forked from cilium/cilium
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: reproducible images based on upstream releases
- Loading branch information
Showing
4 changed files
with
45 additions
and
170 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -39,21 +39,22 @@ ARG LOCKDEBUG | |
| ARG RACE | ||
| ARG V | ||
| ARG LIBNETWORK_PLUGIN | ||
| ARG SOURCE_DATE_EPOCH=0 | ||
|
|
||
| # | ||
| # Please do not add any dependency updates before the 'make install' here, | ||
| # as that will mess with caching for incremental builds! | ||
| # | ||
| WORKDIR /go/src/github.com/cilium/cilium | ||
| RUN --mount=type=bind,readwrite,target=/go/src/github.com/cilium/cilium --mount=target=/root/.cache,type=cache --mount=target=/go/pkg,type=cache \ | ||
| make GOARCH=${TARGETARCH} RACE=${RACE} NOSTRIP=${NOSTRIP} NOOPT=${NOOPT} LOCKDEBUG=${LOCKDEBUG} PKG_BUILD=1 V=${V} LIBNETWORK_PLUGIN=${LIBNETWORK_PLUGIN} \ | ||
| SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} make GOARCH=${TARGETARCH} RACE=${RACE} NOSTRIP=${NOSTRIP} NOOPT=${NOOPT} LOCKDEBUG=${LOCKDEBUG} PKG_BUILD=1 V=${V} LIBNETWORK_PLUGIN=${LIBNETWORK_PLUGIN} \ | ||
| DESTDIR=/tmp/install/${TARGETOS}/${TARGETARCH} build-container install-container-binary | ||
|
|
||
| RUN --mount=type=bind,readwrite,target=/go/src/github.com/cilium/cilium --mount=target=/root/.cache,type=cache --mount=target=/go/pkg,type=cache \ | ||
| # install-bash-completion will execute the bash_completion script. It is | ||
| # fine to run this with same architecture as BUILDARCH since the output of | ||
| # bash_completion is the same for both architectures. | ||
| make GOARCH=${BUILDARCH} RACE=${RACE} NOSTRIP=${NOSTRIP} NOOPT=${NOOPT} LOCKDEBUG=${LOCKDEBUG} PKG_BUILD=1 V=${V} LIBNETWORK_PLUGIN=${LIBNETWORK_PLUGIN} \ | ||
| SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} make GOARCH=${BUILDARCH} RACE=${RACE} NOSTRIP=${NOSTRIP} NOOPT=${NOOPT} LOCKDEBUG=${LOCKDEBUG} PKG_BUILD=1 V=${V} LIBNETWORK_PLUGIN=${LIBNETWORK_PLUGIN} \ | ||
| DESTDIR=/tmp/install/${TARGETOS}/${TARGETARCH} install-bash-completion licenses-all && \ | ||
| mv LICENSE.all /tmp/install/${TARGETOS}/${TARGETARCH}/LICENSE.all | ||
|
|
||
|
|
@@ -62,6 +63,8 @@ COPY images/cilium/init-container.sh \ | |
| plugins/cilium-cni/cni-uninstall.sh \ | ||
| /tmp/install/${TARGETOS}/${TARGETARCH} | ||
|
|
||
| RUN find /tmp/install/${TARGETOS}/${TARGETARCH} -depth -execdir touch --no-dereference -a -m -t $(date -u -d @${SOURCE_DATE_EPOCH} +%Y%m%d%H%M.%S) '{}' ';' | ||
|
|
||
| # | ||
| # Cilium runtime install. | ||
| # | ||
|
|
@@ -72,26 +75,13 @@ COPY images/cilium/init-container.sh \ | |
| # built while allowing the new versions to make changes that are not | ||
| # backwards compatible. | ||
| # | ||
| FROM ${CILIUM_RUNTIME_IMAGE} as release | ||
| FROM docker.io/cilium/cilium:v1.15.0-pre.3@sha256:c09d3fc906f26edbc93494cc46e6616668d7931a05470f02b9f9a266c2cfc279 as release | ||
| # TARGETOS is an automatic platform ARG enabled by Docker BuildKit. | ||
| ARG TARGETOS | ||
| # TARGETARCH is an automatic platform ARG enabled by Docker BuildKit. | ||
| ARG TARGETARCH | ||
| LABEL maintainer="[email protected]" | ||
| RUN echo ". /etc/profile.d/bash_completion.sh" >> /etc/bash.bashrc | ||
| COPY --from=cilium-envoy /usr/lib/libcilium.so /usr/lib/libcilium.so | ||
| COPY --from=cilium-envoy /usr/bin/cilium-envoy /usr/bin/cilium-envoy-starter /usr/bin/ | ||
| # When used within the Cilium container, Hubble CLI should target the | ||
| # local unix domain socket instead of Hubble Relay. | ||
| ENV HUBBLE_SERVER=unix:///var/run/cilium/hubble.sock | ||
| COPY --from=hubble /out/${TARGETOS}/${TARGETARCH}/bin/hubble /usr/bin/hubble | ||
| COPY --from=hubble /out/linux/bash_completion /etc/bash_completion.d/hubble | ||
|
|
||
| COPY --from=builder /tmp/install/${TARGETOS}/${TARGETARCH} / | ||
| WORKDIR /home/cilium | ||
|
|
||
| ENV INITSYSTEM="SYSTEMD" | ||
| CMD ["/usr/bin/cilium-dbg"] | ||
| COPY --link --from=builder /tmp/install/${TARGETOS}/${TARGETARCH} / | ||
|
|
||
| # | ||
| # Cilium debug image. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,13 +20,14 @@ ARG NOOPT | |
| ARG LOCKDEBUG | ||
| ARG RACE | ||
| ARG OPERATOR_VARIANT | ||
| ARG SOURCE_DATE_EPOCH=0 | ||
|
|
||
| WORKDIR /go/src/github.com/cilium/cilium | ||
|
|
||
| RUN --mount=type=bind,readwrite,target=/go/src/github.com/cilium/cilium \ | ||
| --mount=type=cache,target=/root/.cache \ | ||
| --mount=type=cache,target=/go/pkg \ | ||
| make GOARCH=${TARGETARCH} RACE=${RACE} NOSTRIP=${NOSTRIP} NOOPT=${NOOPT} LOCKDEBUG=${LOCKDEBUG} \ | ||
| SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} make GOARCH=${TARGETARCH} RACE=${RACE} NOSTRIP=${NOSTRIP} NOOPT=${NOOPT} LOCKDEBUG=${LOCKDEBUG} \ | ||
| DESTDIR=/out/${TARGETOS}/${TARGETARCH} build-container-${OPERATOR_VARIANT} install-container-binary-${OPERATOR_VARIANT} | ||
|
|
||
| # licenses-all is a "script" that executes "go run" so its ARCH should be set | ||
|
|
@@ -36,6 +37,8 @@ RUN --mount=type=bind,readwrite,target=/go/src/github.com/cilium/cilium \ | |
| --mount=type=cache,target=/go/pkg \ | ||
| make GOARCH=${BUILDARCH} licenses-all && mv LICENSE.all /out/${TARGETOS}/${TARGETARCH} | ||
|
|
||
| RUN find /out/${TARGETOS}/${TARGETARCH} -depth -execdir touch --no-dereference -a -m -t $(date -u -d @${SOURCE_DATE_EPOCH} +%Y%m%d%H%M.%S) '{}' ';' | ||
|
|
||
| # BUILDPLATFORM is an automatic platform ARG enabled by Docker BuildKit. | ||
| # Represents the plataform where the build is happening, do not mix with | ||
| # TARGETARCH | ||
|
|
@@ -55,20 +58,12 @@ RUN --mount=type=bind,readwrite,target=/go/src/github.com/cilium/cilium \ | |
| --mount=type=cache,target=/go/pkg \ | ||
| ./build-gops.sh | ||
|
|
||
| FROM ${BASE_IMAGE} as release | ||
| FROM docker.io/cilium/operator:v1.15.0-pre.3@sha256:1df2ea3840ca1c012d86f8e9dd785c3f24ce319915db3e6c99150627dfdc08cb as release | ||
| # TARGETOS is an automatic platform ARG enabled by Docker BuildKit. | ||
| ARG TARGETOS | ||
| # TARGETARCH is an automatic platform ARG enabled by Docker BuildKit. | ||
| ARG TARGETARCH | ||
| ARG OPERATOR_VARIANT | ||
| LABEL maintainer="[email protected]" | ||
| COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt | ||
| COPY --from=gops /out/${TARGETOS}/${TARGETARCH}/bin/gops /bin/gops | ||
| COPY --from=builder /out/${TARGETOS}/${TARGETARCH}/usr/bin/cilium-${OPERATOR_VARIANT} /usr/bin/cilium-${OPERATOR_VARIANT} | ||
| COPY --from=builder /out/${TARGETOS}/${TARGETARCH}/LICENSE.all /LICENSE.all | ||
| WORKDIR / | ||
| ENV GOPS_CONFIG_DIR=/ | ||
| CMD ["/usr/bin/cilium-${OPERATOR_VARIANT}"] | ||
| COPY --link --from=builder /out/${TARGETOS}/${TARGETARCH} / | ||
|
|
||
| FROM --platform=${BUILDPLATFORM} ${CILIUM_BUILDER_IMAGE} as debug-tools | ||
|
|
||
|
|
||