Update immich jail

2 files changed, 11 insertions, 55 deletions

diff --git a/roles/jails/20_immich/templates/jail.conf.j2 b/roles/jails/20_immich/templates/jail.conf.j2
index 47a0454..6486677 100644
--- a/roles/jails/20_immich/templates/jail.conf.j2
+++ b/roles/jails/20_immich/templates/jail.conf.j2
@@ -1,11 +1,14 @@
+{% set devfs_ruleset = 4 -%}
 {{ jail.name }} {
   vnet;
   exec.clean;
   allow.raw_sockets;
-  mount.devfs;
-  enforce_statfs = 1;
 
-  devfs_ruleset = 4;
+  mount.devfs;        # Mount /dev according to devfs_ruleset
+  devfs_ruleset = {{ devfs_ruleset }};
+
+  enforce_statfs = 1; # Let jail see own mounts
+
   host.hostname = "${name}";
   path = "/usr/local/jails/containers/${name}";
 
@@ -25,10 +28,10 @@
 {% for img in oci_images %}
 
   # Mounts for {{ img.name }} rootfs
-  mount += "linprocfs $path/image/{{ img.name }}/proc  linprocfs rw 0 0";
-  mount += "linsysfs  $path/image/{{ img.name }}/sys   linsysfs  rw 0 0";
-  mount += "devfs     $path/image/{{ img.name }}/dev   devfs     rw 0 0";
-  mount += "tmpfs     $path/image/{{ img.name }}/tmp   tmpfs     rw 0 0";
-  mount += "tmpfs     $path/image/{{ img.name }}/run   tmpfs     rw 0 0";
+  mount += "devfs     $path/image/{{ img.name }}/dev   devfs     rw,ruleset={{ devfs_ruleset }}   0   0";
+  mount += "linprocfs $path/image/{{ img.name }}/proc  linprocfs rw             0   0";
+  mount += "linsysfs  $path/image/{{ img.name }}/sys   linsysfs  rw             0   0";
+  mount += "tmpfs     $path/image/{{ img.name }}/tmp   tmpfs     rw             0   0";
+  mount += "tmpfs     $path/image/{{ img.name }}/run   tmpfs     rw             0   0";
 {% endfor %}
 }
diff --git a/roles/jails/20_immich/templates/usr_local_bin_extract_image.sh b/roles/jails/20_immich/templates/usr_local_bin_extract_image.sh
deleted file mode 100644
index e8226dd..0000000
--- a/roles/jails/20_immich/templates/usr_local_bin_extract_image.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/sh
-# Extract a Docker image to a directory under /image/
-# Usage: extract-image.sh <image-ref> <name>
-# Example: extract-image.sh ghcr.io/immich-app/immich-server:v2.4.1 immich-server
-
-set -eu
-
-IMAGE="$1"
-NAME="$2"
-IMAGE_DIR="/image"
-TARGET="${IMAGE_DIR}/${NAME}"
-TMP_DIR="/tmp/oci-${NAME}"
-
-echo "Extracting ${IMAGE} to ${TARGET}..."
-
-# Clean up any previous extraction attempt
-rm -rf "${TMP_DIR}"
-mkdir -p "${TMP_DIR}"
-
-# Pull image layers
-skopeo copy --override-os linux "docker://${IMAGE}" "dir:${TMP_DIR}"
-
-# Extract all layers in order into new rootfs
-rm -rf "${TARGET}.new"
-mkdir -p "${TARGET}.new"
-
-# Parse layer digests from manifest and extract each layer
-grep -o '"sha256:[a-f0-9]*"' "${TMP_DIR}/manifest.json" | \
-    sed 's/"//g; s/sha256://' | \
-    while read hash; do
-        if [ -f "${TMP_DIR}/${hash}" ]; then
-            echo "  Extracting layer ${hash}..."
-            tar -xzf "${TMP_DIR}/${hash}" -C "${TARGET}.new" 2>/dev/null || \
-            tar -xf "${TMP_DIR}/${hash}" -C "${TARGET}.new" 2>/dev/null || true
-        fi
-    done
-
-# Swap in the new rootfs
-if [ -d "${TARGET}" ]; then
-    mv "${TARGET}" "${TARGET}.old"
-fi
-mv "${TARGET}.new" "${TARGET}"
-
-# Cleanup
-rm -rf "${TMP_DIR}" "${TARGET}.old"
-
-echo "Done: ${TARGET}"