries above are unreachable, pull from the origin instead:

Pull from Kiota — linux/amd64

docker pull kiota.ch/b19/ubuntu:resolute

Series: resolute | noble

Usage

Build on top of this image:

From GHCR

FROM ghcr.io/damian-buho/b19/ubuntu:resolute

From DockerHub

FROM damianbuho/b19-ubuntu:resolute

Series: resolute | noble

For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

Building

Clone the repository with its submodules:

git clone --recurse-submodules https://codeberg.org/b19/ubuntu ubuntu && cd ubuntu

Build the container image locally:

make container-build

• Makefile reference

Run make with no arguments for the default target; run make help to list every target.

For the local dev loop, make dev-container brings up the dev-container.

Pipeline entry points:

• make analyzed — Run the heavy analysis sweep (mutation testing, benchmarks)
• make audited — Re-scan the pinned dependencies and published artifacts for new vulnerabilities
• make check-outdated — Report every pinned dependency that lags upstream
• make release-is-ready — Run the pseudo-CI pipeline locally — build, test and scan, without publishing

Documentation

• Configure the image environment
• Use the APT cache
• Manage long-running processes with b19-exec
• Download files with b19-fetch
• Log with b19-log
• Run commands with b19-run
• Initialize state once with bootstrap.d
• Build images with build.d hooks
• Distrust compromised certificate authorities
• Use NUMPROCS CPU detection
• Declare dependencies
• Start containers with entrypoint.d
• Write healthchecks
• Translate strings with b19-i18n
• Track image lineage
• Run as a non-root user
• Run offgrid builds
• Ship files with overlays
• Build on the pinned base
• Validate ports
• Use the runner family
• Load secrets
• Enhance interactive shells
• Handle signals gracefully
• Render templates with minijinja
• Test images with test.d
• Bound every step with timeouts
• Use the tools
• Use the XDG paths

Policies

• How to contribute
• Security policy
• Getting support
• Code of Conduct
• AI and LLM Policy

Links

• Projectfile Specification

License

This project is licensed under MIT — see the LICENSE file for details.