|
| 1 | +# syntax=docker/dockerfile:1.16.0@sha256:e2dd261f92e4b763d789984f6eab84be66ab4f5f08052316d8eb8f173593acf7 |
| 2 | +# check=error=true |
| 3 | + |
| 4 | +# Find the latest version at https://catalog.redhat.com/en/software/containers/ubi10/ubi-minimal/66f1504a379b9c2cf23e145c#get-the-image |
| 5 | +# IMPORTANT: Make sure to use the "Manifest List Digest" that references the images for multiple architectures |
| 6 | +# rather than just the "Image Digest" that references the image for the selected architecture. |
| 7 | +# The website is broken, so you can use this to find it: |
| 8 | +# curl https://catalog.redhat.com/en/software/containers/ubi10/ubi-minimal/66f1504a379b9c2cf23e145c \ |
| 9 | +# | grep -oE 'registry.redhat.io/ubi10/ubi-minimal@sha256:[a-z0-9]{64}' |
| 10 | +FROM registry.access.redhat.com/ubi10/ubi-minimal@sha256:a74a7a92d3069bfac09c6882087771fc7db59fa9d8e16f14f4e012fe7288554c AS builder |
| 11 | + |
| 12 | +LABEL maintainer="Stackable GmbH" |
| 13 | + |
| 14 | +# Pin the rustup version to avoid unexpected breaking changes. |
| 15 | +# See https://github.com/rust-lang/rustup/blob/4514d36fcc9c42416176111cd841c86f7ec44b2c/rustup-init.sh#L91 |
| 16 | +# Find the latest version here: https://github.com/rust-lang/rustup/tags |
| 17 | +# renovate: datasource=github-tags packageName=rust-lang/rustup |
| 18 | +ENV RUSTUP_VERSION=1.28.2 |
| 19 | +# This SHOULD be kept in sync with operator-templating and other tools to reduce build times |
| 20 | +# Find the latest version here: https://doc.rust-lang.org/stable/releases.html |
| 21 | +# renovate: datasource=github-releases packageName=rust-lang/rust |
| 22 | +ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.93.0 |
| 23 | +# Find the latest version here: https://crates.io/crates/cargo-cyclonedx |
| 24 | +# renovate: datasource=crate packageName=cargo-cyclonedx |
| 25 | +ENV CARGO_CYCLONEDX_CRATE_VERSION=0.5.7 |
| 26 | +# Find the latest version here: https://crates.io/crates/cargo-auditable |
| 27 | +# renovate: datasource=crate packageName=cargo-auditable |
| 28 | +ENV CARGO_AUDITABLE_CRATE_VERSION=0.7.2 |
| 29 | +# Find the latest version here: https://github.com/protocolbuffers/protobuf/releases |
| 30 | +# Upload any newer version to nexus with ./.scripts/upload_new_protoc_version.sh |
| 31 | +# renovate: datasource=github-releases packageName=protocolbuffers/protobuf |
| 32 | +ENV PROTOC_VERSION=31.1 |
| 33 | + |
| 34 | +# Sets the default shell to Bash with strict error handling and robust pipeline processing. |
| 35 | +# "-e": Exits immediately if a command exits with a non-zero status |
| 36 | +# "-u": Treats unset variables as an error, preventing unexpected behavior from undefined variables. |
| 37 | +# "-o pipefail": Causes a pipeline to return the exit status of the last command in the pipe that failed, ensuring errors in any part of a pipeline are not ignored. |
| 38 | +# "-c": Allows the execution of commands passed as a string |
| 39 | +# This is automatically inherited in all other Dockerfiles that use this unless it is overwritten |
| 40 | +SHELL ["/bin/bash", "-euo", "pipefail", "-c"] |
| 41 | + |
| 42 | +# We configure microdnf to not install weak dependencies in this file |
| 43 | +# Not doing this caused the content of images to become unpredictable because |
| 44 | +# based on which packages get updated by `microdnf update` new weak dependencies |
| 45 | +# might be installed that were not present earlier (the ubi base image doesn't |
| 46 | +# seem to install weak dependencies) |
| 47 | +# This also affects the packages that are installed in our Dockerfiles (java as prime |
| 48 | +# example). |
| 49 | +# https://github.com/stackabletech/docker-images/pull/533 |
| 50 | +COPY stackable-base/stackable/dnf.conf /etc/dnf/dnf.conf |
| 51 | + |
| 52 | +# Update image and install everything needed for Rustup & Rust |
| 53 | +RUN microdnf update \ |
| 54 | + && microdnf install \ |
| 55 | + clang \ |
| 56 | + cmake \ |
| 57 | + curl-minimal \ |
| 58 | + findutils \ |
| 59 | + gcc \ |
| 60 | + gcc-c++ \ |
| 61 | + # krb5 needed for secret-operator |
| 62 | + krb5-devel \ |
| 63 | + krb5-libs \ |
| 64 | + libkadm5 \ |
| 65 | + make \ |
| 66 | + openssl-devel \ |
| 67 | + pkg-config \ |
| 68 | + systemd-devel \ |
| 69 | + # tar needed to create the source code snapshot before building the Rust code |
| 70 | + tar \ |
| 71 | + unzip \ |
| 72 | + && microdnf clean all \ |
| 73 | + && rm -rf /var/cache/yum |
| 74 | + |
| 75 | +# Container Storage Interface is defined using GRPC/Protobuf, our operators that use it (secret-operator/listener-operator) require |
| 76 | +# protoc via Prost (https://github.com/tokio-rs/prost). |
| 77 | +WORKDIR /opt/protoc |
| 78 | +# Prost does not document which version of protoc it expects (https://docs.rs/prost-build/0.12.4/prost_build/), so this should be the latest upstream version |
| 79 | +# (within reason). |
| 80 | +RUN ARCH=$(arch | sed 's/^aarch64$/aarch_64/') \ |
| 81 | + && curl --fail --location --output protoc.zip "https://repo.stackable.tech/repository/packages/protoc/protoc-${PROTOC_VERSION}-linux-${ARCH}.zip" \ |
| 82 | + && unzip protoc.zip \ |
| 83 | + && rm protoc.zip |
| 84 | +ENV PROTOC=/opt/protoc/bin/protoc |
| 85 | +WORKDIR / |
| 86 | + |
| 87 | +# IMPORTANT |
| 88 | +# If you change the toolchain version here, make sure to also change the "rust_version" |
| 89 | +# property in operator-templating/config/rust.yaml |
| 90 | +RUN <<EOF |
| 91 | +curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | RUSTUP_VERSION="$RUSTUP_VERSION" sh -s -- -y --default-toolchain "$RUST_DEFAULT_TOOLCHAIN_VERSION" |
| 92 | +. "$HOME/.cargo/env" |
| 93 | +cargo install --quiet --locked "cargo-cyclonedx@$CARGO_CYCLONEDX_CRATE_VERSION" "cargo-auditable@$CARGO_AUDITABLE_CRATE_VERSION" |
| 94 | +EOF |
| 95 | + |
| 96 | +# Build artifacts will be available in /app. |
| 97 | +RUN mkdir /app |
| 98 | + |
| 99 | +COPY shared/copy_artifacts.sh / |
| 100 | + |
| 101 | +ONBUILD WORKDIR /src |
| 102 | +ONBUILD COPY . /src |
| 103 | + |
| 104 | +ONBUILD RUN <<EOF |
| 105 | +. "$HOME/.cargo/env" |
| 106 | +tar -czf /app/stackable-src.tar.gz . |
| 107 | +cargo auditable --quiet build --release --workspace |
| 108 | +cargo cyclonedx --all --spec-version 1.5 --describe binaries |
| 109 | + |
| 110 | +# -maxdepth 1: The interesting binaries are all directly in ${BUILD_DIR}. |
| 111 | +# -regex filters out tests |
| 112 | +# - exec copies matching files to /app |
| 113 | +find /src/target/release \ |
| 114 | + -regextype egrep \ |
| 115 | + -maxdepth 1 \ |
| 116 | + -executable \ |
| 117 | + -type f \ |
| 118 | + ! -regex ".*\-[a-fA-F0-9]{16,16}$" \ |
| 119 | + -exec /copy_artifacts.sh {} \; |
| 120 | + |
| 121 | +echo "The following files will be copied to the runtime image: $(ls /app)" |
| 122 | +EOF |
0 commit comments