Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt, and fuse-overlayfs to verified upstream source checksums; SlackBuild recipes, scripts/build-packages.sh, checksums.sh, release.sh, and update-versions.sh implement the reproducible pipeline; GitHub Actions workflows build in a Slackware container and publish releases without committing any binaries. - plugin/podman.plg installs/updates/removes all eight packages (the seven components plus the plugin's own unraid-podman scaffolding package) via upgradepkg, using the official Unraid array-event hook mechanism (event/disks_mounted, event/stopping) instead of editing /boot/config/go. rc.podman and the sbin/ helper scripts implement storage creation, config seeding/sync, preflight checks, autostart with per-container Safe-Mode, and package verify/update/rollback. - webui/plugins/podman implements the Dashboard, Containers, Pods, Images, Volumes, Networks, Logs, Terminal, Compose, and Settings panels against the approved mockup (webui/mockups/prototype.html), talking to podman system service exclusively via PodmanClient.php (libpod REST API over the Unix socket), with two documented exceptions: Terminal's one-shot exec model and Compose's use of the podman compose CLI, since libpod has no REST equivalent for either. - docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions and honest current status (syntax-checked, unit- and integration-tested against fake sockets/servers; not yet run against a real Unraid/Podman/Slackware system). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-11 10:51:14 +00:00
parent 58ffc0c226
commit e2fefcdf9c
124 changed files with 9611 additions and 0 deletions
@@ -0,0 +1,59 @@
+# packages/
+
+One subdirectory per Slackware `.txz` package required by the plugin, built
+against Unraid's Slackware base. See
+[docs/ARCHITECTURE.md, section 5](../docs/ARCHITECTURE.md#5-paketmanagement)
+for the full rationale (why these components, static linking preference,
+version pinning, build strategy).
+
+## Packages
+
+| Directory | Upstream project | Purpose |
+|---|---|---|
+| `podman/` | [containers/podman](https://github.com/containers/podman) | Core container engine binary |
+| `conmon/` | [containers/conmon](https://github.com/containers/conmon) | Container monitor process |
+| `crun/` | [containers/crun](https://github.com/containers/crun) | OCI runtime (preferred over runc) |
+| `netavark/` | [containers/netavark](https://github.com/containers/netavark) | Network backend |
+| `aardvark-dns/` | [containers/aardvark-dns](https://github.com/containers/aardvark-dns) | DNS for container-to-container name resolution |
+| `containers-common/` | [containers/common](https://github.com/containers/common) | Default config/seccomp/registries templates |
+| `fuse-overlayfs/` | [containers/fuse-overlayfs](https://github.com/containers/fuse-overlayfs) | Fallback storage driver (rootless, Phase 2) |
+| `passt/` | [passt.top](https://passt.top/passt/about/) (no GitHub mirror) | Rootless networking (Phase 2), successor to slirp4netns |
+| `unraid-podman/` | this repository (not an upstream project) | Plugin's own scaffolding — rc.podman, sbin/ scripts, event/ hooks, config templates (see [its README](unraid-podman/README.md)) |
+
+`podman`, `conmon`, `crun`, `netavark`, `aardvark-dns`, `passt`,
+`fuse-overlayfs`, and `unraid-podman` are built and released automatically by
+`.github/workflows/build-packages.yml`. `containers-common` currently only
+supplies reference config (see [config/](../config)) and is not yet wired
+into the automated build.
+
+## Standard layout per package
+
+Each package directory follows the same skeleton:
+
+```
+packages/<name>/
+├── <name>.SlackBuild   # Slackware build script (source download, build, packaging)
+├── slack-desc            # Slackware package description (max 70 cols / 11 lines)
+├── patches/               # Optional patches applied during the build
+└── README.md              # Upstream version pinned, build notes, patch rationale
+```
+
+## Build pipeline
+
+Packages are built via `scripts/build-packages.sh`, which runs each
+package's `<name>.SlackBuild` in turn (see `scripts/lib/slackbuild-common.sh`
+for the shared fetch/verify/package helpers they all use). This must run
+inside a Slackware-compatible build environment — never on an arbitrary host
+distro, to avoid glibc/ABI drift against Unraid's base.
+`.github/workflows/build-packages.yml` is the CI entry point: it runs the
+same script inside a pinned Slackware container
+(`scripts/ci/setup-slackware-buildenv.sh` bootstraps any build-time
+dependency the base image doesn't already ship) and uploads the results as a
+workflow artifact — nothing built is ever committed to this repository.
+
+Exact upstream versions and source checksums are pinned centrally in
+[versions.env](../versions.env) (update via `scripts/update-versions.sh`,
+never by hand) and, at release time, mirrored into the top-level
+`plugin/podman.plg` manifest together with MD5 checksums by
+`scripts/release.sh`, so installs are reproducible and rollback-able — see
+[docs/ARCHITECTURE.md, section 14 (Rollback)](../docs/ARCHITECTURE.md#14-rollback).
@@ -0,0 +1,15 @@
+# packages/aardvark-dns
+
+Slackware package build recipe for **aardvark-dns**.
+
+- Upstream: https://github.com/containers/aardvark-dns
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `aardvark-dns.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,46 @@
+#!/bin/bash
+# =============================================================================
+# packages/aardvark-dns/aardvark-dns.SlackBuild
+#
+# Builds the aardvark-dns .txz package from upstream source (Rust).
+# aardvark-dns provides container-to-container DNS name resolution within
+# netavark-managed networks (see docs/ARCHITECTURE.md section 8). Installed
+# as a libexec helper binary, same rationale as netavark.
+#
+# Requires (in the build environment): rustc, cargo.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$AARDVARK_DNS_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "aardvark-dns"
+
+tarball=$(sb_fetch_and_verify "$AARDVARK_DNS_SRC_URL" "$AARDVARK_DNS_SRC_SHA256" "aardvark-dns-$VERSION.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [aardvark-dns] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+echo "==> [aardvark-dns] cargo build --release"
+cargo build --release --locked
+
+echo "==> [aardvark-dns] install into \$PKG"
+install -D -m 0755 target/release/aardvark-dns "$PKG/usr/libexec/podman/aardvark-dns"
+
+sb_install_docs "$srcdir/LICENSE" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+aardvark-dns: aardvark-dns (TODO: one-line summary)
+aardvark-dns:
+aardvark-dns: TODO: two-to-three sentence description of aardvark-dns, its role in the
+aardvark-dns: unraid-podman plugin, and a link to the upstream project.
+aardvark-dns:
+aardvark-dns: Homepage: https://github.com/containers/aardvark-dns
+aardvark-dns:
+aardvark-dns:
+aardvark-dns:
+aardvark-dns:
+aardvark-dns:
@@ -0,0 +1,15 @@
+# packages/conmon
+
+Slackware package build recipe for **conmon**.
+
+- Upstream: https://github.com/containers/conmon
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `conmon.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,46 @@
+#!/bin/bash
+# =============================================================================
+# packages/conmon/conmon.SlackBuild
+#
+# Builds the conmon .txz package from upstream source (C, glib-based).
+# conmon is the per-container monitor process podman/crun rely on to keep a
+# container's stdio and exit status attached even if podman itself restarts.
+#
+# Requires (in the build environment): gcc, make, pkg-config, glib2-dev,
+# libseccomp-dev.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$CONMON_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "conmon"
+
+tarball=$(sb_fetch_and_verify "$CONMON_SRC_URL" "$CONMON_SRC_SHA256" "conmon-$VERSION.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [conmon] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+echo "==> [conmon] make"
+make PREFIX=/usr
+
+echo "==> [conmon] make install into \$PKG"
+make install PREFIX=/usr DESTDIR="$PKG"
+
+sb_install_docs "$srcdir/LICENSE" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+conmon: conmon (TODO: one-line summary)
+conmon:
+conmon: TODO: two-to-three sentence description of conmon, its role in the
+conmon: unraid-podman plugin, and a link to the upstream project.
+conmon:
+conmon: Homepage: https://github.com/containers/conmon
+conmon:
+conmon:
+conmon:
+conmon:
+conmon:
@@ -0,0 +1,15 @@
+# packages/containers-common
+
+Slackware package build recipe for **containers-common**.
+
+- Upstream: https://github.com/containers/common
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `containers-common.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,33 @@
+#!/bin/sh
+# SlackBuild for containers-common — unraid-podman
+#
+# Builds a Slackware-compatible .txz package for containers-common, pinned to a specific
+# upstream release from https://github.com/containers/common.
+# See docs/ARCHITECTURE.md section 5 (Paketmanagement) and packages/README.md.
+#
+# STATUS: placeholder — not yet implemented.
+
+set -eu
+
+PRGNAM=containers-common
+VERSION=${VERSION:-0.0.0}   # TODO: pin exact upstream version
+ARCH=${ARCH:-x86_64}
+BUILD=${BUILD:-1}
+TAG=${TAG:-_unraidpodman}
+
+CWD=$(pwd)
+TMP=${TMP:-/tmp/SBo}
+PKG=$TMP/package-$PRGNAM
+OUTPUT=${OUTPUT:-/tmp}
+
+# TODO:
+#   1. Fetch source tarball for $PRGNAM $VERSION from
+#      https://github.com/containers/common
+#   2. Apply patches from packages/containers-common/patches/, if any
+#   3. Build (Go build for Go-based components, make for C-based components)
+#   4. Install into $PKG following Slackware package filesystem layout
+#   5. Copy packages/containers-common/slack-desc into $PKG/install/slack-desc
+#   6. makepkg to produce $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.txz
+
+echo "TODO: implement containers-common.SlackBuild"
+exit 1
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+containers-common: containers-common (TODO: one-line summary)
+containers-common:
+containers-common: TODO: two-to-three sentence description of containers-common, its role in the
+containers-common: unraid-podman plugin, and a link to the upstream project.
+containers-common:
+containers-common: Homepage: https://github.com/containers/common
+containers-common:
+containers-common:
+containers-common:
+containers-common:
+containers-common:
@@ -0,0 +1,15 @@
+# packages/crun
+
+Slackware package build recipe for **crun**.
+
+- Upstream: https://github.com/containers/crun
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `crun.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,59 @@
+#!/bin/bash
+# =============================================================================
+# packages/crun/crun.SlackBuild
+#
+# Builds the crun .txz package from upstream source (C, autotools). crun is
+# the OCI runtime this project uses (preferred over runc — lighter, cgroup
+# v2-friendly, see docs/ARCHITECTURE.md section 5.1).
+#
+# Requires (in the build environment): gcc, make, autoconf, automake,
+# libtool, pkg-config, libcap-dev, libseccomp-dev, libyajl-dev, python3
+# (used by crun's build-time code generator).
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$CRUN_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "crun"
+
+tarball=$(sb_fetch_and_verify "$CRUN_SRC_URL" "$CRUN_SRC_SHA256" "crun-$VERSION.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [crun] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+# GitHub's source archive does not include vendored git submodules
+# (libocispec) that crun's release tarballs normally bundle; init/update
+# them explicitly.
+if [ -f .gitmodules ]; then
+  echo "==> [crun] fetching submodules"
+  git -c protocol.file.allow=always submodule update --init --recursive || true
+fi
+
+echo "==> [crun] autogen + configure"
+./autogen.sh
+./configure --prefix=/usr --disable-systemd
+
+echo "==> [crun] make"
+make
+
+echo "==> [crun] make install into \$PKG"
+make install DESTDIR="$PKG"
+
+sb_install_docs "$srcdir/COPYING" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+crun: crun (TODO: one-line summary)
+crun:
+crun: TODO: two-to-three sentence description of crun, its role in the
+crun: unraid-podman plugin, and a link to the upstream project.
+crun:
+crun: Homepage: https://github.com/containers/crun
+crun:
+crun:
+crun:
+crun:
+crun:
@@ -0,0 +1,15 @@
+# packages/fuse-overlayfs
+
+Slackware package build recipe for **fuse-overlayfs**.
+
+- Upstream: https://github.com/containers/fuse-overlayfs
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `fuse-overlayfs.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,54 @@
+#!/bin/bash
+# =============================================================================
+# packages/fuse-overlayfs/fuse-overlayfs.SlackBuild
+#
+# Builds the fuse-overlayfs .txz package from upstream source (C, autotools).
+# Not used by the rootful storage path in Phase 1 (which uses the native
+# overlay driver on the podman.img loopback filesystem — see
+# docs/ARCHITECTURE.md section 10), but required ahead of time for the
+# rootless Podman phase, where unprivileged overlay mounts generally aren't
+# available (see docs/ARCHITECTURE.md section 0, "Nicht-Ziele" / ROADMAP.md
+# Phase 3).
+#
+# Requires (in the build environment): gcc, make, autoconf, automake,
+# libtool, pkg-config, libfuse3-dev.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$FUSE_OVERLAYFS_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "fuse-overlayfs"
+
+tarball=$(sb_fetch_and_verify "$FUSE_OVERLAYFS_SRC_URL" "$FUSE_OVERLAYFS_SRC_SHA256" "fuse-overlayfs-$VERSION.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [fuse-overlayfs] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+echo "==> [fuse-overlayfs] autogen + configure"
+./autogen.sh
+./configure --prefix=/usr
+
+echo "==> [fuse-overlayfs] make"
+make
+
+echo "==> [fuse-overlayfs] make install into \$PKG"
+make install DESTDIR="$PKG"
+
+sb_install_docs "$srcdir/COPYING" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+fuse-overlayfs: fuse-overlayfs (TODO: one-line summary)
+fuse-overlayfs:
+fuse-overlayfs: TODO: two-to-three sentence description of fuse-overlayfs, its role in the
+fuse-overlayfs: unraid-podman plugin, and a link to the upstream project.
+fuse-overlayfs:
+fuse-overlayfs: Homepage: https://github.com/containers/fuse-overlayfs
+fuse-overlayfs:
+fuse-overlayfs:
+fuse-overlayfs:
+fuse-overlayfs:
+fuse-overlayfs:
@@ -0,0 +1,15 @@
+# packages/netavark
+
+Slackware package build recipe for **netavark**.
+
+- Upstream: https://github.com/containers/netavark
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `netavark.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,49 @@
+#!/bin/bash
+# =============================================================================
+# packages/netavark/netavark.SlackBuild
+#
+# Builds the netavark .txz package from upstream source (Rust). netavark is
+# this project's container networking backend (see docs/ARCHITECTURE.md
+# section 8) — it is installed as a libexec helper binary, not a $PATH tool,
+# matching upstream's own layout so podman finds it via
+# `netavark_binary_dir` in containers.conf.
+#
+# Requires (in the build environment): rustc, cargo (a recent stable
+# toolchain — check upstream's Cargo.toml `rust-version` for the current
+# minimum).
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$NETAVARK_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "netavark"
+
+tarball=$(sb_fetch_and_verify "$NETAVARK_SRC_URL" "$NETAVARK_SRC_SHA256" "netavark-$VERSION.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [netavark] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+echo "==> [netavark] cargo build --release"
+cargo build --release --locked
+
+echo "==> [netavark] install into \$PKG"
+install -D -m 0755 target/release/netavark "$PKG/usr/libexec/podman/netavark"
+
+sb_install_docs "$srcdir/LICENSE" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+netavark: netavark (TODO: one-line summary)
+netavark:
+netavark: TODO: two-to-three sentence description of netavark, its role in the
+netavark: unraid-podman plugin, and a link to the upstream project.
+netavark:
+netavark: Homepage: https://github.com/containers/netavark
+netavark:
+netavark:
+netavark:
+netavark:
+netavark:
@@ -0,0 +1,21 @@
+# packages/passt
+
+Slackware package build recipe for **passt** (and its `pasta` counterpart).
+
+- Upstream: https://passt.top/passt/about/ (cgit, no GitHub mirror)
+- Pinned commit: see `PASST_COMMIT` in [versions.env](../../versions.env)
+- Patches: see `patches/` (currently none)
+- Build entry point: `passt.SlackBuild`
+
+## Notes
+
+Unlike the other six packages, passt has no tagged releases or semver
+versioning upstream — distributions package it straight from a pinned git
+commit (this is also how Fedora/Debian build it). `scripts/update-versions.sh`
+handles re-pinning to a newer commit and recomputing the snapshot checksum;
+see [versions.env](../../versions.env) for the exact snapshot URL pattern.
+
+Not required for the Phase 1 (rootful) MVP — passt/pasta become relevant once
+rootless Podman support is added (see
+[docs/ROADMAP.md](../../docs/ROADMAP.md), Phase 3). It is built now so the
+package pipeline covers the full dependency set from day one.
@@ -0,0 +1,49 @@
+#!/bin/bash
+# =============================================================================
+# packages/passt/passt.SlackBuild
+#
+# Builds the passt/pasta .txz package from upstream source (C, plain
+# Makefile — no autotools). passt is Podman's modern unprivileged
+# user-mode network transport for rootless containers, superseding
+# slirp4netns (see versions.env for why this project pins it via a git
+# commit snapshot rather than a tagged release: upstream has no GitHub
+# mirror and does not use semver tags).
+#
+# Requires (in the build environment): gcc, make. No external library
+# dependencies beyond libc — passt deliberately avoids them.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$PASST_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "passt"
+
+tarball=$(sb_fetch_and_verify "$PASST_SRC_URL" "$PASST_SRC_SHA256" "passt-$PASST_COMMIT.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [passt] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+echo "==> [passt] make"
+make
+
+echo "==> [passt] make install into \$PKG"
+make install prefix=/usr DESTDIR="$PKG"
+
+sb_install_docs "$srcdir/LICENSES/GPL-2.0-or-later.txt" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+passt: passt (unprivileged user-mode networking for VMs/containers)
+passt:
+passt: passt and pasta provide unprivileged (rootless) user-mode network
+passt: connectivity for containers and VMs, without requiring a tap device
+passt: or elevated capabilities. Podman uses it as the rootless network
+passt: transport, superseding slirp4netns.
+passt:
+passt: Homepage: https://passt.top/passt/about/
+passt:
+passt:
+passt:
@@ -0,0 +1,15 @@
+# packages/podman
+
+Slackware package build recipe for **podman**.
+
+- Upstream: https://github.com/containers/podman
+- Pinned version: TODO
+- Patches: see `patches/` (currently none)
+- Build entry point: `podman.SlackBuild` (placeholder, not yet implemented)
+
+## Notes
+
+TODO: document any Unraid/Slackware-specific build considerations (static
+linking, cgroup v2 assumptions, kernel feature requirements) once the build
+script is implemented. See
+[docs/ARCHITECTURE.md, section 5.2 (Build-Strategie)](../../docs/ARCHITECTURE.md#52-build-strategie).
@@ -0,0 +1,74 @@
+#!/bin/bash
+# =============================================================================
+# packages/podman/podman.SlackBuild
+#
+# Builds the podman .txz package from upstream source (Go). Version and
+# checksum are pinned centrally in versions.env — see
+# scripts/lib/slackbuild-common.sh for the shared fetch/verify/package
+# helpers used below, and docs/ARCHITECTURE.md section 5 for why the
+# graphdriver build tags below are what they are (this project only ever
+# uses the overlay storage driver, see docs/ARCHITECTURE.md section 10).
+#
+# Requires (in the build environment): go >= 1.22, make, gcc, pkg-config,
+# libseccomp-dev. GPG signature verification support is intentionally left
+# out to keep the dependency footprint minimal for a from-scratch Slackware
+# build.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$PODMAN_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "podman"
+
+tarball=$(sb_fetch_and_verify "$PODMAN_SRC_URL" "$PODMAN_SRC_SHA256" "podman-$VERSION.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+# Apply any local patches (none currently — see packages/podman/patches/).
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [podman] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+# Build tags: exclude storage backends this project doesn't use (btrfs,
+# devicemapper — see docs/ARCHITECTURE.md section 10, overlay-only), exclude
+# systemd integration (Unraid has no systemd — see docs/ARCHITECTURE.md
+# "Rahmenbedingungen"), keep seccomp support.
+export BUILDTAGS="seccomp exclude_graphdriver_btrfs exclude_graphdriver_devicemapper containers_image_openpgp"
+export CGO_ENABLED=1
+export GOFLAGS="${GOFLAGS:--mod=mod}"
+
+echo "==> [podman] make (BUILDTAGS=$BUILDTAGS)"
+make BUILDTAGS="$BUILDTAGS" GO_BUILD_FLAGS="-ldflags -s"
+
+echo "==> [podman] make install into \$PKG"
+make install \
+  DESTDIR="$PKG" \
+  PREFIX=/usr \
+  ETCDIR="$PKG/etc" \
+  BUILDTAGS="$BUILDTAGS"
+
+# We ship our own containers.conf/storage.conf/registries.conf/policy.json
+# templates (see config/) staged via plugin/podman.plg instead of upstream's
+# defaults, so drop the ones `make install` places under $PKG/etc to avoid
+# ambiguity about which file is authoritative on a running system.
+rm -rf "$PKG/etc/containers"
+
+# No systemd units — Unraid has no systemd (see docs/ARCHITECTURE.md,
+# "Rahmenbedingungen"); process lifecycle is entirely owned by rc.podman.
+rm -rf "$PKG/usr/lib/systemd" "$PKG/lib/systemd"
+
+sb_install_docs "$srcdir/LICENSE" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+podman: podman (TODO: one-line summary)
+podman:
+podman: TODO: two-to-three sentence description of podman, its role in the
+podman: unraid-podman plugin, and a link to the upstream project.
+podman:
+podman: Homepage: https://github.com/containers/podman
+podman:
+podman:
+podman:
+podman:
+podman:
@@ -0,0 +1,16 @@
+# packages/unraid-podman
+
+Packaging recipe for the plugin's own scaffolding — **not** an upstream
+component like the other seven package directories. See
+`unraid-podman.SlackBuild`'s header comment for the full rationale.
+
+Bundles:
+- `plugin/rc.d/rc.podman` → `/etc/rc.d/rc.podman`
+- `plugin/sbin/*.sh` → `/usr/local/sbin/`
+- `plugin/event/*` → `/usr/local/emhttp/plugins/podman/event/` (official
+  Unraid array-event hooks — see those files' own header comments)
+- `config/*.conf`, `config/podman.cfg.example` → `/usr/local/share/unraid-podman/templates/`
+- `webui/plugins/podman/` → `/usr/local/emhttp/plugins/podman/` (once populated, see [docs/ROADMAP.md](../../docs/ROADMAP.md))
+
+Version is read directly from `plugin/podman.plg`'s `<!ENTITY version>` —
+there's no separate version to keep in sync.
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+unraid-podman: unraid-podman (plugin scaffolding: rc.podman, hooks, config)
+unraid-podman:
+unraid-podman: This package contains the unraid-podman plugin's own files —
+unraid-podman: the rc.podman init script, helper scripts under
+unraid-podman: /usr/local/sbin, the official Unraid array event hooks, and
+unraid-podman: default configuration templates. It does not contain Podman
+unraid-podman: itself (see the separate podman/conmon/crun/... packages).
+unraid-podman:
+unraid-podman: Homepage: https://github.com/OWNER/unraid-podman
+unraid-podman:
+unraid-podman:
@@ -0,0 +1,84 @@
+#!/bin/bash
+# =============================================================================
+# packages/unraid-podman/unraid-podman.SlackBuild
+#
+# Unlike the other seven packages, this one does not compile anything from
+# an external upstream source — it packages THIS repository's own plugin
+# scaffolding (rc.podman, the sbin/ helper scripts, the official Unraid
+# event/ hooks, and the default config templates) into a single .txz,
+# exactly matching how real-world Unraid plugins bundle their own files
+# (verified against the actual unassigned.devices.plg / package layout —
+# see docs/ARCHITECTURE.md section 3.2 for the reference check that led to
+# this design). plugin/podman.plg installs this alongside the seven
+# compiled component packages, all via the same
+# `upgradepkg --install-new --reinstall` mechanism.
+#
+# Version: taken directly from plugin/podman.plg's own <!ENTITY version>,
+# so there is exactly one place a release's plugin version is defined —
+# scripts/release.sh already updates that entity, and this script just
+# reads it back rather than duplicating it in versions.env (which is
+# reserved for pinning EXTERNAL upstream sources, see that file's header).
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION=$(grep -oP '(?<=<!ENTITY version[[:space:]]{1,10}")[^"]+' "$REPO_ROOT/plugin/podman.plg" | head -n1)
+if [ -z "$VERSION" ]; then
+  echo "!! Could not read <!ENTITY version> from $REPO_ROOT/plugin/podman.plg" >&2
+  exit 1
+fi
+
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "unraid-podman"
+
+# --- Stage rc.podman -----------------------------------------------------
+install -D -m 0755 "$REPO_ROOT/plugin/rc.d/rc.podman" "$PKG/etc/rc.d/rc.podman"
+
+# --- Stage sbin helper scripts ---------------------------------------------
+for f in "$REPO_ROOT"/plugin/sbin/*.sh; do
+  install -D -m 0755 "$f" "$PKG/usr/local/sbin/$(basename "$f")"
+done
+
+# --- Stage official Unraid plugin event hooks -------------------------------
+# See plugin/event/*/'s own header comments: this is the officially
+# documented mechanism (verified against unassigned.devices), NOT a
+# /boot/config/go edit.
+for f in "$REPO_ROOT"/plugin/event/*; do
+  install -D -m 0755 "$f" "$PKG/usr/local/emhttp/plugins/podman/event/$(basename "$f")"
+done
+
+# --- Stage default config templates -----------------------------------------
+# Consumed by podman-config.sh's `seed` command at install/first-boot time —
+# see that script's header comment for the seed-only-if-missing contract.
+for f in containers.conf storage.conf registries.conf policy.json; do
+  install -D -m 0644 "$REPO_ROOT/config/$f" "$PKG/usr/local/share/unraid-podman/templates/$f"
+done
+install -D -m 0644 "$REPO_ROOT/config/podman.cfg.example" \
+  "$PKG/usr/local/share/unraid-podman/templates/podman.cfg.example"
+
+# --- Stage WebUI files, if present ------------------------------------------
+# webui/plugins/podman/ is populated starting in a later development phase
+# (see docs/ROADMAP.md, Phase 2) — copy it in wholesale when it exists so
+# this SlackBuild doesn't need to change again once it does.
+if [ -d "$REPO_ROOT/webui/plugins/podman" ]; then
+  mkdir -p "$PKG/usr/local/emhttp/plugins/podman"
+  cp -a "$REPO_ROOT/webui/plugins/podman/." "$PKG/usr/local/emhttp/plugins/podman/"
+  # event/ was already staged above with correct permissions — avoid
+  # clobbering it with a possibly-non-executable copy from webui/ (which
+  # has no reason to contain its own event/ directory, but be defensive).
+  for f in "$REPO_ROOT"/plugin/event/*; do
+    install -D -m 0755 "$f" "$PKG/usr/local/emhttp/plugins/podman/event/$(basename "$f")"
+  done
+fi
+
+sb_install_docs "$REPO_ROOT/LICENSE" "$REPO_ROOT/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"