gvisor.dev/gvisor@v0.0.0-20240520182842-f9d4d51c7e0f/Makefile (about)

     1  #!/usr/bin/make -f
     2  
     3  # Copyright 2019 The gVisor Authors.
     4  #
     5  # Licensed under the Apache License, Version 2.0 (the "License");
     6  # you may not use this file except in compliance with the License.
     7  # You may obtain a copy of the License at
     8  #
     9  #     http://www.apache.org/licenses/LICENSE-2.0
    10  #
    11  # Unless required by applicable law or agreed to in writing, software
    12  # distributed under the License is distributed on an "AS IS" BASIS,
    13  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    14  # See the License for the specific language governing permissions and
    15  # limitations under the License.
    16  
    17  default: runsc
    18  .PHONY: default
    19  
    20  # Header for debugging (used by other macros).
    21  header = echo --- $(1) >&2
    22  
    23  # Make hacks.
    24  EMPTY :=
    25  SPACE := $(EMPTY) $(EMPTY)
    26  SHELL = /bin/bash
    27  COMMA := ,
    28  
    29  ## usage: make <target>
    30  ##         or
    31  ##        make <build|test|copy|run|sudo> STARTUP_OPTIONS="..." OPTIONS="..." TARGETS="..." ARGS="..."
    32  ##
    33  ## Basic targets.
    34  ##
    35  ##   This Makefile wraps basic build and test targets for ease-of-use. Bazel
    36  ##   is run inside a canonical Docker container in order to simplify up-front
    37  ##   requirements.
    38  ##
    39  ##   There are common arguments that may be passed to targets. These are:
    40  ##     OPTIONS - Build or test options.
    41  ##     TARGETS - The bazel targets.
    42  ##     ARGS    - Arguments for run or sudo.
    43  ##
    44  ##   Additionally, the copy target expects a DESTINATION to be provided.
    45  ##
    46  ##   For example, to build runsc using this Makefile, you can run:
    47  ##     make build OPTIONS="" TARGETS="//runsc"'
    48  ##
    49  help: ## Shows all targets and help from the Makefile (this message).
    50  	@grep --no-filename -E '^([a-z.A-Z_%-]+:.*?|)##' $(MAKEFILE_LIST) | \
    51  		awk 'BEGIN {FS = "(:.*?|)## ?"}; { \
    52  			if (length($$1) > 0) { \
    53  				printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2; \
    54  			} else { \
    55  				printf "%s\n", $$2; \
    56  			} \
    57  		}'
    58  
    59  build: ## Builds the given $(TARGETS) with the given $(OPTIONS). E.g. make build TARGETS=runsc
    60  	@$(call build,$(OPTIONS) $(TARGETS))
    61  .PHONY: build
    62  
    63  test: ## Tests the given $(TARGETS) with the given $(OPTIONS). E.g. make test TARGETS=pkg/buffer:buffer_test
    64  	@$(call test,$(OPTIONS) $(TARGETS))
    65  .PHONY: test
    66  
    67  copy: ## Copies the given $(TARGETS) to the given $(DESTINATION). E.g. make copy TARGETS=runsc DESTINATION=/tmp
    68  	@$(call copy,$(TARGETS),$(DESTINATION))
    69  .PHONY: copy
    70  
    71  run: ## Runs the given $(TARGETS), built with $(OPTIONS), using $(ARGS). E.g. make run TARGETS=runsc ARGS=-version
    72  	@$(call run,$(TARGETS),$(ARGS))
    73  .PHONY: run
    74  
    75  sudo: ## Runs the given $(TARGETS) as per run, but using "sudo -E". E.g. make sudo TARGETS=test/root:root_test ARGS=-test.v
    76  	@$(call sudo,$(TARGETS),$(ARGS))
    77  .PHONY: sudo
    78  
    79  # Load image helpers.
    80  include tools/images.mk
    81  
    82  # Load all bazel wrappers.
    83  #
    84  # This file should define the basic "build", "test", "run" and "sudo" rules, in
    85  # addition to the $(BRANCH_NAME) and $(BUILD_ROOTS) variables.
    86  ifneq (,$(wildcard tools/google.mk))
    87  include tools/google.mk
    88  else
    89  include tools/bazel.mk
    90  endif
    91  
    92  ##
    93  ## Development helpers and tooling.
    94  ##
    95  ##   These targets faciliate local development by automatically
    96  ##   installing and configuring a runtime. Several variables may
    97  ##   be used here to tweak the installation:
    98  ##     RUNTIME         - The name of the installed runtime (default: $BRANCH_NAME).
    99  ##     RUNTIME_DIR     - Where the runtime will be installed (default: temporary directory with the $RUNTIME).
   100  ##     RUNTIME_BIN     - The runtime binary (default: $RUNTIME_DIR/runsc).
   101  ##     RUNTIME_LOG_DIR - The logs directory (default: $RUNTIME_DIR/logs).
   102  ##     RUNTIME_LOGS    - The log pattern (default: $RUNTIME_LOG_DIR/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%).
   103  ##     RUNTIME_ARGS    - Arguments passed to the runtime when installed.
   104  ##     STAGED_BINARIES - A tarball of staged binaries. If this is set, then binaries
   105  ##                       will be installed from this staged bundle instead of built.
   106  ##     DOCKER_RELOAD_COMMAND - The command to run to reload Docker. (default: sudo systemctl reload docker).
   107  
   108  ifeq (,$(BRANCH_NAME))
   109  RUNTIME     ?= runsc
   110  else
   111  RUNTIME     ?= $(BRANCH_NAME)
   112  endif
   113  RUNTIME_DIR     ?= $(shell dirname $(shell mktemp -u))/$(RUNTIME)
   114  RUNTIME_BIN     ?= $(RUNTIME_DIR)/runsc
   115  RUNTIME_LOG_DIR ?= $(RUNTIME_DIR)/logs
   116  RUNTIME_LOGS    ?= $(RUNTIME_LOG_DIR)/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%
   117  RUNTIME_ARGS    ?=
   118  DOCKER_RELOAD_COMMAND ?= sudo systemctl reload docker
   119  
   120  SYSFS_GROUP_PATH := /sys/fs/cgroup
   121  ifeq ($(shell stat -f -c "%T" "$(SYSFS_GROUP_PATH)" 2>/dev/null),cgroup2fs)
   122  CGROUPV2 := true
   123  else
   124  CGROUPV2 := false
   125  endif
   126  
   127  $(RUNTIME_BIN): # See below.
   128  	@mkdir -p "$(RUNTIME_DIR)"
   129  ifeq (,$(STAGED_BINARIES))
   130  	@$(call copy,//runsc,$(RUNTIME_BIN))
   131  else
   132  	gsutil cat "${STAGED_BINARIES}" | \
   133  	  tar -C "$(RUNTIME_DIR)" -zxvf - runsc && \
   134  	  chmod a+rx "$(RUNTIME_BIN)"
   135  endif
   136  .PHONY: $(RUNTIME_BIN) # Real file, but force rebuild.
   137  
   138  # Configure helpers for below.
   139  configure_noreload = \
   140    $(call header,CONFIGURE $(1) → $(RUNTIME_BIN) $(RUNTIME_ARGS) $(2)); \
   141    sudo $(RUNTIME_BIN) install --experimental=true --runtime="$(1)" -- $(RUNTIME_ARGS) --debug-log "$(RUNTIME_LOGS)" $(2) && \
   142    sudo rm -rf "$(RUNTIME_LOG_DIR)" && mkdir -p "$(RUNTIME_LOG_DIR)"
   143  
   144  reload_docker = \
   145    $(call header,DOCKER RELOAD); \
   146    bash -xc "$(DOCKER_RELOAD_COMMAND)" && \
   147    if test -f /etc/docker/daemon.json; then \
   148      sudo chmod 0755 /etc/docker && \
   149      sudo chmod 0644 /etc/docker/daemon.json; \
   150    fi
   151  
   152  wait_for_runtime = ( \
   153    set -x; \
   154    docker info --format '{{range $$k,$$v:=.Runtimes}}{{println $$k}}{{end}}' | grep -qF $(1) || \
   155    for i in 1 2 3 4 5; do \
   156      sleep 1; \
   157      docker info --format '{{range $$k,$$v:=.Runtimes}}{{println $$k}}{{end}}' | grep -qF $(1) && break; \
   158    done \
   159  )
   160  
   161  
   162  configure = $(call configure_noreload,$(1),$(2)) && $(reload_docker) && $(call wait_for_runtime,$(1))
   163  
   164  # Helpers for above. Requires $(RUNTIME_BIN) dependency.
   165  install_runtime = $(call configure,$(1),$(2) --TESTONLY-test-name-env=RUNSC_TEST_NAME)
   166  # Don't use cached results, otherwise multiple runs using different runtimes
   167  # may be skipped, if all other inputs are the same.
   168  test_runtime = $(call test,--test_env=RUNTIME=$(1) --nocache_test_results $(PARTITIONS) $(2))
   169  test_runtime_cached = $(call test,--test_env=RUNTIME=$(1) $(PARTITIONS) $(2))
   170  
   171  refresh: $(RUNTIME_BIN) ## Updates the runtime binary.
   172  .PHONY: refresh
   173  
   174  dev: $(RUNTIME_BIN) ## Installs a set of local runtimes. Requires sudo.
   175  	@$(call configure_noreload,$(RUNTIME),--net-raw)
   176  	@$(call configure_noreload,$(RUNTIME)-d,--net-raw --debug --strace --log-packets)
   177  	@$(call configure_noreload,$(RUNTIME)-p,--net-raw --profile)
   178  	@$(call configure_noreload,$(RUNTIME)-cgroup-d,--net-raw --debug --strace --log-packets --cgroupfs)
   179  	@$(call configure_noreload,$(RUNTIME)-systemd-d,--net-raw --debug --strace --log-packets --systemd-cgroup)
   180  	@$(call reload_docker)
   181  .PHONY: dev
   182  
   183  ##
   184  ## Canonical build and test targets.
   185  ##
   186  ##   These targets are used by continuous integration and provide
   187  ##   convenient entrypoints for testing changes. If you're adding a
   188  ##   new subsystem or workflow, consider adding a new target here.
   189  ##
   190  ##   Some targets support a PARTITION (1-indexed) and TOTAL_PARTITIONS
   191  ##   environment variables for high-level test sharding. Unlike most
   192  ##   other variables, these are sourced from the environment.
   193  ##
   194  PARTITION        ?= 1
   195  TOTAL_PARTITIONS ?= 1
   196  PARTITIONS       := --test_env=PARTITION=$(PARTITION) --test_env=TOTAL_PARTITIONS=$(TOTAL_PARTITIONS)
   197  
   198  runsc: ## Builds the runsc binary.
   199  	@$(call build,-c opt //runsc)
   200  .PHONY: runsc
   201  
   202  debian: ## Builds the debian packages.
   203  	@$(call build,-c opt //debian:debian)
   204  .PHONY: debian
   205  
   206  smoke-tests: ## Runs a simple smoke test after building runsc.
   207  	@$(call run,//runsc,--alsologtostderr --network none --debug --TESTONLY-unsafe-nonroot=true --rootless do true)
   208  .PHONY: smoke-tests
   209  
   210  smoke-race-tests: ## Runs a smoke test after build building runsc in race configuration.
   211  	@$(call run,$(RACE_FLAGS) //runsc:runsc-race,--alsologtostderr --network none --debug --TESTONLY-unsafe-nonroot=true --rootless do true)
   212  .PHONY: smoke-race-tests
   213  
   214  nogo-tests:
   215  	@$(call test,--test_tag_filters=nogo //:all pkg/... tools/...)
   216  .PHONY: nogo-tests
   217  
   218  # For unit tests, we take everything in the root, pkg/... and tools/..., and
   219  # pull in all directories in runsc except runsc/container.
   220  #
   221  # FIXME(gvisor.dev/issue/10045): Need to fix broken tests.
   222  unit-tests: ## Local package unit tests in pkg/..., tools/.., etc.
   223  	@$(call test,--test_tag_filters=-nogo$(COMMA)-requires-kvm -- //:all pkg/... tools/... runsc/... vdso/... test/trace/... -//pkg/metric:metric_test -//pkg/coretag:coretag_test -//runsc/config:config_test -//tools/tracereplay:tracereplay_test -//test/trace:trace_test)
   224  .PHONY: unit-tests
   225  
   226  # See unit-tests: this includes runsc/container.
   227  container-tests: ## Run all tests in runsc/container/...
   228  	@$(call test,--test_tag_filters=-nogo runsc/container/...)
   229  .PHONY: container-tests
   230  
   231  tests: ## Runs all unit tests and syscall tests.
   232  tests: unit-tests nogo-tests container-tests syscall-tests
   233  .PHONY: tests
   234  
   235  integration-tests: ## Run all standard integration tests.
   236  integration-tests: docker-tests overlay-tests hostnet-tests swgso-tests
   237  integration-tests: do-tests kvm-tests containerd-tests-min
   238  .PHONY: integration-tests
   239  
   240  network-tests: ## Run all networking integration tests.
   241  network-tests: iptables-tests packetdrill-tests packetimpact-tests
   242  .PHONY: network-tests
   243  
   244  syscall-tests: $(RUNTIME_BIN) ## Run all system call tests.
   245  	@$(call test,--test_env=RUNTIME=$(RUNTIME_BIN) --cxxopt=-Werror $(PARTITIONS) test/syscalls/...)
   246  .PHONY: syscall-tests
   247  
   248  packetimpact-tests:
   249  	@$(call test,--jobs=HOST_CPUS*3 --local_test_jobs=HOST_CPUS*3 //test/packetimpact/tests:all_tests)
   250  .PHONY: packetimpact-tests
   251  
   252  # Extra configuration options for runtime tests.
   253  RUNTIME_TESTS_FILTER ?=
   254  RUNTIME_TESTS_PER_TEST_TIMEOUT ?= 20m
   255  RUNTIME_TESTS_RUNS_PER_TEST ?= 1
   256  RUNTIME_TESTS_FLAKY_IS_ERROR ?= true
   257  RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT ?= true
   258  
   259  %-runtime-tests: load-runtimes_% $(RUNTIME_BIN)
   260  	@$(call install_runtime,$(RUNTIME),--watchdog-action=panic --platform=systrap)
   261  	@IMAGE_TAG=$(call tag,runtimes_$*) && \
   262  	$(call test_runtime_cached,$(RUNTIME),--test_timeout=1800 --test_env=RUNTIME_TESTS_FILTER=$(RUNTIME_TESTS_FILTER) --test_env=RUNTIME_TESTS_PER_TEST_TIMEOUT=$(RUNTIME_TESTS_PER_TEST_TIMEOUT) --test_env=RUNTIME_TESTS_RUNS_PER_TEST=$(RUNTIME_TESTS_RUNS_PER_TEST) --test_env=RUNTIME_TESTS_FLAKY_IS_ERROR=$(RUNTIME_TESTS_FLAKY_IS_ERROR) --test_env=RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT=$(RUNTIME_TESTS_FLAKY_SHORT_CIRCUIT) --test_env=IMAGE_TAG=$${IMAGE_TAG} //test/runtimes:$*)
   263  
   264  do-tests: $(RUNTIME_BIN)
   265  	@$(RUNTIME_BIN) --rootless do true
   266  	@$(RUNTIME_BIN) --rootless -network=none do true
   267  	@sudo $(RUNTIME_BIN) do true
   268  .PHONY: do-tests
   269  
   270  arm-qemu-smoke-test: BAZEL_OPTIONS=--config=aarch64
   271  arm-qemu-smoke-test: $(RUNTIME_BIN) load-arm-qemu
   272  	export T=$$(mktemp -d --tmpdir release.XXXXXX); \
   273  	mkdir -p $$T/bin/arm64/ && \
   274  	cp $(RUNTIME_BIN) $$T/bin/arm64 && \
   275  	docker run --rm -v $$T/bin/arm64/runsc:/workdir/initramfs/runsc gvisor.dev/images/arm-qemu
   276  .PHONY: arm-qemu-smoke-test
   277  
   278  simple-tests: unit-tests # Compatibility target.
   279  .PHONY: simple-tests
   280  
   281  # Images needed for GPU smoke tests.
   282  gpu-smoke-images: load-basic_cuda-vector-add load-gpu_cuda-tests
   283  .PHONY: gpu-smoke-images
   284  
   285  gpu-smoke-tests: gpu-smoke-images $(RUNTIME_BIN)
   286  	@$(call sudo,test/gpu:smoke_test,--runtime=runc -test.v $(ARGS))
   287  	@$(call install_runtime,$(RUNTIME),--nvproxy=true --nvproxy-docker=true)
   288  	@$(call sudo,test/gpu:smoke_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   289  .PHONY: gpu-smoke-tests
   290  
   291  cos-gpu-smoke-tests: gpu-smoke-images $(RUNTIME_BIN)
   292  	@$(call sudo,test/gpu:smoke_test,--runtime=runc -test.v --cos-gpu $(ARGS))
   293  	@$(call install_runtime,$(RUNTIME),--nvproxy=true)
   294  	@$(call sudo,test/gpu:smoke_test,--runtime=$(RUNTIME) -test.v --cos-gpu $(ARGS))
   295  .PHONY: cos-gpu-smoke-tests
   296  
   297  # Images needed for GPU tests.
   298  # This is a superset of those needed for smoke tests.
   299  # It includes non-GPU images that are used as part of GPU tests,
   300  # e.g. busybox and python.
   301  gpu-images: gpu-smoke-images load-gpu_pytorch load-gpu_ollama load-gpu_ollama_client load-basic_busybox load-basic_python load-gpu_stable-diffusion-xl
   302  .PHONY: gpu-images
   303  
   304  gpu-all-tests: gpu-images gpu-smoke-tests $(RUNTIME_BIN)
   305  	@$(call install_runtime,$(RUNTIME),--nvproxy=true --nvproxy-docker=true)
   306  	@$(call sudo,test/gpu:pytorch_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   307  	@$(call sudo,test/gpu:textgen_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   308  	@$(call sudo,test/gpu:imagegen_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   309  	@$(call sudo,test/gpu:sr_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   310  .PHONY: gpu-all-tests
   311  
   312  cos-gpu-all-tests: gpu-images cos-gpu-smoke-tests $(RUNTIME_BIN)
   313  	@$(call install_runtime,$(RUNTIME),--nvproxy=true)
   314  	@$(call sudo,test/gpu:pytorch_test,--runtime=$(RUNTIME) -test.v --cos-gpu $(ARGS))
   315  	@$(call sudo,test/gpu:textgen_test,--runtime=$(RUNTIME) -test.v --cos-gpu $(ARGS))
   316  	@$(call sudo,test/gpu:imagegen_test,--runtime=$(RUNTIME) -test.v --cos-gpu $(ARGS))
   317  	@$(call sudo,test/gpu:sr_test,--runtime=$(RUNTIME) -test.v --cos-gpu $(ARGS))
   318  .PHONY: cos-gpu-all-tests
   319  
   320  portforward-tests: load-basic_redis load-basic_nginx $(RUNTIME_BIN)
   321  	@$(call install_runtime,$(RUNTIME),--network=sandbox)
   322  	@$(call sudo,test/root:portforward_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   323  	@$(call install_runtime,$(RUNTIME),--network=host)
   324  	@$(call sudo,test/root:portforward_test,--runtime=$(RUNTIME) -test.v $(ARGS))
   325  .PHONY: portforward-test
   326  
   327  # Standard integration targets.
   328  INTEGRATION_TARGETS := //test/image:image_test //test/e2e:integration_test
   329  
   330  docker-tests: load-basic $(RUNTIME_BIN)
   331  	@$(call install_runtime,$(RUNTIME),) # Clear flags.
   332  	@$(call install_runtime,$(RUNTIME)-fdlimit,--fdlimit=2000) # Used by TestRlimitNoFile.
   333  	@$(call install_runtime,$(RUNTIME)-dcache,--fdlimit=2000 --dcache=100) # Used by TestDentryCacheLimit.
   334  	@$(call install_runtime,$(RUNTIME)-host-uds,--host-uds=all) # Used by TestHostSocketConnect.
   335  	@$(call install_runtime,$(RUNTIME)-overlay,--overlay2=all:self) # Used by TestOverlay*.
   336  	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS) //test/e2e:integration_runtime_test)
   337  .PHONY: docker-tests
   338  
   339  overlay-tests: load-basic $(RUNTIME_BIN)
   340  	@$(call install_runtime,$(RUNTIME),--overlay2=all:dir=/tmp)
   341  	@$(call test_runtime,$(RUNTIME),--test_env=TEST_OVERLAY=true $(INTEGRATION_TARGETS))
   342  .PHONY: overlay-tests
   343  
   344  swgso-tests: load-basic $(RUNTIME_BIN)
   345  	@$(call install_runtime,$(RUNTIME),--software-gso=true --gso=false)
   346  	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
   347  .PHONY: swgso-tests
   348  
   349  hostnet-tests: load-basic $(RUNTIME_BIN)
   350  	@$(call install_runtime,$(RUNTIME),--network=host --net-raw)
   351  	@$(call test_runtime,$(RUNTIME),--test_env=TEST_CHECKPOINT=false --test_env=TEST_HOSTNET=true --test_env=TEST_NET_RAW=true $(INTEGRATION_TARGETS))
   352  .PHONY: hostnet-tests
   353  
   354  kvm-tests: load-basic $(RUNTIME_BIN)
   355  	@(lsmod | grep -E '^(kvm_intel|kvm_amd)') || sudo modprobe kvm
   356  	@if ! test -w /dev/kvm; then sudo chmod a+rw /dev/kvm; fi
   357  	@$(call test,//pkg/sentry/platform/kvm:kvm_test)
   358  	@$(call install_runtime,$(RUNTIME),--platform=kvm)
   359  	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
   360  .PHONY: kvm-tests
   361  
   362  systrap-tests: load-basic $(RUNTIME_BIN)
   363  	@$(call install_runtime,$(RUNTIME),--platform=systrap)
   364  	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
   365  .PHONY: systrap-tests
   366  
   367  iptables-tests: load-iptables $(RUNTIME_BIN)
   368  	@sudo modprobe iptable_filter
   369  	@sudo modprobe ip6table_filter
   370  	@sudo modprobe iptable_nat
   371  	@sudo modprobe ip6table_nat
   372  	@# FIXME(b/218923513): Need to fix permissions issues.
   373  	@#$(call test,--test_env=RUNTIME=runc //test/iptables:iptables_test)
   374  	@$(call install_runtime,$(RUNTIME),--net-raw)
   375  	@$(call test_runtime,$(RUNTIME),--test_env=TEST_NET_RAW=true //test/iptables:iptables_test)
   376  	@$(call install_runtime,$(RUNTIME)-nftables,--net-raw --reproduce-nftables)
   377  	@$(call test_runtime,$(RUNTIME)-nftables, --test_output=all //test/iptables:nftables_test --test_arg=$(RUNTIME)-nftables)
   378  .PHONY: iptables-tests
   379  
   380  packetdrill-tests: load-packetdrill $(RUNTIME_BIN)
   381  	@$(call install_runtime,$(RUNTIME),) # Clear flags.
   382  	@$(call test_runtime,$(RUNTIME),//test/packetdrill:all_tests)
   383  .PHONY: packetdrill-tests
   384  
   385  fsstress-test: load-basic $(RUNTIME_BIN)
   386  	@$(call install_runtime,$(RUNTIME))
   387  	@$(call test_runtime,$(RUNTIME),//test/fsstress:fsstress_test)
   388  .PHONY: fsstress-test
   389  
   390  # Helper to install containerd.
   391  # $(1) is the containerd version.
   392  install_containerd = \
   393  	($(call header,INSTALL CONTAINERD); \
   394  	export T=$$(mktemp -d --tmpdir containerd.XXXXXX); \
   395  	cp tools/install_containerd.sh $$T && \
   396  	cd /tmp && \
   397  	sudo -H "PATH=$$PATH" $$T/install_containerd.sh $(1); \
   398  	rm -rf $$T)
   399  
   400  # Specific containerd version tests.
   401  containerd-test-%: load-basic_alpine load-basic_python load-basic_busybox load-basic_symlink-resolv load-basic_httpd load-basic_ubuntu $(RUNTIME_BIN)
   402  	@$(call install_runtime,$(RUNTIME),) # Clear flags.
   403  	@$(call install_containerd,$*)
   404  ifeq (,$(STAGED_BINARIES))
   405  	@(export T=$$(mktemp -d --tmpdir containerd.XXXXXX); \
   406  	$(call copy,//shim:containerd-shim-runsc-v1,$$T) && \
   407  	sudo mv $$T/containerd-shim-runsc-v1 "$$(dirname $$(which containerd))"; \
   408  	rm -rf $$T)
   409  else
   410  	gsutil cat "$(STAGED_BINARIES)" | \
   411  		sudo tar -C "$$(dirname $$(which containerd))" -zxvf - containerd-shim-runsc-v1
   412  endif
   413  	@$(call sudo,test/root:root_test,--runtime=$(RUNTIME) -test.v)
   414  containerd-tests-min: containerd-test-1.4.12
   415  
   416  ##
   417  ## Containerd tests.
   418  ##
   419  ## Runs all supported containerd version tests. Update as new versions become
   420  ## available.
   421  ##
   422  containerd-tests:
   423  containerd-tests: containerd-test-1.4.12
   424  containerd-tests: containerd-test-1.5.11
   425  containerd-tests: containerd-test-1.6.2
   426  
   427  ##
   428  ## Benchmarks.
   429  ##
   430  ## Targets to run benchmarks. See //test/benchmarks for details.
   431  ## You can list all available benchmarks using:
   432  ##   $ bazel query 'attr("tags", ".*gvisor_benchmark.*", //test/benchmarks/...)'
   433  ##
   434  ## Common arguments:
   435  ##   BENCHMARKS_PROJECT   - BigQuery project to which to send data.
   436  ##   BENCHMARKS_DATASET   - BigQuery dataset to which to send data.
   437  ##   BENCHMARKS_TABLE     - BigQuery table to which to send data.
   438  ##   BENCHMARKS_SUITE     - name of the benchmark suite. See //tools/bigquery/bigquery.go.
   439  ##   BENCHMARKS_UPLOAD    - if true, upload benchmark data from the run.
   440  ##   BENCHMARKS_OFFICIAL  - marks the data as official.
   441  ##   BENCHMARKS_PLATFORMS - if set, only run the benchmarks for this
   442  ##                          space-separated list of platform names.
   443  ##   BENCHMARKS_RUNC      - if true, also benchmark runc performance.
   444  ##   BENCHMARKS_FILTER    - filter to be applied to the test suite.
   445  ##   BENCHMARKS_OPTIONS   - options to be passed to the test.
   446  ##   BENCHMARKS_PROFILE   - profile options to be passed to the test.
   447  ##                          Set to the empty string to avoid profiling overhead.
   448  ##
   449  BENCHMARKS_PROJECT   ?= gvisor-benchmarks
   450  BENCHMARKS_DATASET   ?= kokoro
   451  BENCHMARKS_TABLE     ?= benchmarks
   452  BENCHMARKS_SUITE     ?= ffmpeg
   453  BENCHMARKS_UPLOAD    ?= false
   454  BENCHMARKS_OFFICIAL  ?= false
   455  BENCHMARKS_TARGETS   ?= //test/benchmarks/media:ffmpeg_test
   456  BENCHMARKS_PLATFORMS ?=
   457  BENCHMARKS_RUNC      ?= true
   458  BENCHMARKS_FILTER    ?= .
   459  BENCHMARKS_OPTIONS   ?= -test.benchtime=30s
   460  BENCHMARKS_ARGS      ?= -test.v -test.bench=$(BENCHMARKS_FILTER) $(BENCHMARKS_OPTIONS)
   461  BENCHMARKS_PROFILE   ?= -pprof-dir=/tmp/profile -pprof-cpu -pprof-heap -pprof-block -pprof-mutex
   462  
   463  init-benchmark-table: ## Initializes a BigQuery table with the benchmark schema.
   464  	@$(call run,//tools/parsers:parser,init --project=$(BENCHMARKS_PROJECT) --dataset=$(BENCHMARKS_DATASET) --table=$(BENCHMARKS_TABLE))
   465  .PHONY: init-benchmark-table
   466  
   467  # $(1) is the runtime name.
   468  run_benchmark = \
   469  	($(call header,BENCHMARK $(1)); \
   470  	set -euo pipefail; \
   471  	export T=$$(mktemp --tmpdir logs.$(1).XXXXXX); \
   472  	export UNSANDBOXED_RUNTIME; \
   473  	if test "$(1)" = "runc"; then $(call sudo,$(BENCHMARKS_TARGETS),-runtime=$(1) $(BENCHMARKS_ARGS)) | tee $$T; fi; \
   474  	if test "$(1)" != "runc"; then $(call sudo,$(BENCHMARKS_TARGETS),-runtime=$(1) $(BENCHMARKS_ARGS) $(BENCHMARKS_PROFILE)) | tee $$T; fi; \
   475  	if test "$(BENCHMARKS_UPLOAD)" = "true"; then \
   476  	  $(call run,tools/parsers:parser,parse --debug --file=$$T --runtime=$(1) --suite_name=$(BENCHMARKS_SUITE) --project=$(BENCHMARKS_PROJECT) --dataset=$(BENCHMARKS_DATASET) --table=$(BENCHMARKS_TABLE) --official=$(BENCHMARKS_OFFICIAL)); \
   477  	fi; \
   478  	rm -rf $$T)
   479  
   480  benchmark-platforms: load-benchmarks $(RUNTIME_BIN) ## Runs benchmarks for runc and all (selected) platforms.
   481  	@set -xe; if test -z "$(BENCHMARKS_PLATFORMS)"; then \
   482  	  for PLATFORM in $$($(RUNTIME_BIN) help platforms); do \
   483  	    export PLATFORM; \
   484  	    $(call install_runtime,$${PLATFORM},--platform $${PLATFORM} --profile); \
   485  	    $(call run_benchmark,$${PLATFORM}); \
   486  	  done; \
   487  	else \
   488  	  for PLATFORM in $(BENCHMARKS_PLATFORMS); do \
   489  	    export PLATFORM; \
   490  	    $(call install_runtime,$${PLATFORM},--platform $${PLATFORM} --profile); \
   491  	    $(call run_benchmark,$${PLATFORM}); \
   492  	  done; \
   493  	fi
   494  	@set -xe; if test "$(BENCHMARKS_RUNC)" == true; then \
   495  	  $(call run_benchmark,runc); \
   496  	fi
   497  .PHONY: benchmark-platforms
   498  
   499  run-benchmark: load-benchmarks ## Runs single benchmark and optionally sends data to BigQuery.
   500  	@$(call run_benchmark,$(RUNTIME))
   501  .PHONY: run-benchmark
   502  
   503  ## Seccomp targets.
   504  seccomp-sentry-filters:  # Dumps seccomp-bpf program for the Sentry binary.
   505  	@$(call run,//runsc/boot/filter/dumpfilter,$(ARGS))
   506  .PHONY: seccomp-sentry-filters
   507  
   508  ##
   509  ## Website & documentation helpers.
   510  ##
   511  ##   The website is built from repository documentation and wrappers, using
   512  ##   using a locally-defined Docker image (see images/jekyll). The following
   513  ##   variables may be set when using website-push:
   514  ##     WEBSITE_IMAGE   - The name of the container image.
   515  ##     WEBSITE_SERVICE - The backend service.
   516  ##     WEBSITE_PROJECT - The project id to use.
   517  ##     WEBSITE_REGION  - The region to deploy to.
   518  ##
   519  WEBSITE_IMAGE   := gcr.io/gvisordev/gvisordev
   520  WEBSITE_SERVICE := gvisordev
   521  WEBSITE_PROJECT := gvisordev
   522  WEBSITE_REGION  := us-central1
   523  
   524  website-build: load-jekyll ## Build the site image locally.
   525  	@$(call run,//website:website,$(WEBSITE_IMAGE))
   526  .PHONY: website-build
   527  
   528  website-server: website-build ## Run a local server for development.
   529  	@# NOTE: When running locally we use the localhost:8080 as custom domain.
   530  	@docker run -i -p 8080:8080 $(WEBSITE_IMAGE) --custom-domain='*'
   531  .PHONY: website-server
   532  
   533  website-push: website-build ## Push a new image and update the service.
   534  	@docker push $(WEBSITE_IMAGE)
   535  .PHONY: website-push
   536  
   537  website-deploy: website-push ## Deploy a new version of the website.
   538  	@gcloud run deploy $(WEBSITE_SERVICE) --platform=managed --region=$(WEBSITE_REGION) --project=$(WEBSITE_PROJECT) --image=$(WEBSITE_IMAGE) --memory 1Gi
   539  .PHONY: website-deploy
   540  
   541  ##
   542  ## Webhook helpers.
   543  ##
   544  ##   The webhook is built locally.
   545  ##     WEBHOOK_IMAGE - The name of the container image.
   546  ##
   547  WEBHOOK_IMAGE := gcr.io/gvisor-presubmit/webhook
   548  
   549  webhook-build: ## Build the webhookimage locally.
   550  	@$(call run,//webhook:image,$(WEBHOOK_IMAGE))
   551  .PHONY: webhook-build
   552  
   553  webhook-push: webhook-build ## Push a new image.
   554  	@docker push $(WEBHOOK_IMAGE)
   555  .PHONY: website-push
   556  
   557  webhook-update: test/kubernetes/gvisor-injection-admission-webhook.yaml.in
   558  	@WEBHOOK=$(WEBHOOK_IMAGE):$$($(call run,//webhook:image,$(WEBHOOK_IMAGE)) | cut -d':' -f2) && \
   559  	INIT=$(call remote_image,certs):$(call tag,certs) && \
   560  	cat $< | sed -e "s|%WEBHOOK%|$${WEBHOOK}|g" | sed -e "s|%INIT%|$${INIT}|g" > test/kubernetes/gvisor-injection-admission-webhook.yaml
   561  .PHONY: webhook-update
   562  
   563  ##
   564  ## Repository builders.
   565  ##
   566  ##   This builds a local apt repository. The following variables may be set:
   567  ##     RELEASE_ROOT      - The repository root (default: "repo" directory).
   568  ##     RELEASE_KEY       - The repository GPG private key file (default: dummy key is created).
   569  ##     RELEASE_ARTIFACTS - The release artifacts directory. May contain multiple.
   570  ##     RELEASE_NIGHTLY   - Set to true if a nightly release (default: false).
   571  ##     RELEASE_COMMIT    - The commit or Change-Id for the release (needed for tag).
   572  ##     RELEASE_NAME      - The name of the release in the proper format (needed for tag).
   573  ##     RELEASE_NOTES     - The file containing release notes (needed for tag).
   574  ##
   575  RELEASE_ROOT      := repo
   576  RELEASE_KEY       := repo.key
   577  RELEASE_ARTIFACTS := artifacts
   578  RELEASE_NIGHTLY   := false
   579  RELEASE_COMMIT    :=
   580  RELEASE_NAME      :=
   581  RELEASE_NOTES     :=
   582  GPG_TEST_OPTIONS  := $(shell if gpg --pinentry-mode loopback --version >/dev/null 2>&1; then echo --pinentry-mode loopback; fi)
   583  
   584  $(RELEASE_KEY):
   585  	@echo "WARNING: Generating a key for testing ($@); don't use this."
   586  	@T=$$(mktemp --tmpdir keyring.XXXXXX); \
   587  	C=$$(mktemp --tmpdir config.XXXXXX); \
   588  	echo Key-Type: DSA >> $$C && \
   589  	echo Key-Length: 1024 >> $$C && \
   590  	echo Name-Real: Test >> $$C && \
   591  	echo Name-Email: test@example.com >> $$C && \
   592  	echo Expire-Date: 0 >> $$C && \
   593  	echo %commit >> $$C && \
   594  	gpg --batch $(GPG_TEST_OPTIONS) --passphrase '' --no-default-keyring --secret-keyring $$T --no-tty --gen-key $$C && \
   595  	gpg --batch $(GPG_TEST_OPTIONS) --export-secret-keys --no-default-keyring --secret-keyring $$T > $@; \
   596  	rc=$$?; rm -f $$T $$C; exit $$rc
   597  
   598  $(RELEASE_ARTIFACTS)/%:
   599  	@mkdir -p $@
   600  	@$(call copy,//runsc:runsc,$@)
   601  	@$(call copy,//shim:containerd-shim-runsc-v1,$@)
   602  	@$(call copy,//debian:debian,$@)
   603  
   604  release: $(RELEASE_KEY) $(RELEASE_ARTIFACTS)/$(ARCH)
   605  	@mkdir -p $(RELEASE_ROOT)
   606  	@NIGHTLY=$(RELEASE_NIGHTLY) tools/make_release.sh $(RELEASE_KEY) $(RELEASE_ROOT) $$(find $(RELEASE_ARTIFACTS) -type f)
   607  .PHONY: release
   608  
   609  tag: ## Creates and pushes a release tag.
   610  	@tools/tag_release.sh "$(RELEASE_COMMIT)" "$(RELEASE_NAME)" "$(RELEASE_NOTES)"
   611  .PHONY: tag