oci: T9269: remove podman runtime from container image

Running containers inside the VyOS container is not supported and the
container CLI nodes are stripped from the image anyway, so podman(8) and
its helpers are dead weight - about 110 MiB of the uncompressed rootfs
(podman 43 MiB, podman-remote 32 MiB, netavark and aardvark-dns 21 MiB,
runc 8 MiB), which is roughly 32 MiB of the compressed tarball.

Remove the binaries along with everything that would otherwise dangle:
the podman and netavark systemd units - podman.service is enabled via a
"WantedBy" symlink and would fail on boot - the quadlet generators, the
tmpfiles.d snippet and the configuration shipped by containers-common.

The container operational mode templates are removed as well, they would
only greet the user with a traceback now that podman is gone.

1 files changed, 30 insertions, 1 deletions

diff --git a/scripts/iso-to-oci b/scripts/iso-to-oci
index 32efbbbf..a0e5e87c 100755
--- a/scripts/iso-to-oci
+++ b/scripts/iso-to-oci
@@ -99,9 +99,38 @@ rm -rf "${UNSQUASHFS}/usr/lib/x86_64-linux-gnu/libwireshark.so*"
 rm -rf "${UNSQUASHFS}/lib/modules/*-vyos"
 rm -rf "${UNSQUASHFS}/root/.gnupg"
 
+# podman(8) is useless inside the container as we do not support running
+# containers in containers - the CLI nodes are removed below anyway. Dropping
+# the runtime and its network helpers (netavark, aardvark-dns) saves about
+# 110 MiB of the uncompressed rootfs. Nothing but the container CLI calls
+# these, so they can go entirely - including the systemd units, the quadlet
+# generators and the configuration shipped by containers-common
+rm -f "${UNSQUASHFS}/etc/systemd/system/default.target.wants/podman.service"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/system/podman.service"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/system/podman.socket"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/system/netavark-dhcp-proxy.service"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/system/netavark-dhcp-proxy.socket"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/system/netavark-firewalld-reload.service"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/system-generators/podman-system-generator"
+rm -f "${UNSQUASHFS}/usr/lib/systemd/user-generators/podman-user-generator"
+rm -f "${UNSQUASHFS}/usr/lib/tmpfiles.d/podman.conf"
+rm -rf "${UNSQUASHFS}/usr/lib/podman"
+rm -rf "${UNSQUASHFS}/usr/libexec/podman"
+rm -f "${UNSQUASHFS}/usr/bin/podman" "${UNSQUASHFS}/usr/bin/podman-remote" \
+      "${UNSQUASHFS}/usr/bin/podmansh" "${UNSQUASHFS}/usr/bin/conmon" \
+      "${UNSQUASHFS}/usr/bin/fuse-overlayfs" "${UNSQUASHFS}/usr/bin/runc" \
+      "${UNSQUASHFS}/usr/sbin/runc"
+rm -rf "${UNSQUASHFS}/etc/containers"
+rm -rf "${UNSQUASHFS}/usr/share/containers"
+
 # delete features not supported in container - only remove the node.def files,
-# this is sufficient to not make the feature pop up on the CLI
+# this is sufficient to not make the feature pop up on the CLI. The container
+# operational mode commands go as well, they would only greet the user with a
+# traceback now that podman is gone
 rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/container"
+for tree in add connect delete generate restart show update; do
+    rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-op/templates/${tree}/container"
+done
 rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/console"
 rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/kernel"
 rm -rf "${UNSQUASHFS}/opt/vyatta/share/vyatta-cfg/templates/system/option/startup-beep"