github.com/kaisenlinux/docker@v0.0.0-20230510090727-ea55db55fac7/engine/Dockerfile (about) 1 # syntax=docker/dockerfile:1 2 3 ARG CROSS="false" 4 ARG SYSTEMD="false" 5 # IMPORTANT: When updating this please note that stdlib archive/tar pkg is vendored 6 ARG GO_VERSION=1.19.7 7 ARG DEBIAN_FRONTEND=noninteractive 8 ARG VPNKIT_VERSION=0.5.0 9 ARG DOCKER_BUILDTAGS="apparmor seccomp" 10 11 ARG BASE_DEBIAN_DISTRO="bullseye" 12 ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" 13 14 FROM ${GOLANG_IMAGE} AS base 15 RUN echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache 16 ARG APT_MIRROR 17 RUN sed -ri "s/(httpredir|deb).debian.org/${APT_MIRROR:-deb.debian.org}/g" /etc/apt/sources.list \ 18 && sed -ri "s/(security).debian.org/${APT_MIRROR:-security.debian.org}/g" /etc/apt/sources.list 19 ENV GO111MODULE=off 20 21 FROM base AS criu 22 ARG DEBIAN_FRONTEND 23 # Install dependency packages specific to criu 24 RUN --mount=type=cache,sharing=locked,id=moby-criu-aptlib,target=/var/lib/apt \ 25 --mount=type=cache,sharing=locked,id=moby-criu-aptcache,target=/var/cache/apt \ 26 apt-get update && apt-get install -y --no-install-recommends \ 27 libcap-dev \ 28 libnet-dev \ 29 libnl-3-dev \ 30 libprotobuf-c-dev \ 31 libprotobuf-dev \ 32 protobuf-c-compiler \ 33 protobuf-compiler \ 34 python3-protobuf 35 36 # Install CRIU for checkpoint/restore support 37 ARG CRIU_VERSION=3.14 38 RUN mkdir -p /usr/src/criu \ 39 && curl -sSL https://github.com/checkpoint-restore/criu/archive/v${CRIU_VERSION}.tar.gz | tar -C /usr/src/criu/ -xz --strip-components=1 \ 40 && cd /usr/src/criu \ 41 && make \ 42 && make PREFIX=/build/ install-criu 43 44 FROM base AS registry 45 WORKDIR /go/src/github.com/docker/distribution 46 # Install two versions of the registry. The first one is a recent version that 47 # supports both schema 1 and 2 manifests. The second one is an older version that 48 # only supports schema1 manifests. This allows integration-cli tests to cover 49 # push/pull with both schema1 and schema2 manifests. 50 # The old version of the registry is not working on arm64, so installation is 51 # skipped on that architecture. 52 ENV REGISTRY_COMMIT_SCHEMA1 ec87e9b6971d831f0eff752ddb54fb64693e51cd 53 ENV REGISTRY_COMMIT 47a064d4195a9b56133891bbb13620c3ac83a827 54 RUN --mount=type=cache,target=/root/.cache/go-build \ 55 --mount=type=cache,target=/go/pkg/mod \ 56 --mount=type=tmpfs,target=/go/src/ \ 57 set -x \ 58 && git clone https://github.com/docker/distribution.git . \ 59 && git checkout -q "$REGISTRY_COMMIT" \ 60 && GOPATH="/go/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \ 61 go build -buildmode=pie -o /build/registry-v2 github.com/docker/distribution/cmd/registry \ 62 && case $(dpkg --print-architecture) in \ 63 amd64|armhf|ppc64*|s390x) \ 64 git checkout -q "$REGISTRY_COMMIT_SCHEMA1"; \ 65 GOPATH="/go/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH"; \ 66 go build -buildmode=pie -o /build/registry-v2-schema1 github.com/docker/distribution/cmd/registry; \ 67 ;; \ 68 esac 69 70 FROM base AS swagger 71 WORKDIR $GOPATH/src/github.com/go-swagger/go-swagger 72 # Install go-swagger for validating swagger.yaml 73 # This is https://github.com/kolyshkin/go-swagger/tree/golang-1.13-fix 74 # TODO: move to under moby/ or fix upstream go-swagger to work for us. 75 ENV GO_SWAGGER_COMMIT c56166c036004ba7a3a321e5951ba472b9ae298c 76 RUN --mount=type=cache,target=/root/.cache/go-build \ 77 --mount=type=cache,target=/go/pkg/mod \ 78 --mount=type=tmpfs,target=/go/src/ \ 79 set -x \ 80 && git clone https://github.com/kolyshkin/go-swagger.git . \ 81 && git checkout -q "$GO_SWAGGER_COMMIT" \ 82 && go build -o /build/swagger github.com/go-swagger/go-swagger/cmd/swagger 83 84 FROM debian:${BASE_DEBIAN_DISTRO} AS frozen-images 85 ARG DEBIAN_FRONTEND 86 RUN --mount=type=cache,sharing=locked,id=moby-frozen-images-aptlib,target=/var/lib/apt \ 87 --mount=type=cache,sharing=locked,id=moby-frozen-images-aptcache,target=/var/cache/apt \ 88 apt-get update && apt-get install -y --no-install-recommends \ 89 ca-certificates \ 90 curl \ 91 jq 92 # Get useful and necessary Hub images so we can "docker load" locally instead of pulling 93 COPY contrib/download-frozen-image-v2.sh / 94 ARG TARGETARCH 95 RUN /download-frozen-image-v2.sh /build \ 96 busybox:latest@sha256:95cf004f559831017cdf4628aaf1bb30133677be8702a8c5f2994629f637a209 \ 97 busybox:glibc@sha256:1f81263701cddf6402afe9f33fca0266d9fff379e59b1748f33d3072da71ee85 \ 98 debian:bullseye-slim@sha256:dacf278785a4daa9de07596ec739dbc07131e189942772210709c5c0777e8437 \ 99 hello-world:latest@sha256:d58e752213a51785838f9eed2b7a498ffa1cb3aa7f946dda11af39286c3db9a9 \ 100 arm32v7/hello-world:latest@sha256:50b8560ad574c779908da71f7ce370c0a2471c098d44d1c8f6b513c5a55eeeb1 101 # See also frozenImages in "testutil/environment/protect.go" (which needs to be updated when adding images to this list) 102 103 FROM base AS cross-false 104 105 FROM --platform=linux/amd64 base AS cross-true 106 ARG DEBIAN_FRONTEND 107 RUN dpkg --add-architecture arm64 108 RUN dpkg --add-architecture armel 109 RUN dpkg --add-architecture armhf 110 RUN dpkg --add-architecture ppc64el 111 RUN dpkg --add-architecture s390x 112 RUN --mount=type=cache,sharing=locked,id=moby-cross-true-aptlib,target=/var/lib/apt \ 113 --mount=type=cache,sharing=locked,id=moby-cross-true-aptcache,target=/var/cache/apt \ 114 apt-get update && apt-get install -y --no-install-recommends \ 115 crossbuild-essential-arm64 \ 116 crossbuild-essential-armel \ 117 crossbuild-essential-armhf \ 118 crossbuild-essential-ppc64el \ 119 crossbuild-essential-s390x 120 121 FROM cross-${CROSS} as dev-base 122 123 FROM dev-base AS runtime-dev-cross-false 124 ARG DEBIAN_FRONTEND 125 RUN --mount=type=cache,sharing=locked,id=moby-cross-false-aptlib,target=/var/lib/apt \ 126 --mount=type=cache,sharing=locked,id=moby-cross-false-aptcache,target=/var/cache/apt \ 127 apt-get update && apt-get install -y --no-install-recommends \ 128 binutils-mingw-w64 \ 129 g++-mingw-w64-x86-64 \ 130 libapparmor-dev \ 131 libbtrfs-dev \ 132 libdevmapper-dev \ 133 libseccomp-dev \ 134 libsystemd-dev \ 135 libudev-dev 136 137 FROM --platform=linux/amd64 runtime-dev-cross-false AS runtime-dev-cross-true 138 ARG DEBIAN_FRONTEND 139 # These crossbuild packages rely on gcc-<arch>, but this doesn't want to install 140 # on non-amd64 systems, so other architectures cannot crossbuild amd64. 141 RUN --mount=type=cache,sharing=locked,id=moby-cross-true-aptlib,target=/var/lib/apt \ 142 --mount=type=cache,sharing=locked,id=moby-cross-true-aptcache,target=/var/cache/apt \ 143 apt-get update && apt-get install -y --no-install-recommends \ 144 libapparmor-dev:arm64 \ 145 libapparmor-dev:armel \ 146 libapparmor-dev:armhf \ 147 libapparmor-dev:ppc64el \ 148 libapparmor-dev:s390x \ 149 libseccomp-dev:arm64 \ 150 libseccomp-dev:armel \ 151 libseccomp-dev:armhf \ 152 libseccomp-dev:ppc64el \ 153 libseccomp-dev:s390x 154 155 FROM runtime-dev-cross-${CROSS} AS runtime-dev 156 157 FROM base AS tomlv 158 ARG TOMLV_COMMIT 159 RUN --mount=type=cache,target=/root/.cache/go-build \ 160 --mount=type=cache,target=/go/pkg/mod \ 161 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 162 PREFIX=/build /tmp/install/install.sh tomlv 163 164 FROM base AS vndr 165 ARG VNDR_VERSION 166 RUN --mount=type=cache,target=/root/.cache/go-build \ 167 --mount=type=cache,target=/go/pkg/mod \ 168 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 169 PREFIX=/build /tmp/install/install.sh vndr 170 171 FROM dev-base AS containerd 172 ARG DEBIAN_FRONTEND 173 RUN --mount=type=cache,sharing=locked,id=moby-containerd-aptlib,target=/var/lib/apt \ 174 --mount=type=cache,sharing=locked,id=moby-containerd-aptcache,target=/var/cache/apt \ 175 apt-get update && apt-get install -y --no-install-recommends \ 176 libbtrfs-dev 177 ARG CONTAINERD_VERSION 178 RUN --mount=type=cache,target=/root/.cache/go-build \ 179 --mount=type=cache,target=/go/pkg/mod \ 180 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 181 PREFIX=/build /tmp/install/install.sh containerd 182 183 FROM dev-base AS proxy 184 ARG LIBNETWORK_COMMIT 185 RUN --mount=type=cache,target=/root/.cache/go-build \ 186 --mount=type=cache,target=/go/pkg/mod \ 187 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 188 PREFIX=/build /tmp/install/install.sh proxy 189 190 FROM base AS golangci_lint 191 ARG GOLANGCI_LINT_VERSION 192 RUN --mount=type=cache,target=/root/.cache/go-build \ 193 --mount=type=cache,target=/go/pkg/mod \ 194 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 195 PREFIX=/build /tmp/install/install.sh golangci_lint 196 197 FROM base AS gotestsum 198 ARG GOTESTSUM_VERSION 199 RUN --mount=type=cache,target=/root/.cache/go-build \ 200 --mount=type=cache,target=/go/pkg/mod \ 201 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 202 PREFIX=/build /tmp/install/install.sh gotestsum 203 204 FROM base AS shfmt 205 ARG SHFMT_VERSION 206 RUN --mount=type=cache,target=/root/.cache/go-build \ 207 --mount=type=cache,target=/go/pkg/mod \ 208 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 209 PREFIX=/build /tmp/install/install.sh shfmt 210 211 FROM dev-base AS dockercli 212 ARG DOCKERCLI_CHANNEL 213 ARG DOCKERCLI_VERSION 214 RUN --mount=type=cache,target=/root/.cache/go-build \ 215 --mount=type=cache,target=/go/pkg/mod \ 216 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 217 PREFIX=/build /tmp/install/install.sh dockercli 218 219 FROM runtime-dev AS runc 220 ARG RUNC_VERSION 221 ARG RUNC_BUILDTAGS 222 RUN --mount=type=cache,target=/root/.cache/go-build \ 223 --mount=type=cache,target=/go/pkg/mod \ 224 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 225 PREFIX=/build /tmp/install/install.sh runc 226 227 FROM dev-base AS tini 228 ARG DEBIAN_FRONTEND 229 ARG TINI_VERSION 230 RUN --mount=type=cache,sharing=locked,id=moby-tini-aptlib,target=/var/lib/apt \ 231 --mount=type=cache,sharing=locked,id=moby-tini-aptcache,target=/var/cache/apt \ 232 apt-get update && apt-get install -y --no-install-recommends \ 233 cmake \ 234 vim-common 235 RUN --mount=type=cache,target=/root/.cache/go-build \ 236 --mount=type=cache,target=/go/pkg/mod \ 237 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 238 PREFIX=/build /tmp/install/install.sh tini 239 240 FROM dev-base AS rootlesskit 241 ARG ROOTLESSKIT_VERSION 242 RUN --mount=type=cache,target=/root/.cache/go-build \ 243 --mount=type=cache,target=/go/pkg/mod \ 244 --mount=type=bind,src=hack/dockerfile/install,target=/tmp/install \ 245 PREFIX=/build /tmp/install/install.sh rootlesskit 246 COPY ./contrib/dockerd-rootless.sh /build 247 COPY ./contrib/dockerd-rootless-setuptool.sh /build 248 249 FROM --platform=amd64 djs55/vpnkit:${VPNKIT_VERSION} AS vpnkit-amd64 250 251 FROM --platform=arm64 djs55/vpnkit:${VPNKIT_VERSION} AS vpnkit-arm64 252 253 FROM scratch AS vpnkit 254 COPY --from=vpnkit-amd64 /vpnkit /build/vpnkit.x86_64 255 COPY --from=vpnkit-arm64 /vpnkit /build/vpnkit.aarch64 256 257 # TODO: Some of this is only really needed for testing, it would be nice to split this up 258 FROM runtime-dev AS dev-systemd-false 259 ARG DEBIAN_FRONTEND 260 RUN groupadd -r docker 261 RUN useradd --create-home --gid docker unprivilegeduser \ 262 && mkdir -p /home/unprivilegeduser/.local/share/docker \ 263 && chown -R unprivilegeduser /home/unprivilegeduser 264 # Let us use a .bashrc file 265 RUN ln -sfv /go/src/github.com/docker/docker/.bashrc ~/.bashrc 266 # Activate bash completion and include Docker's completion if mounted with DOCKER_BASH_COMPLETION_PATH 267 RUN echo "source /usr/share/bash-completion/bash_completion" >> /etc/bash.bashrc 268 RUN ln -s /usr/local/completion/bash/docker /etc/bash_completion.d/docker 269 RUN ldconfig 270 # Set dev environment as safe git directory to prevent "dubious ownership" errors 271 # when bind-mounting the source into the dev-container. See https://github.com/moby/moby/pull/44930 272 RUN git config --global --add safe.directory $GOPATH/src/github.com/docker/docker 273 # This should only install packages that are specifically needed for the dev environment and nothing else 274 # Do you really need to add another package here? Can it be done in a different build stage? 275 RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \ 276 --mount=type=cache,sharing=locked,id=moby-dev-aptcache,target=/var/cache/apt \ 277 apt-get update && apt-get install -y --no-install-recommends \ 278 apparmor \ 279 bash-completion \ 280 bzip2 \ 281 inetutils-ping \ 282 iproute2 \ 283 iptables \ 284 jq \ 285 libcap2-bin \ 286 libnet1 \ 287 libnl-3-200 \ 288 libprotobuf-c1 \ 289 net-tools \ 290 patch \ 291 pigz \ 292 python3-pip \ 293 python3-setuptools \ 294 python3-wheel \ 295 sudo \ 296 thin-provisioning-tools \ 297 uidmap \ 298 vim \ 299 vim-common \ 300 xfsprogs \ 301 xz-utils \ 302 zip 303 304 305 # Switch to use iptables instead of nftables (to match the CI hosts) 306 # TODO use some kind of runtime auto-detection instead if/when nftables is supported (https://github.com/moby/moby/issues/26824) 307 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy || true \ 308 && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true \ 309 && update-alternatives --set arptables /usr/sbin/arptables-legacy || true 310 311 RUN pip3 install yamllint==1.26.1 312 313 COPY --from=dockercli /build/ /usr/local/cli 314 COPY --from=frozen-images /build/ /docker-frozen-images 315 COPY --from=swagger /build/ /usr/local/bin/ 316 COPY --from=tomlv /build/ /usr/local/bin/ 317 COPY --from=tini /build/ /usr/local/bin/ 318 COPY --from=registry /build/ /usr/local/bin/ 319 COPY --from=criu /build/ /usr/local/ 320 COPY --from=vndr /build/ /usr/local/bin/ 321 COPY --from=gotestsum /build/ /usr/local/bin/ 322 COPY --from=golangci_lint /build/ /usr/local/bin/ 323 COPY --from=shfmt /build/ /usr/local/bin/ 324 COPY --from=runc /build/ /usr/local/bin/ 325 COPY --from=containerd /build/ /usr/local/bin/ 326 COPY --from=rootlesskit /build/ /usr/local/bin/ 327 COPY --from=vpnkit /build/ /usr/local/bin/ 328 COPY --from=proxy /build/ /usr/local/bin/ 329 ENV PATH=/usr/local/cli:$PATH 330 ARG DOCKER_BUILDTAGS 331 ENV DOCKER_BUILDTAGS="${DOCKER_BUILDTAGS}" 332 WORKDIR /go/src/github.com/docker/docker 333 VOLUME /var/lib/docker 334 VOLUME /home/unprivilegeduser/.local/share/docker 335 # Wrap all commands in the "docker-in-docker" script to allow nested containers 336 ENTRYPOINT ["hack/dind"] 337 338 FROM dev-systemd-false AS dev-systemd-true 339 RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \ 340 --mount=type=cache,sharing=locked,id=moby-dev-aptcache,target=/var/cache/apt \ 341 apt-get update && apt-get install -y --no-install-recommends \ 342 dbus \ 343 dbus-user-session \ 344 systemd \ 345 systemd-sysv 346 RUN mkdir -p hack \ 347 && curl -o hack/dind-systemd https://raw.githubusercontent.com/AkihiroSuda/containerized-systemd/b70bac0daeea120456764248164c21684ade7d0d/docker-entrypoint.sh \ 348 && chmod +x hack/dind-systemd 349 ENTRYPOINT ["hack/dind-systemd"] 350 351 FROM dev-systemd-${SYSTEMD} AS dev 352 353 FROM runtime-dev AS binary-base 354 ARG DOCKER_GITCOMMIT=HEAD 355 ENV DOCKER_GITCOMMIT=${DOCKER_GITCOMMIT} 356 ARG VERSION 357 ENV VERSION=${VERSION} 358 ARG PLATFORM 359 ENV PLATFORM=${PLATFORM} 360 ARG PRODUCT 361 ENV PRODUCT=${PRODUCT} 362 ARG DEFAULT_PRODUCT_LICENSE 363 ENV DEFAULT_PRODUCT_LICENSE=${DEFAULT_PRODUCT_LICENSE} 364 ARG DOCKER_BUILDTAGS 365 ENV DOCKER_BUILDTAGS="${DOCKER_BUILDTAGS}" 366 ENV PREFIX=/build 367 # TODO: This is here because hack/make.sh binary copies these extras binaries 368 # from $PATH into the bundles dir. 369 # It would be nice to handle this in a different way. 370 COPY --from=tini /build/ /usr/local/bin/ 371 COPY --from=runc /build/ /usr/local/bin/ 372 COPY --from=containerd /build/ /usr/local/bin/ 373 COPY --from=rootlesskit /build/ /usr/local/bin/ 374 COPY --from=proxy /build/ /usr/local/bin/ 375 COPY --from=vpnkit /build/ /usr/local/bin/ 376 WORKDIR /go/src/github.com/docker/docker 377 378 FROM binary-base AS build-binary 379 RUN --mount=type=cache,target=/root/.cache/go-build \ 380 --mount=type=bind,target=/go/src/github.com/docker/docker \ 381 hack/make.sh binary 382 383 FROM binary-base AS build-dynbinary 384 RUN --mount=type=cache,target=/root/.cache/go-build \ 385 --mount=type=bind,target=/go/src/github.com/docker/docker \ 386 hack/make.sh dynbinary 387 388 FROM binary-base AS build-cross 389 ARG DOCKER_CROSSPLATFORMS 390 RUN --mount=type=cache,target=/root/.cache/go-build \ 391 --mount=type=bind,target=/go/src/github.com/docker/docker \ 392 --mount=type=tmpfs,target=/go/src/github.com/docker/docker/autogen \ 393 hack/make.sh cross 394 395 FROM scratch AS binary 396 COPY --from=build-binary /build/bundles/ / 397 398 FROM scratch AS dynbinary 399 COPY --from=build-dynbinary /build/bundles/ / 400 401 FROM scratch AS cross 402 COPY --from=build-cross /build/bundles/ / 403 404 FROM dev AS final 405 COPY . /go/src/github.com/docker/docker