refactor(ci): use mock's use_bootstrap_image instead of pre-baked chroot

Mock 2.0+ can pull a container image as the bootstrap chroot via podman,
eliminating the need to bake the CentOS Stream 10 chroot into the runner
image at build time.

Changes:
- centos-stream-10-ci.cfg: add use_bootstrap_image=True, pointing to
  quay.io/centos/centos:stream10 — mock pulls it at build time
- mock/Containerfile: drop 'mock --init' RUN layer entirely; image is
  now just fedora+mock+tools, builds without --cap-add or --privileged
- build-mock-runner.yml: remove --cap-add/--security-opt flags
- build.yml: cache quay.io/centos/centos:stream10 with actions/cache
  (podman save/load) instead of /var/cache/mock chroot directory
- build-chain.sh: drop /var/cache/mock bind-mount (no longer needed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hanthor

.github/workflows/build-mock-runner.yml

@@ -1,5 +1,7 @@
 name: Build Mock Runner Image
 # Builds and pushes ghcr.io/tuna-os/mock-runner:centos-stream-10
+# Image is just Fedora + mock toolchain. The CentOS Stream 10 environment
+# is pulled at build time via mock's use_bootstrap_image.
 
 on:
   push:
@@ -10,7 +12,6 @@ on:
   workflow_dispatch:
 
 env:
-  REGISTRY: ghcr.io
   IMAGE: ghcr.io/tuna-os/mock-runner
   TAG: centos-stream-10
 
@@ -31,12 +32,7 @@ jobs:
 
       - name: Build image
         run: |
-          # mock --init inside a RUN layer needs SYS_ADMIN + SYS_CHROOT.
-          # podman build doesn't support --privileged; use --cap-add=all
-          # with sudo so the runner process has the needed kernel capabilities.
-          sudo podman build \
-            --cap-add=all \
-            --security-opt label=disable \
+          podman build \
             --pull=always \
             -f mock/Containerfile \
             -t "${IMAGE}:${TAG}" \
@@ -45,8 +41,8 @@ jobs:
 
       - name: Push image
         run: |
-          sudo podman push "${IMAGE}:${TAG}"
-          sudo podman push "${IMAGE}:${TAG}-${{ github.sha }}"
+          podman push "${IMAGE}:${TAG}"
+          podman push "${IMAGE}:${TAG}-${{ github.sha }}"
 
       - name: Inspect
-        run: sudo podman images "${IMAGE}:${TAG}" --format "{{.Repository}}:{{.Tag}}  {{.Size}}"
+        run: podman images "${IMAGE}:${TAG}" --format "{{.Repository}}:{{.Tag}}  {{.Size}}"

.github/workflows/build.yml

@@ -42,13 +42,23 @@ jobs:
             gpg gpgconf
           curl -fsSL https://rclone.org/install.sh | sudo bash
 
-      - name: Cache mock RPM downloads
+      - name: Cache CentOS Stream 10 container image
+        id: cache-cs10
         uses: actions/cache@v4
         with:
-          path: /var/cache/mock
-          key: mock-cache-centos-stream-10-${{ hashFiles('mock/centos-stream-10-ci.cfg') }}
-          restore-keys: |
-            mock-cache-centos-stream-10-
+          path: /tmp/cs10-image.tar
+          key: cs10-image-${{ hashFiles('mock/centos-stream-10-ci.cfg') }}
+
+      - name: Load or pull CentOS Stream 10 image
+        run: |
+          if [[ -f /tmp/cs10-image.tar ]]; then
+            echo "Restoring cached image..."
+            podman load -i /tmp/cs10-image.tar
+          else
+            echo "Pulling quay.io/centos/centos:stream10..."
+            podman pull quay.io/centos/centos:stream10
+            podman save -o /tmp/cs10-image.tar quay.io/centos/centos:stream10
+          fi
 
       - name: Import GPG key
         uses: crazy-max/ghaction-import-gpg@v6
@@ -74,9 +84,6 @@ jobs:
         run: |
           IMAGE="${{ github.event.inputs.image || env.MOCK_RUNNER_IMAGE }}"
           podman pull "${IMAGE}"
-          # Warm the /var/cache/mock host directory so the bind-mount
-          # inside containers picks up cached RPM downloads
-          sudo mkdir -p /var/cache/mock
 
       - name: Seed local repo from R2
         run: |

mock/Containerfile

@@ -1,50 +1,29 @@
-# Mock Runner Image for GNOME 50 / CentOS Stream 10 builds
+# Mock Runner Image
 #
-# Bakes in:
-#   - mock + toolchain (rpm-build, createrepo_c, rpmdevtools, spectool)
-#   - centos-stream-10-ci mock config
-#   - Pre-bootstrapped CentOS Stream 10 mock chroot
+# Fedora + mock toolchain only. The CentOS Stream 10 build environment is
+# sourced at build time via mock's use_bootstrap_image, which pulls
+# quay.io/centos/centos:stream10 through podman. No chroot baked in.
 #
-# Build (requires --privileged for mock --init):
-#   podman build --privileged -f mock/Containerfile -t mock-runner:local mock/
+# Build:
+#   podman build -f mock/Containerfile -t mock-runner:local mock/
 #
 # Push:
 #   podman tag mock-runner:local ghcr.io/tuna-os/mock-runner:centos-stream-10
 #   podman push ghcr.io/tuna-os/mock-runner:centos-stream-10
 
 FROM fedora:latest
 
-# Install build toolchain
 RUN dnf install -y \
         mock \
         rpm-build \
         rpm-sign \
         createrepo_c \
         rpmdevtools \
         python3-pyyaml \
-        git \
     && dnf clean all \
     && rm -rf /var/cache/dnf
 
-# Copy mock config into place
 COPY centos-stream-10-ci.cfg /etc/mock/centos-stream-10-ci.cfg
 
-# Create an empty local repo so mock --init doesn't fail on the
-# file:///local-repo baseurl (it'll be bind-mounted at build time)
-RUN mkdir -p /local-repo && createrepo_c /local-repo
-
-# Bootstrap the CentOS Stream 10 chroot.
-# This downloads ~400 MB of base packages once and bakes them into the image.
-# Subsequent `mock --rebuild --no-clean` invocations skip this phase entirely.
-RUN mock --init -r centos-stream-10-ci \
-        --no-cleanup-after \
-    && echo "Bootstrap complete" \
-    # Remove cached RPMs inside the chroot and build logs to trim image size
-    && find /var/lib/mock/centos-stream-10-ci/ \
-        \( -name "*.rpm" -o -name "*.log" \) -delete \
-    && rm -rf /var/lib/mock/centos-stream-10-ci/root/var/cache/dnf \
-    && rm -rf /var/lib/mock/centos-stream-10-ci-bootstrap/root/var/cache/dnf
-
-LABEL org.opencontainers.image.description="Fedora + mock with CentOS Stream 10 chroot pre-bootstrapped"
+LABEL org.opencontainers.image.description="Fedora + mock runner for CentOS Stream 10 package builds"
 LABEL org.opencontainers.image.source="https://github.com/tuna-os/github-copr"
-# Fri Mar 13 06:47:58 AM IST 2026

mock/centos-stream-10-ci.cfg

@@ -2,6 +2,12 @@ include('/etc/mock/centos-stream-10-x86_64.cfg')
 
 config_opts['root'] = 'centos-stream-10-ci'
 
+# Use podman to pull quay.io/centos/centos:stream10 as the bootstrap chroot
+# instead of bootstrapping from scratch. Mock spawns a container, installs
+# BuildRequires inside it, and builds there — no chroot setup needed.
+config_opts['use_bootstrap_image'] = True
+config_opts['bootstrap_image'] = 'quay.io/centos/centos:stream10'
+
 config_opts['yum.conf'] += """
 [local-build]
 name=Local Build Repository

scripts/build-chain.sh

@@ -219,19 +219,10 @@ MOCKCFG
 
     echo "==> [${pkg_name}] Running mock inside podman (${BUILD_IMAGE})..."
 
-    # Bind-mount the host mock RPM download cache so packages aren't
-    # re-downloaded across builds. /var/cache/mock is safe to share
-    # between parallel container runs (dnf uses per-request locking).
-    local mock_cache_vol=""
-    if [[ -d /var/cache/mock ]]; then
-        mock_cache_vol="-v /var/cache/mock:/var/cache/mock:Z"
-    fi
-
     podman run --rm --privileged \
         --pull=missing \
         -v "${builddir}:/builddir:Z" \
         -v "${LOCAL_REPO}:/local-repo:Z" \
-        ${mock_cache_vol} \
         "${BUILD_IMAGE}" \
         bash -exc "
             createrepo_c /local-repo/