antilax3/wolfi repository overview

⁠ ⁠ ⁠

⁠This base container is not aimed at public consumption. It exists to serve as a single endpoint for AntilaX-3 containers and is based upon Wolfi⁠ and S6 overlay⁠, following the layout of our Alpine baseimage⁠.

⁠Differences from the Alpine baseimage

The s6-overlay layout, the abc user, the PUID/PGID handling and the /app, /config and /defaults directories are identical. What Wolfi changes:

⁠Versioning

Wolfi is a rolling distribution with no release number of its own: the VERSION_ID in its os-release is the frozen constant 20230201, and Chainguard publishes no tag but latest. The version ladder is therefore the pinned base image's own build date, read from org.opencontainers.image.created on the manifest Renovate pins:

2026.09.16   the base image this build used
2026.09      the newest build from that month
2026         the newest build from that year
latest       the newest build
BK<build>    immutable, one per Buildkite build

It behaves like the Alpine baseimage's 3/3.24/3.24.1: the ladder advances when Renovate bumps the digest, and is republished in place when only our own layer changes. resolve_release() in .buildkite/libs/common.sh reads the annotation from the registry without pulling the image, retries, and fails the build rather than publish a tag built from a missing value. The digest itself is also recorded on every image as org.opencontainers.image.base.digest and asserted by the test suite, so a tag can always be traced back to an exact base.

Wolfi also ships no getent, so anything reading the account databases must read /etc/passwd and /etc/group directly.

⁠Development

Linting runs locally through lefthook⁠. Install the hooks once per clone:

lefthook install

pre-commit runs editorconfig-checker⁠, hadolint⁠, jq, shellcheck⁠, typos⁠ and yamllint⁠ over the staged files, and commit-msg enforces Conventional Commits⁠. Run everything on demand with:

lefthook run pre-commit --all-files