jsvm/Dockerfile at main · yfe404/jsvm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# syntax=docker/dockerfile:1

# ---------------------------------------------------------------------------
# Stage 1: build libv8_monolith.a
#
# 25-40 min on 16 cores, ~15GB of scratch disk. Push this stage to a registry
# and pin it. You do not want it in the inner loop.
#
#   docker build --target v8src -t myreg/v8src:14.x .
#   docker push myreg/v8src:14.x
#
# Debian rather than Alpine deliberately: musl saves ~1MB on a 30MB static
# binary, and costs you the only toolchain configuration upstream tests.
# ---------------------------------------------------------------------------
FROM debian:bookworm-slim AS v8src

ARG V8_VERSION=14.0.126
ARG JOBS=

RUN apt-get update && apt-get install -y --no-install-recommends \
      git curl python3 xz-utils ca-certificates pkg-config \
      build-essential libglib2.0-dev libc6-dev binutils file \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /v8
ENV DEPOT_TOOLS_UPDATE=0
RUN git clone --depth=1 \
      https://chromium.googlesource.com/chromium/tools/depot_tools.git
ENV PATH=/v8/depot_tools:$PATH

# --no-history keeps this from pulling gigabytes of git objects.
RUN gclient config --unmanaged --name=v8 \
      https://chromium.googlesource.com/v8/v8.git \
 && gclient sync --no-history --shallow --revision=v8@$V8_VERSION

WORKDIR /v8/v8

# install-build-deps.py shells out to lsb_release and hard-fails without it;
# bookworm-slim does not ship it. sudo likewise: the script calls it even as
# root. Kept as its own step, after the sync, so editing it does not invalidate
# the multi-GB gclient layer above. Fold into the apt-get at the top if you are
# building from cold anyway.
RUN apt-get update && apt-get install -y --no-install-recommends \
      lsb-release sudo \
 && rm -rf /var/lib/apt/lists/*

# Pulls the bundled clang and the handful of system packages V8 needs.
RUN ./build/install-build-deps.sh --no-arm --no-nacl --no-chromeos-fonts \
      --no-prompt || ./build/install-build-deps.sh --no-prompt

COPY args.gn out/rel/args.gn
# The depot_tools `gn` and `ninja` are Python shims that demand a bootstrapped
# depot_tools (python3_bin_reldir.txt), which DEPOT_TOOLS_UPDATE=0 prevents.
# gclient sync already fetched the real binaries; call them directly.
RUN buildtools/linux64/gn gen out/rel \
 && third_party/ninja/ninja -C out/rel v8_monolith ${JOBS:+-j$JOBS} \
 && ls -la out/rel/obj/libv8_monolith.a

# ---------------------------------------------------------------------------
# Stage 2: build the embedder, generate the snapshot, relink, strip
# ---------------------------------------------------------------------------
FROM v8src AS embedder

WORKDIR /src
COPY Makefile ./
COPY src ./src

ENV V8_ROOT=/v8/v8 V8_OUT=out/rel

# Fails loudly if gn desc stopped producing the ABI defines.
RUN make verify-abi

RUN make -j$(nproc) all && make size

# Smoke tests run here, in a stage that still has a shell. The scratch image
# has no shell to test in.
RUN make check

# ---------------------------------------------------------------------------
# Stage 3: the actual image
#
# No libc, no shell, no /etc, no CA bundle. Docker still mounts /proc and /sys,
# which V8 needs for CPU count and page size.
# ---------------------------------------------------------------------------
FROM scratch

COPY --from=embedder /src/build/jsvm /jsvm

# Nonroot without /etc/passwd: numeric UID only.
USER 65532:65532

ENTRYPOINT ["/jsvm"]