ci-image/dockerfiles/Dockerfile.nix at 1f830f608791b11dcc0064db8d664151d89c0bb7 · matttrach/ci-image · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
FROM registry.suse.com/bci/bci-base:15.7@sha256:3292c81fb9e40b60903e6c88fac34e955b6d5b3acd3eb055d02d5c1538a72aea

LABEL org.opencontainers.image.source="https://github.com/rancher/ci-image" \
      org.opencontainers.image.title="Rancher nix CI image" \
      org.opencontainers.image.description="Nix environment"

ARG TARGETARCH
ENV ARCH=$TARGETARCH
ENV GH_TELEMETRY=false
ENV DO_NOT_TRACK=true
ENV PATH="/var/ci-tools/active:${PATH}"

RUN zypper -n refresh && \
    zypper -n install \
        gettext-runtime \
        ca-certificates \
        docker \
        gawk \
        git-core \
        gzip \
        jq \
        make \
        tar \
        unzip \
        zstd \
        wget \
        sudo \
        vim \
    && \
    zypper -n clean -a && \
    rm -rf /var/log/{lastlog,tallylog,zypper.log,zypp/history,YaST2}

# Create runner group (GID 121) and user (UID 1001) early for use in tool installations.
# /var/ci-tools/ is set up with setgid (2755) so subdirectories inherit the runner group.
# This allows any user added to the runner group to access tools extracted to /var/ci-tools/.
RUN groupadd -g 121 runner && \
    useradd -u 1001 -g 121 -m runner && \
    mkdir -p /var/ci-tools && \
    chown root:runner /var/ci-tools && \
    chmod 2755 /var/ci-tools

# cosign v3.0.6
RUN case "${ARCH}" in \
        amd64) CHECKSUM="c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74" ;; \
        arm64) CHECKSUM="bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export TMP_DIR=$(mktemp -d) && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64" ;; \
        arm64) DOWNLOAD_URL="https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-arm64" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_DIR}/cosign" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_DIR}/cosign" > "${TMP_DIR}/checksum.sha256" && \
    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
    install "${TMP_DIR}/cosign" "/usr/local/bin/cosign" && \
    rm -rf "${TMP_DIR}"

# gh v2.89.0
RUN case "${ARCH}" in \
        amd64) CHECKSUM="d0422caade520530e76c1c558da47daebaa8e1203d6b7ff10ad7d6faba3490d8" ;; \
        arm64) CHECKSUM="9e64a623dfc242990aa5d9b3f507111149c4282f66b68eaad1dc79eeb13b9ce5" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export TMP_DIR=$(mktemp -d) && \
    export TMP_FILE="${TMP_DIR}/gh.tar.gz" && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_amd64.tar.gz"; EXTRACT="gh_2.89.0_linux_amd64/bin/gh" ;; \
        arm64) DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v2.89.0/gh_2.89.0_linux_arm64.tar.gz"; EXTRACT="gh_2.89.0_linux_arm64/bin/gh" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/gh" && \
    rm -rf "${TMP_DIR}"

# helmv3 v3.20.2
RUN case "${ARCH}" in \
        amd64) CHECKSUM="258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea" ;; \
        arm64) CHECKSUM="5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export TMP_DIR=$(mktemp -d) && \
    export TMP_FILE="${TMP_DIR}/helmv3.tar.gz" && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz"; EXTRACT="linux-amd64/helm" ;; \
        arm64) DOWNLOAD_URL="https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz"; EXTRACT="linux-arm64/helm" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/helmv3" && \
    rm -rf "${TMP_DIR}"

# helmv4 v4.1.4
RUN case "${ARCH}" in \
        amd64) CHECKSUM="70b2c30a19da4db264dfd68c8a3664e05093a361cefd89572ffb36f8abfa3d09" ;; \
        arm64) CHECKSUM="13d03672be289045d2ff00e4e345d61de1c6f21c1257a45955a30e8ae036d8f1" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export TMP_DIR=$(mktemp -d) && \
    export TMP_FILE="${TMP_DIR}/helmv4.tar.gz" && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gz"; EXTRACT="linux-amd64/helm" ;; \
        arm64) DOWNLOAD_URL="https://get.helm.sh/helm-v4.1.4-linux-arm64.tar.gz"; EXTRACT="linux-arm64/helm" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/helmv4" && \
    rm -rf "${TMP_DIR}"

# slsactl v0.1.30
RUN case "${ARCH}" in \
        amd64) CHECKSUM="7ed4750766c135ddcae788d194d7ff59a57c6debdc722fd1e52c06460218f10a" ;; \
        arm64) CHECKSUM="bbbe66089135c82526677177c080f5ca4911ad1989712596338c5acdae4bb383" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export TMP_DIR=$(mktemp -d) && \
    export TMP_FILE="${TMP_DIR}/slsactl.tar.gz" && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://github.com/rancherlabs/slsactl/releases/download/v0.1.30/slsactl_0.1.30_linux_amd64.tar.gz"; EXTRACT="slsactl" ;; \
        arm64) DOWNLOAD_URL="https://github.com/rancherlabs/slsactl/releases/download/v0.1.30/slsactl_0.1.30_linux_arm64.tar.gz"; EXTRACT="slsactl" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/slsactl" && \
    rm -rf "${TMP_DIR}"

# nix 2.34.5

# Pre-install setup for nix
# Create unprivileged user for Nix installation
RUN useradd -m suse && \
    if [ ! -f /etc/sudoers ]; then touch /etc/sudoers; fi && \
    echo "suse ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

# Add suse user to runner group and create /etc/nix directory and configuration
RUN usermod -a -G runner suse && \
    sudo mkdir -p /etc/nix && \
    printf "build-users-group =\nsandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
    sudo chown -R suse:runner /etc/nix && \
    sudo mkdir -p /nix && \
    sudo chown -R suse:runner /nix && \
    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/profile.d/nix.sh && \
    echo 'source /home/suse/.nix-profile/etc/profile.d/nix.sh' > /etc/bash.bashrc.local

RUN case "${ARCH}" in \
        amd64) CHECKSUM="0a0462692a10ff1eb8a608f713f38d1f25a208ad55963a9c00b239da398de5a1" ;; \
        arm64) CHECKSUM="771e4b6f719243b9481f19eaedfbbbacc2f4a0282d6e043df4f33bb449ea3c57" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export INSTALL_DIR="/var/ci-tools/nix" && \
    mkdir -p "${INSTALL_DIR}" && \
    export TMP_FILE="${INSTALL_DIR}/nix.tar.xz" && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://releases.nixos.org/nix/nix-2.34.5/nix-2.34.5-x86_64-linux.tar.xz"; EXTRACT="nix-2.34.5-x86_64-linux/install" ;; \
        arm64) DOWNLOAD_URL="https://releases.nixos.org/nix/nix-2.34.5/nix-2.34.5-aarch64-linux.tar.xz"; EXTRACT="nix-2.34.5-aarch64-linux/install" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${INSTALL_DIR}/checksum.sha256" && \
    sha256sum -c "${INSTALL_DIR}/checksum.sha256" && \
    cd "${INSTALL_DIR}" && \
    tar xf "${TMP_FILE}" && \
    chmod -R a+rX . && \
    rm "${TMP_FILE}" "${INSTALL_DIR}/checksum.sha256"

# Post-install setup for nix
# Fix ownership and run Nix installer from the extracted archive
RUN set -e; \
    sudo chown -R suse:runner /var/ci-tools/nix

# Switch to unprivileged user for installation
USER suse
WORKDIR /home/suse
ENV USER=suse

RUN set -e; \
    case "${ARCH}" in \
        amd64) extract="nix-2.34.5-x86_64-linux/install" ;; \
        arm64) extract="nix-2.34.5-aarch64-linux/install" ;; \
        *) echo "unsupported architecture: ${ARCH}" >&2; exit 1 ;; \
    esac; \
    cd /var/ci-tools/nix && \
    ./${extract} --no-daemon

# Restore root user for remaining Dockerfile operations
USER root
ENV USER=root

# goreleaser v2.15.2
RUN case "${ARCH}" in \
        amd64) CHECKSUM="0ebdbf0353aba566b969dde746cc4e4806f96c27aa2f3971b229a9df7611fedc" ;; \
        arm64) CHECKSUM="5db66761a98f6693161e49e1a95d28d2673a892ba60cb4a5e16736cafd41c4c9" ;; \
        *) echo "Unsupported: ${ARCH}"; exit 1 ;; \
    esac && \
    export TMP_DIR=$(mktemp -d) && \
    export TMP_FILE="${TMP_DIR}/goreleaser.tar.gz" && \
    case "${ARCH}" in \
        amd64) DOWNLOAD_URL="https://github.com/goreleaser/goreleaser/releases/download/v2.15.2/goreleaser_Linux_x86_64.tar.gz"; EXTRACT="goreleaser" ;; \
        arm64) DOWNLOAD_URL="https://github.com/goreleaser/goreleaser/releases/download/v2.15.2/goreleaser_Linux_arm64.tar.gz"; EXTRACT="goreleaser" ;; \
    esac && \
    curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors "${DOWNLOAD_URL}" > "${TMP_FILE}" && \
    printf "%s  %s\n" "${CHECKSUM}" "${TMP_FILE}" > "${TMP_DIR}/checksum.sha256" && \
    sha256sum -c "${TMP_DIR}/checksum.sha256" && \
    tar xzf "${TMP_FILE}" -C "${TMP_DIR}" && \
    install "${TMP_DIR}/${EXTRACT}" "/usr/local/bin/goreleaser" && \
    rm -rf "${TMP_DIR}"

# Family selectors — copy scripts and set up manifest + active symlinks.
# /var/ci-tools/active is on PATH ahead of /usr/local/bin; runner can update
# the active symlink with: ci-select <family> <tool>  or  select-<family> <tool>
COPY dockerfiles/scripts/select-helm.sh /usr/local/bin/select-helm
COPY dockerfiles/scripts/ci-select.sh /usr/local/bin/ci-select
RUN chmod +x /usr/local/bin/select-helm && chmod +x /usr/local/bin/ci-select


# Set up CI tool family infrastructure (runner user and group created earlier).
RUN mkdir -p /var/ci-tools/active \
    && mkdir -p /usr/local/share/ci-tools/families/helm \
    && touch /usr/local/share/ci-tools/families/helm/helmv3 \
    && touch /usr/local/share/ci-tools/families/helm/helmv4 \
    && ln -sf helmv4 /usr/local/share/ci-tools/families/helm/default \
    && ln -sf /usr/local/bin/helmv4 /var/ci-tools/active/helm \
    && chown -R root:runner /var/ci-tools \
    && chmod 2775 /var/ci-tools/active

# We trust our base image and the repos that are pulled in workflows. Otherwise
# each workflow that uses our base images would have to add the step below.
RUN git config --system --add safe.directory '*'