forked from containerd/containerd
/
Dockerfile.test
100 lines (88 loc) · 3.95 KB
/
Dockerfile.test
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# This dockerfile is used to test containerd within a container
#
# usage:
# 1.) docker build -t containerd-test -f Dockerfile.test ../
# 2.) docker run -it --privileged -v /tmp:/tmp --tmpfs /var/lib/containerd-test containerd-test bash
# 3.) $ make binaries install test
#
# Use the RUNC_VERSION build-arg to build with a custom version of runc, for example,
# to build runc v1.0.0-rc94, use:
#
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
ARG GOLANG_VERSION=1.18.8
ARG GOLANG_IMAGE=golang
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
# Install runc
FROM golang AS runc
RUN apt-get update && apt-get install -y --no-install-recommends \
libseccomp-dev \
&& rm -rf /var/lib/apt/lists/*
COPY script/setup/runc-version script/setup/install-runc ./
# Allow overriding the version of runc to install through build-args
ARG RUNC_VERSION
ARG GOPROXY=direct
ARG DESTDIR=/build
RUN ./install-runc
FROM golang AS build-env
RUN apt-get update && apt-get install -y --no-install-recommends \
libbtrfs-dev \
btrfs-progs \
libseccomp-dev \
xfsprogs \
&& rm -rf /var/lib/apt/lists/*
RUN mkdir -p /go/src/github.com/containerd/containerd
WORKDIR /go/src/github.com/containerd/containerd
FROM golang AS cni
ENV DESTDIR=/build
COPY script/setup/install-cni ./
COPY go.mod /go/src/github.com/containerd/containerd/go.mod
RUN ./install-cni
FROM golang AS critools
ARG DESTDIR=/build
COPY script/setup/install-critools script/setup/critools-version ./
RUN GOBIN=$DESTDIR/usr/local/bin ./install-critools
FROM build-env AS containerd
ARG DESTDIR=/build
COPY . .
RUN make BUILDTAGS="no_btrfs no_devmapper" binaries install
# cri-in-userns stage is for testing "CRI-in-UserNS", which should be used in conjunction with
# "Kubelet-in-UserNS": https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless
# This feature is mostly expected to be used for `kind` and `minikube`.
#
# Requires Rootless Docker/Podman/nerdctl with cgroup v2 delegation: https://rootlesscontaine.rs/getting-started/common/cgroup2/
# (Rootless Docker/Podman/nerdctl prepares the UserNS, so we do not need to create UserNS by ourselves)
FROM build-env AS cri-in-userns
RUN apt-get update && apt-get install -y --no-install-recommends \
iptables \
&& rm -rf /var/lib/apt/lists/*
COPY contrib/Dockerfile.test.d/cri-in-userns/etc_containerd_config.toml /etc/containerd/config.toml
COPY contrib/Dockerfile.test.d/cri-in-userns/docker-entrypoint.sh /docker-entrypoint.sh
COPY --from=runc /build/ /
COPY --from=cni /build/ /
COPY --from=critools /build/ /
COPY --from=containerd /build/ /
VOLUME /var/lib/containerd
ENTRYPOINT ["/docker-entrypoint.sh"]
# Skip "runtime should support unsafe sysctls": `container init caused: write sysctl key fs.mqueue.msg_max: open /proc/sys/fs/mqueue/msg_max: permission denied`
# Skip "runtime should support safe sysctls": `container init caused: write sysctl key kernel.shm_rmid_forced: open /proc/sys/kernel/shm_rmid_forced: permission denied`
# Skip "should allow privilege escalation when (NoNewPrivis is) false": expected log "Effective uid: 0\n" (stream="stdout") not found in logs [{timestamp:{wall:974487519 ext:63761339984 loc:<nil>} stream:stdout log:Effective uid: 1000) }]
CMD ["critest", "--ginkgo.skip=should support unsafe sysctls|should support safe sysctls|should allow privilege escalation when false"]
# Install proto3
FROM golang AS proto3
ARG DESTDIR=/build
RUN apt-get update && apt-get install -y --no-install-recommends \
autoconf \
automake \
g++ \
libtool \
unzip \
&& rm -rf /var/lib/apt/lists/*
COPY script/setup/install-protobuf install-protobuf
RUN ./install-protobuf \
&& mkdir -p $DESTDIR/usr/local/bin $DESTDIR/usr/local/include \
&& mv /usr/local/bin/protoc $DESTDIR/usr/local/bin/protoc \
&& mv /usr/local/include/google $DESTDIR/usr/local/include/google
FROM build-env AS dev
COPY --from=proto3 /build/ /
COPY --from=runc /build/ /
COPY . .