6 files changed, 78 insertions, 113 deletions
diff --git a/debian/.gitignore b/debian/.gitignore
index 3eb2fb2..96bfb9e 100644
--- a/debian/.gitignore
+++ b/debian/.gitignore
@@ -1,2 +1 @@
 build-area/
-.vagrant/
diff --git a/debian/Dockerfile b/debian/Dockerfile
new file mode 100644
index 0000000..c29c56e
--- /dev/null
+++ b/debian/Dockerfile
@@ -0,0 +1,52 @@
+FROM ubuntu:focal
+
+ENV GPG_KEY="09AEA2BAD52882A1AF9D6042F218DB829A9905B5"
+ENV DEBFULLNAME="Egor Tensin"
+ENV DEBEMAIL="egor@tensin.name"
+
+ARG UID=1000
+ARG GID=1000
+
+RUN if ! id -n -g "$GID" ; then \
+        groupadd -g "$GID" builder ; \
+    fi
+
+RUN if ! id -n -u "$UID" ; then \
+        useradd -u "$UID" -g "$GID" --shell /bin/bash --create-home builder && \
+        passwd -d builder ; \
+    fi
+
+RUN apt update && \
+    DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends \
+        dirmngr \
+        gpg \
+        gpg-agent \
+        git \
+        make \
+        sudo
+
+# I'd prefer to run everything as root, but some bright person decided to
+# hardcode sudo usage in git-pbuilder (https://manpages.org/git-pbuilder):
+#
+#     > In this case, it calls cowbuilder (or the configured builder as described above) _using sudo_
+#
+RUN echo 'ALL ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers
+
+COPY ["prelude.mk", "/"]
+COPY ["debian/Makefile", "/deps/"]
+RUN make -C /deps deps
+
+USER "$UID:$GID"
+
+RUN git config --global user.name "$DEBFULLNAME" && \
+    git config --global user.email "$DEBEMAIL"
+
+ENV GNUPGHOME=/tmp/gnupg
+RUN mkdir -p -- "$GNUPGHOME" && \
+    chmod 0700 "$GNUPGHOME"
+
+RUN gpg --keyserver hkp://keyserver.ubuntu.com/ --recv-keys "0x$GPG_KEY" && \
+    echo "$GPG_KEY:6:" | gpg --import-ownertrust
+
+COPY [".", "/app"]
+WORKDIR /app/debian
diff --git a/debian/Makefile b/debian/Makefile
index 085e306..72be202 100644
--- a/debian/Makefile
+++ b/debian/Makefile
@@ -1,26 +1,27 @@
 include ../prelude.mk
 
-NAME      ?= Egor Tensin
-EMAIL     ?= egor@tensin.name
 PPA_OWNER ?= egor-tensin
 PPA_NAME  ?= config-links
 GPG_KEY   ?= 09AEA2BAD52882A1AF9D6042F218DB829A9905B5
 DIST      ?= focal
 
-$(eval $(call noexpand,NAME))
-$(eval $(call noexpand,EMAIL))
 $(eval $(call noexpand,PPA_OWNER))
 $(eval $(call noexpand,PPA_NAME))
 $(eval $(call noexpand,GPG_KEY))
 $(eval $(call noexpand,DIST))
 
-export NAME
-export EMAIL
-
 this_dir   := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
 root       := $(this_dir)/..
 build_area := $(this_dir)/build-area
 
+.PHONY: docker
+docker:
+	uid="$$( stat -c '%u' . )" && \
+	gid="$$( stat -c '%g' . )" && \
+	docker compose build --build-arg UID="$$uid" --build-arg GID="$$gid"
+	docker compose run --rm builder
+	docker compose down -v
+
 .PHONY: deps
 deps:
 	apt update
@@ -30,8 +31,10 @@ deps:
 		devscripts \
 		dh-make \
 		dput \
+		fakeroot \
 		git-buildpackage \
-		vim
+		openssh-client \
+		sudo
 
 .PHONY: dch
 dch:
diff --git a/debian/README.Debian b/debian/README.Debian
index 0a1f9b4..a993681 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -1,9 +1,8 @@
 config-links for Debian
 ----------------------
 
-There's a Vagrantfile to make maintenance easier.  To start, use `vagrant up`,
-then `vagrant ssh`.  The project will be in /vagrant; kill the VM using
-`vagrant destroy -f` when you're done.
+There's a Dockerfile to make maintenance easier.  To start, run `make docker`;
+on exit from the shell, the container will be brought down.
 
 There're a bunch of useful one-liners in Makefile.  Everything is built in
 debian/build-area/.
diff --git a/debian/Vagrantfile b/debian/Vagrantfile
deleted file mode 100644
index 2b38b0f..0000000
--- a/debian/Vagrantfile
+++ /dev/null
@@ -1,101 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-NAME = 'Egor Tensin'
-EMAIL = 'egor@tensin.name'
-GPG_KEY = '09AEA2BAD52882A1AF9D6042F218DB829A9905B5'
-UID = Process.euid
-
-REQUIRED_PLUGINS = %w(
-  vagrant-libvirt
-  vagrant-reload
-)
-exit unless REQUIRED_PLUGINS.all? do |plugin|
-  Vagrant.has_plugin?(plugin) || (
-    puts "The #{plugin} plugin is required. Please install it with:"
-    puts "    vagrant plugin install #{plugin}"
-    false
-  )
-end
-
-Vagrant.configure("2") do |config|
-  config.vm.box = "generic/ubuntu2004"
-
-  # Weirdly enough, VirtualBox's shared folders didn't quite work for me.
-  # gbp buildpackage would just exit with FileExistsError, which doesn't
-  # happen with NFS shares.
-  config.vm.synced_folder "../", "/vagrant",
-    type: "nfs",
-    nfs_udp: false,
-    nfs_version: "4"
-
-  config.vm.provider "libvirt" do |v|
-    v.cpus = 2
-    v.memory = 4096
-  end
-
-  # Working with the git repository:
-  config.vm.provision "shell", privileged: false, inline: <<-SHELL
-#!/usr/bin/env bash
-set -o errexit -o nounset -o pipefail
-git config --global user.name '#{NAME}'
-git config --global user.email '#{EMAIL}'
-  SHELL
-  config.ssh.forward_agent = true
-
-  # Set DEB* environment variables:
-  config.vm.provision "shell", privileged: false, inline: <<-SHELL
-#!/usr/bin/env bash
-set -o errexit -o nounset -o pipefail
-tee -a ~/.bashrc <<'EOF'
-export DEBFULLNAME='#{NAME}'
-export DEBEMAIL='#{EMAIL}'
-EOF
-  SHELL
-
-  # gpg-agent forwarding (https://wiki.gnupg.org/AgentForwarding):
-  config.vm.provision "shell", privileged: false, inline: <<-SHELL
-#!/usr/bin/env bash
-set -o errexit -o nounset -o pipefail
-gpg --keyserver hkp://keyserver.ubuntu.com/ --recv-keys '0x#{GPG_KEY}'
-gpg --import-ownertrust <<'EOF'
-#{GPG_KEY}:6:
-EOF
-  SHELL
-  config.vm.provision "shell", inline: <<-SHELL
-#!/usr/bin/env bash
-set -o errexit -o nounset -o pipefail
-echo 'StreamLocalBindUnlink yes' >> /etc/ssh/sshd_config
-  SHELL
-  # "agent-extra-socket" on the host.
-  local_gpg_socket = one_line(run('gpgconf', '--list-dirs', 'agent-extra-socket'))
-  # "agent-socket" on the VM.
-  remote_gpg_socket = "/run/user/#{UID}/gnupg/S.gpg-agent"
-  config.ssh.extra_args = ['-R', "#{remote_gpg_socket}:#{local_gpg_socket}"]
-
-  # Install the required packages:
-  config.vm.provision "shell", inline: <<-SHELL
-#!/usr/bin/env bash
-set -o errexit -o nounset -o pipefail
-apt update
-DEBIAN_FRONTEND=noninteractive apt install -y --no-install-recommends make
-cd /vagrant/debian
-make deps
-  SHELL
-
-  config.vm.provision :reload
-end
-
-require "open3"
-
-def run(*cmd)
-  stdout, stderr, status = Open3.capture3(*cmd)
-  abort stderr unless status.success?
-  stdout
-end
-
-def one_line(output)
-  lines = output.lines.map(&:chomp)
-  abort "Must be a single line: #{lines}" unless lines.length == 1
-  lines.first
-end
diff --git a/debian/docker-compose.yml b/debian/docker-compose.yml
new file mode 100644
index 0000000..9e38238
--- /dev/null
+++ b/debian/docker-compose.yml
@@ -0,0 +1,13 @@
+services:
+  builder:
+    build:
+      context: ..
+      dockerfile: debian/Dockerfile
+    cap_add:
+      - SYS_ADMIN
+    environment:
+      SSH_AUTH_SOCK: /ssh-agent.sock
+    volumes:
+      - '../:/app'
+      - /run/user/1000/gnupg/S.gpg-agent.extra:/tmp/gnupg/S.gpg-agent
+      - "${SSH_AUTH_SOCK}:/ssh-agent.sock"