go.mod: experimental integration of gomodjail (library sandbox) #4012
+98
−32
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -39,6 +39,10 @@ ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v2.1.2@BINARY | |
| ARG TINI_VERSION=v0.19.0@BINARY | ||
| # Extra deps: Debug | ||
| ARG BUILDG_VERSION=v0.4.1@BINARY | ||
| # Extra deps: gomodjail | ||
| # TODO: pin the deps | ||
| ARG MAKESELF_VERSION=v2.5.0 | ||
| ARG GOMODJAIL_VERSION=master | ||
|
|
||
| # Test deps | ||
| # Currently, the Docker Official Images and the test deps are not pinned by the hash | ||
|
|
@@ -118,7 +122,8 @@ RUN xx-go --wrap && \ | |
| xx-verify --static cmd/ipfs/ipfs && cp -a cmd/ipfs/ipfs /out/${TARGETARCH} | ||
|
|
||
| FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build-base | ||
| # tar: required by makeself (executed by `gomodjail unpack`) | ||
| RUN apk add --no-cache make git curl tar | ||
| RUN git config --global advice.detachedHead false | ||
| ADD hack/git-checkout-tag-with-hash.sh /usr/local/bin/ | ||
|
|
||
|
|
@@ -231,6 +236,24 @@ RUN ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION/@BINARY}; \ | |
| tar xzf "${fname}" -C /out/bin && \ | ||
| rm -f "${fname}" /out/bin/rootlesskit-docker-proxy && \ | ||
| echo "- RootlessKit: ${ROOTLESSKIT_VERSION}" >> /out/share/doc/nerdctl-full/README.md | ||
| # makeself is needed by `gomodjail pack`. | ||
| # TODO: remove dependency on makeself https://github.com/AkihiroSuda/gomodjail/issues/31 | ||
|
There was a problem hiding this comment. Seems to be a blocker 😞 $ ./nerdctl.gomodjail --namespace=nerdctl-test info
Unrecognized flag : --namespace=nerdctl-testThere was a problem hiding this comment. Is there a reason to keep Alpine? https://github.com/containerd/nerdctl/blob/main/Dockerfile#L120-L123 There was a problem hiding this comment. IIRC static linking didn't work well with glibc, at least in the past. There was a problem hiding this comment. We do not build with CGO at all on alpine, though - (and whatever needs CGO is built on Debian - containerd and the rest, because they do need glibc anyhow). Anyhow, different discussion (can happen in #4021). Will look into gomodjail and see if I can help with getting rid of makeself. There was a problem hiding this comment. Thanks, left an idea in (The blocker is about the arg parser of makeself, not about any Alpine stuff) |
||
| ARG MAKESELF_VERSION | ||
| RUN fname="makeself-${MAKESELF_VERSION/v}.run" && \ | ||
| curl -o "${fname}" -fsSL --proto '=https' --tlsv1.2 "https://github.com/megastep/makeself/releases/download/release-${MAKESELF_VERSION/v}/${fname}" && \ | ||
| grep "${fname}" "/SHA256SUMS.d/makeself-${MAKESELF_VERSION}" | sha256sum -c && \ | ||
| dirname="makeself-${MAKESELF_VERSION/v}" && \ | ||
| sh "${fname}" && \ | ||
| cp -a "${dirname}"/makeself-header.sh /usr/local/bin/ && \ | ||
| cp -a "${dirname}"/makeself.sh /usr/local/bin/makeself && \ | ||
| rm -rf "${fname}" "${dirname}" | ||
| ARG GOMODJAIL_VERSION | ||
| RUN git clone https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail && \ | ||
| cd /go/src/github.com/AkihiroSuda/gomodjail && \ | ||
| git checkout "${GOMODJAIL_VERSION}" && \ | ||
| make STATIC=1 && \ | ||
| cp -a _output/bin/gomodjail /out/bin/ && \ | ||
| echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/README.md | ||
|
|
||
| RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \ | ||
| echo "## License" >> /out/share/doc/nerdctl-full/README.md && \ | ||
|
|
@@ -245,6 +268,8 @@ COPY . /go/src/github.com/containerd/nerdctl | |
| RUN { echo "# nerdctl (full distribution)"; echo "- nerdctl: $(cd /go/src/github.com/containerd/nerdctl && git describe --tags)"; cat /out/share/doc/nerdctl-full/README.md; } > /out/share/doc/nerdctl-full/README.md.new; mv /out/share/doc/nerdctl-full/README.md.new /out/share/doc/nerdctl-full/README.md | ||
| WORKDIR /go/src/github.com/containerd/nerdctl | ||
| RUN BINDIR=/out/bin make binaries install | ||
| RUN /out/bin/gomodjail pack --go-mod=/go/src/github.com/containerd/nerdctl/go.mod /out/bin/nerdctl && \ | ||
| cp -a nerdctl.gomodjail /out/bin/ | ||
AkihiroSuda marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| COPY README.md /out/share/doc/nerdctl/ | ||
| COPY docs /out/share/doc/nerdctl/docs | ||
| RUN (cd /out && find ! -type d | sort | xargs sha256sum > /tmp/SHA256SUMS ) && \ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 4d2fa9d898be22c63bb3c6bb7cc3dc97237700dea6d6ad898dcbec0289df0bc4 makeself-2.5.0.run |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
(This is not working because
test-integration-rootless.shdoes not propagate the env var across the SSH session)