github.com/Heebron/moby@v0.0.0-20221111184709-6eab4f55faf7/Dockerfile (about) 1 # syntax=docker/dockerfile:1 2 3 ARG CROSS="false" 4 ARG SYSTEMD="false" 5 ARG GO_VERSION=1.19.3 6 ARG DEBIAN_FRONTEND=noninteractive 7 ARG VPNKIT_VERSION=0.5.0 8 9 ARG BASE_DEBIAN_DISTRO="bullseye" 10 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" 11 12 FROM ${GOLANG_IMAGE} AS base 13 RUN echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache 14 ARG APT_MIRROR 15 RUN sed -ri "s/(httpredir|deb).debian.org/${APT_MIRROR:-deb.debian.org}/g" /etc/apt/sources.list \ 16 && sed -ri "s/(security).debian.org/${APT_MIRROR:-security.debian.org}/g" /etc/apt/sources.list 17 ENV GO111MODULE=off 18 19 FROM base AS criu 20 ARG DEBIAN_FRONTEND 21 ADD --chmod=0644 https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_11/Release.key /etc/apt/trusted.gpg.d/criu.gpg.asc 22 RUN --mount=type=cache,sharing=locked,id=moby-criu-aptlib,target=/var/lib/apt \ 23 --mount=type=cache,sharing=locked,id=moby-criu-aptcache,target=/var/cache/apt \ 24 echo 'deb https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_11/ /' > /etc/apt/sources.list.d/criu.list \ 25 && apt-get update \ 26 && apt-get install -y --no-install-recommends criu \ 27 && install -D /usr/sbin/criu /build/criu 28 29 FROM base AS registry 30 WORKDIR /go/src/github.com/docker/distribution 31 32 # REGISTRY_VERSION specifies the version of the registry to build and install 33 # from the https://github.com/docker/distribution repository. This version of 34 # the registry is used to test both schema 1 and schema 2 manifests. Generally, 35 # the version specified here should match a current release. 36 ARG REGISTRY_VERSION=v2.3.0 37 38 # REGISTRY_VERSION_SCHEMA1 specifies the version of the registry to build and 39 # install from the https://github.com/docker/distribution repository. This is 40 # an older (pre v2.3.0) version of the registry that only supports schema1 41 # manifests. This version of the registry is not working on arm64, so installation 42 # is skipped on that architecture. 43 ARG REGISTRY_VERSION_SCHEMA1=v2.1.0 44 RUN --mount=type=cache,target=/root/.cache/go-build \ 45 --mount=type=cache,target=/go/pkg/mod \ 46 --mount=type=tmpfs,target=/go/src/ \ 47 set -x \ 48 && git clone https://github.com/docker/distribution.git . \ 49 && git checkout -q "$REGISTRY_VERSION" \ 50 && GOPATH="/go/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \ 51 go build -buildmode=pie -o /build/registry-v2 github.com/docker/distribution/cmd/registry \ 52 && case $(dpkg --print-architecture) in \ 53 amd64|armhf|ppc64*|s390x) \ 54 git checkout -q "$REGISTRY_VERSION_SCHEMA1"; \ 55 GOPATH="/go/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH"; \ 56 go build -buildmode=pie -o /build/registry-v2-schema1 github.com/docker/distribution/cmd/registry; \ 57 ;; \ 58 esac 59 60 FROM base AS swagger 61 WORKDIR $GOPATH/src/github.com/go-swagger/go-swagger 62 63 # GO_SWAGGER_COMMIT specifies the version of the go-swagger binary to build and 64 # install. Go-swagger is used in CI for validating swagger.yaml in hack/validate/swagger-gen 65 # 66 # Currently uses a fork from https://github.com/kolyshkin/go-swagger/tree/golang-1.13-fix, 67 # TODO: move to under moby/ or fix upstream go-swagger to work for us. 68 ENV GO_SWAGGER_COMMIT c56166c036004ba7a3a321e5951ba472b9ae298c 69 RUN --mount=type=cache,target=/root/.cache/go-build \ 70 --mount=type=cache,target=/go/pkg/mod \ 71 --mount=type=tmpfs,target=/go/src/ \ 72 set -x \ 73 && git clone https://github.com/kolyshkin/go-swagger.git . \ 74 && git checkout -q "$GO_SWAGGER_COMMIT" \ 75 && go build -o /build/swagger github.com/go-swagger/go-swagger/cmd/swagger 76 77 FROM debian:${BASE_DEBIAN_DISTRO} AS frozen-images 78 ARG DEBIAN_FRONTEND 79 RUN --mount=type=cache,sharing=locked,id=moby-frozen-images-aptlib,target=/var/lib/apt \ 80 --mount=type=cache,sharing=locked,id=moby-frozen-images-aptcache,target=/var/cache/apt \ 81 apt-get update && apt-get install -y --no-install-recommends \ 82 ca-certificates \ 83 curl \ 84 jq 85 # Get useful and necessary Hub images so we can "docker load" locally instead of pulling 86 COPY contrib/download-frozen-image-v2.sh / 87 ARG TARGETARCH 88 RUN /download-frozen-image-v2.sh /build \ 89 busybox:latest@sha256:95cf004f559831017cdf4628aaf1bb30133677be8702a8c5f2994629f637a209 \ 90 busybox:glibc@sha256:1f81263701cddf6402afe9f33fca0266d9fff379e59b1748f33d3072da71ee85 \ 91 debian:bullseye-slim@sha256:dacf278785a4daa9de07596ec739dbc07131e189942772210709c5c0777e8437 \ 92 hello-world:latest@sha256:d58e752213a51785838f9eed2b7a498ffa1cb3aa7f946dda11af39286c3db9a9 \ 93 arm32v7/hello-world:latest@sha256:50b8560ad574c779908da71f7ce370c0a2471c098d44d1c8f6b513c5a55eeeb1 94 # See also frozenImages in "testutil/environment/protect.go" (which needs to be updated when adding images to this list) 95 96 FROM base AS cross-false 97 98 FROM --platform=linux/amd64 base AS cross-true 99 ARG DEBIAN_FRONTEND 100 RUN dpkg --add-architecture arm64 101 RUN dpkg --add-architecture armel 102 RUN dpkg --add-architecture armhf 103 RUN dpkg --add-architecture ppc64el 104 RUN dpkg --add-architecture s390x 105 RUN --mount=type=cache,sharing=locked,id=moby-cross-true-aptlib,target=/var/lib/apt \ 106 --mount=type=cache,sharing=locked,id=moby-cross-true-aptcache,target=/var/cache/apt \ 107 apt-get update && apt-get install -y --no-install-recommends \ 108 crossbuild-essential-arm64 \ 109 crossbuild-essential-armel \ 110 crossbuild-essential-armhf \ 111 crossbuild-essential-ppc64el \ 112 crossbuild-essential-s390x 113 114 FROM cross-${CROSS} AS dev-base 115 116 FROM dev-base AS runtime-dev-cross-false 117 ARG DEBIAN_FRONTEND 118 RUN --mount=type=cache,sharing=locked,id=moby-cross-false-aptlib,target=/var/lib/apt \ 119 --mount=type=cache,sharing=locked,id=moby-cross-false-aptcache,target=/var/cache/apt \ 120 apt-get update && apt-get install -y --no-install-recommends \ 121 binutils-mingw-w64 \ 122 g++-mingw-w64-x86-64 \ 123 libapparmor-dev \ 124 libbtrfs-dev \ 125 libdevmapper-dev \ 126 libseccomp-dev \ 127 libsystemd-dev \ 128 libudev-dev 129 130 FROM --platform=linux/amd64 runtime-dev-cross-false AS runtime-dev-cross-true 131 ARG DEBIAN_FRONTEND 132 # These crossbuild packages rely on gcc-<arch>, but this doesn't want to install 133 # on non-amd64 systems, so other architectures cannot crossbuild amd64. 134 RUN --mount=type=cache,sharing=locked,id=moby-cross-true-aptlib,target=/var/lib/apt \ 135 --mount=type=cache,sharing=locked,id=moby-cross-true-aptcache,target=/var/cache/apt \ 136 apt-get update && apt-get install -y --no-install-recommends \ 137 libapparmor-dev:arm64 \ 138 libapparmor-dev:armel \ 139 libapparmor-dev:armhf \ 140 libapparmor-dev:ppc64el \ 141 libapparmor-dev:s390x \ 142 libseccomp-dev:arm64 \ 143 libseccomp-dev:armel \ 144 libseccomp-dev:armhf \ 145 libseccomp-dev:ppc64el \ 146 libseccomp-dev:s390x 147 148 FROM runtime-dev-cross-${CROSS} AS runtime-dev 149 150 FROM base AS delve 151 # DELVE_VERSION specifies the version of the Delve debugger binary 152 # from the https://github.com/go-delve/delve repository. 153 # It can be used to run Docker with a possibility of 154 # attaching debugger to it. 155 # 156 ARG DELVE_VERSION=v1.8.1 157 # Delve on Linux is currently only supported on amd64 and arm64; 158 # https://github.com/go-delve/delve/blob/v1.8.1/pkg/proc/native/support_sentinel.go#L1-L6 159 RUN --mount=type=cache,target=/root/.cache/go-build \ 160 --mount=type=cache,target=/go/pkg/mod \ 161 case $(dpkg --print-architecture) in \ 162 amd64|arm64) \ 163 GOBIN=/build/ GO111MODULE=on go install "github.com/go-delve/delve/cmd/dlv@${DELVE_VERSION}" \ 164 && /build/dlv --help \ 165 ;; \ 166 *) \ 167 mkdir -p /build/ \ 168 ;; \ 169 esac 170 171 FROM base AS tomll 172 # GOTOML_VERSION specifies the version of the tomll binary to build and install 173 # from the https://github.com/pelletier/go-toml repository. This binary is used 174 # in CI in the hack/validate/toml script. 175 # 176 # When updating this version, consider updating the github.com/pelletier/go-toml 177 # dependency in vendor.mod accordingly. 178 ARG GOTOML_VERSION=v1.8.1 179 RUN --mount=type=cache,target=/root/.cache/go-build \ 180 --mount=type=cache,target=/go/pkg/mod \ 181 GOBIN=/build/ GO111MODULE=on go install "github.com/pelletier/go-toml/cmd/tomll@${GOTOML_VERSION}" \ 182 && /build/tomll --help 183 184 FROM base AS gowinres 185 # GOWINRES_VERSION defines go-winres tool version 186 ARG GOWINRES_VERSION=v0.2.3 187 RUN --mount=type=cache,target=/root/.cache/go-build \ 188 --mount=type=cache,target=/go/pkg/mod \ 189 GOBIN=/build/ GO111MODULE=on go install "github.com/tc-hib/go-winres@${GOWINRES_VERSION}" \ 190 && /build/go-winres --help 191 192 FROM dev-base AS containerd 193 ARG DEBIAN_FRONTEND 194 RUN --mount=type=cache,sharing=locked,id=moby-containerd-aptlib,target=/var/lib/apt \ 195 --mount=type=cache,sharing=locked,id=moby-containerd-aptcache,target=/var/cache/apt \ 196 apt-get update && apt-get install -y --no-install-recommends \ 197 libbtrfs-dev 198 ARG CONTAINERD_VERSION 199 COPY /hack/dockerfile/install/install.sh /hack/dockerfile/install/containerd.installer / 200 RUN --mount=type=cache,target=/root/.cache/go-build \ 201 --mount=type=cache,target=/go/pkg/mod \ 202 PREFIX=/build /install.sh containerd 203 204 FROM base AS golangci_lint 205 # FIXME: when updating golangci-lint, remove the temporary "nolint" in https://github.com/moby/moby/blob/7860686a8df15eea9def9e6189c6f9eca031bb6f/libnetwork/networkdb/cluster.go#L246 206 ARG GOLANGCI_LINT_VERSION=v1.49.0 207 RUN --mount=type=cache,target=/root/.cache/go-build \ 208 --mount=type=cache,target=/go/pkg/mod \ 209 GOBIN=/build/ GO111MODULE=on go install "github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}" \ 210 && /build/golangci-lint --version 211 212 FROM base AS gotestsum 213 ARG GOTESTSUM_VERSION=v1.8.1 214 RUN --mount=type=cache,target=/root/.cache/go-build \ 215 --mount=type=cache,target=/go/pkg/mod \ 216 GOBIN=/build/ GO111MODULE=on go install "gotest.tools/gotestsum@${GOTESTSUM_VERSION}" \ 217 && /build/gotestsum --version 218 219 FROM base AS shfmt 220 ARG SHFMT_VERSION=v3.0.2 221 RUN --mount=type=cache,target=/root/.cache/go-build \ 222 --mount=type=cache,target=/go/pkg/mod \ 223 GOBIN=/build/ GO111MODULE=on go install "mvdan.cc/sh/v3/cmd/shfmt@${SHFMT_VERSION}" \ 224 && /build/shfmt --version 225 226 FROM dev-base AS dockercli 227 ARG DOCKERCLI_CHANNEL 228 ARG DOCKERCLI_VERSION 229 COPY /hack/dockerfile/install/install.sh /hack/dockerfile/install/dockercli.installer / 230 RUN --mount=type=cache,target=/root/.cache/go-build \ 231 --mount=type=cache,target=/go/pkg/mod \ 232 PREFIX=/build /install.sh dockercli 233 234 FROM runtime-dev AS runc 235 ARG RUNC_VERSION 236 ARG RUNC_BUILDTAGS 237 COPY /hack/dockerfile/install/install.sh /hack/dockerfile/install/runc.installer / 238 RUN --mount=type=cache,target=/root/.cache/go-build \ 239 --mount=type=cache,target=/go/pkg/mod \ 240 PREFIX=/build /install.sh runc 241 242 FROM dev-base AS tini 243 ARG DEBIAN_FRONTEND 244 ARG TINI_VERSION 245 RUN --mount=type=cache,sharing=locked,id=moby-tini-aptlib,target=/var/lib/apt \ 246 --mount=type=cache,sharing=locked,id=moby-tini-aptcache,target=/var/cache/apt \ 247 apt-get update && apt-get install -y --no-install-recommends \ 248 cmake \ 249 vim-common 250 COPY /hack/dockerfile/install/install.sh /hack/dockerfile/install/tini.installer / 251 RUN --mount=type=cache,target=/root/.cache/go-build \ 252 --mount=type=cache,target=/go/pkg/mod \ 253 PREFIX=/build /install.sh tini 254 255 FROM dev-base AS rootlesskit 256 ARG ROOTLESSKIT_VERSION 257 ARG PREFIX=/build 258 COPY /hack/dockerfile/install/install.sh /hack/dockerfile/install/rootlesskit.installer / 259 RUN --mount=type=cache,target=/root/.cache/go-build \ 260 --mount=type=cache,target=/go/pkg/mod \ 261 /install.sh rootlesskit \ 262 && "${PREFIX}"/rootlesskit --version \ 263 && "${PREFIX}"/rootlesskit-docker-proxy --help 264 COPY ./contrib/dockerd-rootless.sh /build 265 COPY ./contrib/dockerd-rootless-setuptool.sh /build 266 267 FROM base AS crun 268 ARG CRUN_VERSION=1.4.5 269 RUN --mount=type=cache,sharing=locked,id=moby-crun-aptlib,target=/var/lib/apt \ 270 --mount=type=cache,sharing=locked,id=moby-crun-aptcache,target=/var/cache/apt \ 271 apt-get update && apt-get install -y --no-install-recommends \ 272 autoconf \ 273 automake \ 274 build-essential \ 275 libcap-dev \ 276 libprotobuf-c-dev \ 277 libseccomp-dev \ 278 libsystemd-dev \ 279 libtool \ 280 libudev-dev \ 281 libyajl-dev \ 282 python3 \ 283 ; 284 RUN --mount=type=tmpfs,target=/tmp/crun-build \ 285 git clone https://github.com/containers/crun.git /tmp/crun-build && \ 286 cd /tmp/crun-build && \ 287 git checkout -q "${CRUN_VERSION}" && \ 288 ./autogen.sh && \ 289 ./configure --bindir=/build && \ 290 make -j install 291 292 FROM --platform=amd64 djs55/vpnkit:${VPNKIT_VERSION} AS vpnkit-amd64 293 294 FROM --platform=arm64 djs55/vpnkit:${VPNKIT_VERSION} AS vpnkit-arm64 295 296 FROM scratch AS vpnkit 297 COPY --from=vpnkit-amd64 /vpnkit /build/vpnkit.x86_64 298 COPY --from=vpnkit-arm64 /vpnkit /build/vpnkit.aarch64 299 300 # TODO: Some of this is only really needed for testing, it would be nice to split this up 301 FROM runtime-dev AS dev-systemd-false 302 ARG DEBIAN_FRONTEND 303 RUN groupadd -r docker 304 RUN useradd --create-home --gid docker unprivilegeduser \ 305 && mkdir -p /home/unprivilegeduser/.local/share/docker \ 306 && chown -R unprivilegeduser /home/unprivilegeduser 307 # Let us use a .bashrc file 308 RUN ln -sfv /go/src/github.com/docker/docker/.bashrc ~/.bashrc 309 # Activate bash completion and include Docker's completion if mounted with DOCKER_BASH_COMPLETION_PATH 310 RUN echo "source /usr/share/bash-completion/bash_completion" >> /etc/bash.bashrc 311 RUN ln -s /usr/local/completion/bash/docker /etc/bash_completion.d/docker 312 RUN ldconfig 313 # This should only install packages that are specifically needed for the dev environment and nothing else 314 # Do you really need to add another package here? Can it be done in a different build stage? 315 RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \ 316 --mount=type=cache,sharing=locked,id=moby-dev-aptcache,target=/var/cache/apt \ 317 apt-get update && apt-get install -y --no-install-recommends \ 318 apparmor \ 319 bash-completion \ 320 bzip2 \ 321 inetutils-ping \ 322 iproute2 \ 323 iptables \ 324 jq \ 325 libcap2-bin \ 326 libnet1 \ 327 libnl-3-200 \ 328 libprotobuf-c1 \ 329 libyajl2 \ 330 net-tools \ 331 patch \ 332 pigz \ 333 python3-pip \ 334 python3-setuptools \ 335 python3-wheel \ 336 sudo \ 337 systemd-journal-remote \ 338 thin-provisioning-tools \ 339 uidmap \ 340 vim \ 341 vim-common \ 342 xfsprogs \ 343 xz-utils \ 344 zip \ 345 zstd 346 347 348 # Switch to use iptables instead of nftables (to match the CI hosts) 349 # TODO use some kind of runtime auto-detection instead if/when nftables is supported (https://github.com/moby/moby/issues/26824) 350 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy || true \ 351 && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true \ 352 && update-alternatives --set arptables /usr/sbin/arptables-legacy || true 353 354 ARG YAMLLINT_VERSION=1.27.1 355 RUN pip3 install yamllint==${YAMLLINT_VERSION} 356 357 COPY --from=dockercli /build/ /usr/local/cli 358 COPY --from=frozen-images /build/ /docker-frozen-images 359 COPY --from=swagger /build/ /usr/local/bin/ 360 COPY --from=delve /build/ /usr/local/bin/ 361 COPY --from=tomll /build/ /usr/local/bin/ 362 COPY --from=gowinres /build/ /usr/local/bin/ 363 COPY --from=tini /build/ /usr/local/bin/ 364 COPY --from=registry /build/ /usr/local/bin/ 365 COPY --from=criu /build/ /usr/local/bin/ 366 COPY --from=gotestsum /build/ /usr/local/bin/ 367 COPY --from=golangci_lint /build/ /usr/local/bin/ 368 COPY --from=shfmt /build/ /usr/local/bin/ 369 COPY --from=runc /build/ /usr/local/bin/ 370 COPY --from=containerd /build/ /usr/local/bin/ 371 COPY --from=rootlesskit /build/ /usr/local/bin/ 372 COPY --from=vpnkit /build/ /usr/local/bin/ 373 COPY --from=crun /build/ /usr/local/bin/ 374 COPY hack/dockerfile/etc/docker/ /etc/docker/ 375 ENV PATH=/usr/local/cli:$PATH 376 ARG DOCKER_BUILDTAGS 377 ENV DOCKER_BUILDTAGS="${DOCKER_BUILDTAGS}" 378 WORKDIR /go/src/github.com/docker/docker 379 VOLUME /var/lib/docker 380 VOLUME /home/unprivilegeduser/.local/share/docker 381 # Wrap all commands in the "docker-in-docker" script to allow nested containers 382 ENTRYPOINT ["hack/dind"] 383 384 FROM dev-systemd-false AS dev-systemd-true 385 RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \ 386 --mount=type=cache,sharing=locked,id=moby-dev-aptcache,target=/var/cache/apt \ 387 apt-get update && apt-get install -y --no-install-recommends \ 388 dbus \ 389 dbus-user-session \ 390 systemd \ 391 systemd-sysv 392 ENTRYPOINT ["hack/dind-systemd"] 393 394 FROM dev-systemd-${SYSTEMD} AS dev 395 396 FROM runtime-dev AS binary-base 397 ARG DOCKER_GITCOMMIT=HEAD 398 ENV DOCKER_GITCOMMIT=${DOCKER_GITCOMMIT} 399 ARG VERSION 400 ENV VERSION=${VERSION} 401 ARG PLATFORM 402 ENV PLATFORM=${PLATFORM} 403 ARG PRODUCT 404 ENV PRODUCT=${PRODUCT} 405 ARG DEFAULT_PRODUCT_LICENSE 406 ENV DEFAULT_PRODUCT_LICENSE=${DEFAULT_PRODUCT_LICENSE} 407 ARG PACKAGER_NAME 408 ENV PACKAGER_NAME=${PACKAGER_NAME} 409 ARG DOCKER_BUILDTAGS 410 ENV DOCKER_BUILDTAGS="${DOCKER_BUILDTAGS}" 411 ENV PREFIX=/build 412 # TODO: This is here because hack/make.sh binary copies these extras binaries 413 # from $PATH into the bundles dir. 414 # It would be nice to handle this in a different way. 415 COPY --from=tini /build/ /usr/local/bin/ 416 COPY --from=runc /build/ /usr/local/bin/ 417 COPY --from=containerd /build/ /usr/local/bin/ 418 COPY --from=rootlesskit /build/ /usr/local/bin/ 419 COPY --from=vpnkit /build/ /usr/local/bin/ 420 COPY --from=gowinres /build/ /usr/local/bin/ 421 WORKDIR /go/src/github.com/docker/docker 422 423 FROM binary-base AS build-binary 424 RUN --mount=type=cache,target=/root/.cache \ 425 --mount=type=bind,target=.,ro \ 426 --mount=type=tmpfs,target=cli/winresources/dockerd \ 427 --mount=type=tmpfs,target=cli/winresources/docker-proxy \ 428 hack/make.sh binary 429 430 FROM binary-base AS build-dynbinary 431 RUN --mount=type=cache,target=/root/.cache \ 432 --mount=type=bind,target=.,ro \ 433 --mount=type=tmpfs,target=cli/winresources/dockerd \ 434 --mount=type=tmpfs,target=cli/winresources/docker-proxy \ 435 hack/make.sh dynbinary 436 437 FROM binary-base AS build-cross 438 ARG DOCKER_CROSSPLATFORMS 439 RUN --mount=type=cache,target=/root/.cache \ 440 --mount=type=bind,target=.,ro \ 441 --mount=type=tmpfs,target=cli/winresources/dockerd \ 442 --mount=type=tmpfs,target=cli/winresources/docker-proxy \ 443 hack/make.sh cross 444 445 FROM scratch AS binary 446 COPY --from=build-binary /build/bundles/ / 447 448 FROM scratch AS dynbinary 449 COPY --from=build-dynbinary /build/bundles/ / 450 451 FROM scratch AS cross 452 COPY --from=build-cross /build/bundles/ / 453 454 FROM dev AS final 455 COPY . /go/src/github.com/docker/docker