Merge pull request #3682 from Jakob-Naucke/cross

Multistrap Ubuntu & enable cross-building guest
This commit is contained in:
James O. D. Hunt
2022-03-21 11:11:47 +00:00
committed by GitHub
17 changed files with 106 additions and 377 deletions

View File

@@ -36,7 +36,4 @@ RUN zypper --non-interactive refresh; \
zypper --non-interactive clean --all;
# This will install the proper golang to build Kata components
@INSTALL_MUSL@
@INSTALL_GO@
@INSTALL_RUST@

View File

@@ -6,7 +6,7 @@
ARG IMAGE_REGISTRY=docker.io
FROM ${IMAGE_REGISTRY}/alpine:3.15
RUN apk update && apk add \
RUN apk update && apk add --no-cache \
apk-tools-static \
autoconf \
automake \
@@ -26,3 +26,5 @@ RUN apk update && apk add \
musl-dev \
protoc \
tar
# aarch64 requires this name -- link for all
RUN ln -s /usr/bin/gcc "/usr/bin/$(uname -m)-linux-musl-gcc"

View File

@@ -37,5 +37,4 @@ RUN dnf -y update && dnf install -y \
dnf clean all
# This will install the proper packages to build Kata components
@INSTALL_MUSL@
@INSTALL_RUST@

View File

@@ -1,34 +0,0 @@
#
# Copyright (c) 2020 ARM Limited
#
# SPDX-License-Identifier: Apache-2.0
ARG IMAGE_REGISTRY=docker.io
# NOTE: OS_VERSION is set according to config.sh
FROM ${IMAGE_REGISTRY}/debian:@OS_VERSION@
# RUN commands
RUN apt-get update && apt-get install -y \
autoconf \
automake \
binutils \
build-essential \
chrony \
coreutils \
curl \
debianutils \
debootstrap \
g++ \
gcc \
git \
libc-dev \
libstdc++-8-dev \
m4 \
make \
sed \
systemd \
tar \
vim
# This will install the proper packages to build Kata components
@INSTALL_MUSL@
@INSTALL_RUST@

View File

@@ -27,14 +27,14 @@ RUN apt-get update && apt-get --no-install-recommends install -y \
libstdc++-8-dev \
m4 \
make \
musl \
musl-dev \
musl-tools \
sed \
systemd \
tar \
vim \
wget
# aarch64 requires this name -- link for all
RUN ln -s /usr/bin/musl-gcc "/usr/bin/$(uname -m)-linux-musl-gcc"
# This will install the proper packages to build Kata components
@INSTALL_RUST@

View File

@@ -14,7 +14,6 @@ script_name="${0##*/}"
script_dir="$(dirname $(readlink -f $0))"
AGENT_VERSION=${AGENT_VERSION:-}
RUST_VERSION="null"
MUSL_VERSION=${MUSL_VERSION:-"null"}
AGENT_BIN=${AGENT_BIN:-kata-agent}
AGENT_INIT=${AGENT_INIT:-no}
KERNEL_MODULES_DIR=${KERNEL_MODULES_DIR:-""}
@@ -40,7 +39,11 @@ handle_error() {
trap 'handle_error $LINENO' ERR
# Default architecture
ARCH=$(uname -m)
export ARCH=${ARCH:-$(uname -m)}
if [ "$ARCH" == "ppc64le" ] || [ "$ARCH" == "s390x" ]; then
LIBC=gnu
echo "WARNING: Forcing LIBC=gnu because $ARCH has no musl Rust target"
fi
# distro-specific config file
typeset -r CONFIG_SH="config.sh"
@@ -104,6 +107,11 @@ AGENT_SOURCE_BIN Path to the directory of agent binary.
AGENT_VERSION Version of the agent to include in the rootfs.
Default value: ${AGENT_VERSION:-<not set>}
ARCH Target architecture (according to \`uname -m\`).
Foreign bootstraps are currently only supported for Ubuntu
and glibc agents.
Default value: $(uname -m)
DISTRO_REPO Use host repositories to install guest packages.
Default value: <not set>
@@ -125,6 +133,9 @@ KERNEL_MODULES_DIR Path to a directory containing kernel modules to include in
the rootfs.
Default value: <empty>
LIBC libc the agent is built against (gnu or musl).
Default value: ${LIBC} (varies with architecture)
ROOTFS_DIR Path to the directory that is populated with the rootfs.
Default value: <${script_name} path>/rootfs-<DISTRO-name>
@@ -335,11 +346,6 @@ build_rootfs_distro()
echo "Required rust version: $RUST_VERSION"
detect_musl_version ||
die "Could not detect the required musl version for AGENT_VERSION='${AGENT_VERSION:-main}'."
echo "Required musl version: $MUSL_VERSION"
if [ -z "${USE_DOCKER}" ] && [ -z "${USE_PODMAN}" ]; then
info "build directly"
build_rootfs ${ROOTFS_DIR}
@@ -411,8 +417,10 @@ build_rootfs_distro()
--env ROOTFS_DIR="/rootfs" \
--env AGENT_BIN="${AGENT_BIN}" \
--env AGENT_INIT="${AGENT_INIT}" \
--env ARCH="${ARCH}" \
--env CI="${CI}" \
--env KERNEL_MODULES_DIR="${KERNEL_MODULES_DIR}" \
--env LIBC="${LIBC}" \
--env EXTRA_PKGS="${EXTRA_PKGS}" \
--env OSBUILDER_VERSION="${OSBUILDER_VERSION}" \
--env OS_VERSION="${OS_VERSION}" \
@@ -540,11 +548,6 @@ EOF
AGENT_DEST="${AGENT_DIR}/${AGENT_BIN}"
if [ -z "${AGENT_SOURCE_BIN}" ] ; then
if [ "$ARCH" == "ppc64le" ] || [ "$ARCH" == "s390x" ]; then
LIBC=gnu
echo "WARNING: Forcing LIBC=gnu because $ARCH has no musl Rust target"
fi
[ "$LIBC" == "musl" ] && bash ${script_dir}/../../../ci/install_musl.sh
test -r "${HOME}/.cargo/env" && source "${HOME}/.cargo/env"
# rust agent needs ${arch}-unknown-linux-${LIBC}
if ! (rustup show | grep -v linux-${LIBC} > /dev/null); then
@@ -555,7 +558,6 @@ EOF
bash ${script_dir}/../../../ci/install_rust.sh ${RUST_VERSION}
fi
test -r "${HOME}/.cargo/env" && source "${HOME}/.cargo/env"
[ "$ARCH" == "aarch64" ] && OLD_PATH=$PATH && export PATH=$PATH:/usr/local/musl/bin
agent_dir="${script_dir}/../../../src/agent/"
@@ -563,7 +565,7 @@ EOF
info "Set up libseccomp"
libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
bash ${script_dir}/../../../ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
${script_dir}/../../../ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
export LIBSECCOMP_LINK_TYPE=static
export LIBSECCOMP_LIB_PATH="${libseccomp_install_dir}/lib"
@@ -577,7 +579,6 @@ EOF
make clean
make LIBC=${LIBC} INIT=${AGENT_INIT} SECCOMP=${SECCOMP}
make install DESTDIR="${ROOTFS_DIR}" LIBC=${LIBC} INIT=${AGENT_INIT}
[ "$ARCH" == "aarch64" ] && export PATH=$OLD_PATH && rm -rf /usr/local/musl
if [ "${SECCOMP}" == "yes" ]; then
rm -rf "${libseccomp_install_dir}" "${gperf_install_dir}"
fi

View File

@@ -14,5 +14,4 @@ FROM ${IMAGE_REGISTRY}/@distro@:@OS_VERSION@
# RUN commands
# This will install the proper packages to build Kata components
@INSTALL_MUSL@
@INSTALL_RUST@

View File

@@ -1,43 +0,0 @@
#
# Copyright (c) 2020 ARM Limited
#
# SPDX-License-Identifier: Apache-2.0
ARG IMAGE_REGISTRY=docker.io
#ubuntu: docker image to be used to create a rootfs
#@OS_VERSION@: Docker image version to build this dockerfile
FROM ${IMAGE_REGISTRY}/ubuntu:@OS_VERSION@
# This dockerfile needs to provide all the componets need to build a rootfs
# Install any package need to create a rootfs (package manager, extra tools)
# Avoid tzdata setup
ENV DEBIAN_FRONTEND noninteractive
# RUN commands
RUN apt-get update && apt-get install -y \
autoconf \
automake \
binutils \
build-essential \
chrony \
coreutils \
curl \
debianutils \
debootstrap \
g++ \
gcc \
git \
libc6-dev \
libstdc++-8-dev \
m4 \
make \
sed \
systemd \
tar \
vim && \
apt-get clean && rm -rf /var/lib/apt/lists/
# This will install the proper packages to build Kata components
@INSTALL_MUSL@
@INSTALL_RUST@

View File

@@ -1,45 +1,29 @@
#
# Copyright (c) 2018 Yash Jain
# Copyright (c) 2018 Yash Jain, 2022 IBM Corp.
#
# SPDX-License-Identifier: Apache-2.0
ARG IMAGE_REGISTRY=docker.io
#ubuntu: docker image to be used to create a rootfs
#@OS_VERSION@: Docker image version to build this dockerfile
FROM ${IMAGE_REGISTRY}/ubuntu:@OS_VERSION@
@SET_PROXY@
# This dockerfile needs to provide all the componets need to build a rootfs
# Install any package need to create a rootfs (package manager, extra tools)
# RUN commands
RUN apt-get update && apt-get --no-install-recommends install -y \
apt-utils \
autoconf \
automake \
binutils \
build-essential \
RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive \
apt-get --no-install-recommends -y install \
ca-certificates \
chrony \
coreutils \
curl \
debianutils \
debootstrap \
g++ \
gcc \
$(gcc_arch="@ARCH@" && [ "$(uname -m)" != "$gcc_arch" ] && ( \
libc_arch="$gcc_arch" && \
[ "$gcc_arch" = aarch64 ] && libc_arch=arm64; \
[ "$gcc_arch" = ppc64le ] && gcc_arch=powerpc64le && libc_arch=ppc64el; \
[ "$gcc_arch" = x86_64 ] && gcc_arch=x86-64 && libc_arch=amd64; \
echo "gcc-$gcc_arch-linux-gnu libc6-dev-$libc_arch-cross")) \
git \
libc6-dev \
libstdc++-8-dev \
m4 \
make \
musl \
musl-dev \
multistrap \
musl-tools \
protobuf-compiler \
sed \
systemd \
tar \
vim \
wget
protobuf-compiler
# aarch64 requires this name -- link for all
RUN ln -s /usr/bin/musl-gcc "/usr/bin/$(uname -m)-linux-musl-gcc"
# This will install the proper packages to build Kata components
@INSTALL_RUST@

View File

@@ -1,34 +1,28 @@
# This is a configuration file add extra variables to
#
# Copyright (c) 2018 Yash Jain
# Copyright (c) 2018 Yash Jain, 2022 IBM Corp.
#
# SPDX-License-Identifier: Apache-2.0
# be used by build_rootfs() from rootfs_lib.sh the variables will be
# loaded just before call the function. For more information see the
# rootfs-builder/README.md file.
OS_VERSION=${OS_VERSION:-20.04}
OS_NAME=ubuntu
# This should be Ubuntu's code name, e.g. "focal" (Focal Fossa) for 20.04
OS_NAME=${OS_NAME:-"focal"}
OS_VERSION=${OS_VERSION:-focal}
PACKAGES=chrony
[ "$AGENT_INIT" = no ] && PACKAGES+=" init"
[ "$SECCOMP" = yes ] && PACKAGES+=" libseccomp2"
REPO_URL=http://ports.ubuntu.com
# packages to be installed by default
PACKAGES="systemd coreutils init kmod"
EXTRA_PKGS+=" chrony"
DEBOOTSTRAP=${PACKAGE_MANAGER:-"debootstrap"}
case $(uname -m) in
x86_64) ARCHITECTURE="amd64";;
ppc64le) ARCHITECTURE="ppc64el";;
aarch64) ARCHITECTURE="arm64";;
s390x) ARCHITECTURE="s390x";;
(*) die "$(uname -m) not supported "
case "$ARCH" in
aarch64) DEB_ARCH=arm64;;
ppc64le) DEB_ARCH=ppc64el;;
s390x) DEB_ARCH="$ARCH";;
x86_64) DEB_ARCH=amd64; REPO_URL=http://archive.ubuntu.com/ubuntu;;
*) die "$ARCH not supported"
esac
# Init process must be one of {systemd,kata-agent}
INIT_PROCESS=systemd
# List of zero or more architectures to exclude from build,
# as reported by `uname -m`
ARCH_EXCLUDE_LIST=()
[ "$SECCOMP" = "yes" ] && PACKAGES+=" libseccomp2" || true
if [ "$(uname -m)" != "$ARCH" ]; then
case "$ARCH" in
ppc64le) cc_arch=powerpc64le;;
x86_64) cc_arch=x86-64;;
*) cc_arch="$ARCH"
esac
export CC="$cc_arch-linux-gnu-gcc"
fi

View File

@@ -1,78 +1,29 @@
# - Arguments
#
# Copyright (c) 2018 Yash Jain
# Copyright (c) 2018 Yash Jain, 2022 IBM Corp.
#
# SPDX-License-Identifier: Apache-2.0
#
#
# rootfs_dir=$1
#
# - Optional environment variables
#
# EXTRA_PKGS: Variable to add extra PKGS provided by the user
#
# BIN_AGENT: Name of the Kata-Agent binary
#
# REPO_URL: URL to distribution repository ( should be configured in
# config.sh file)
#
# Any other configuration variable for a specific distro must be added
# and documented on its own config.sh
#
# - Expected result
#
# rootfs_dir populated with rootfs pkgs
# It must provide a binary in /sbin/init
#
build_rootfs() {
# Mandatory
local ROOTFS_DIR=$1
local rootfs_dir=$1
local multistrap_conf=multistrap.conf
# Name of the Kata-Agent binary
local BIN_AGENT=${BIN_AGENT}
# For simplicity's sake, use multistrap for foreign and native bootstraps.
cat > "$multistrap_conf" << EOF
[General]
cleanup=true
aptsources=Ubuntu
bootstrap=Ubuntu
# In case of support EXTRA packages, use it to allow
# users to add more packages to the base rootfs
local EXTRA_PKGS=${EXTRA_PKGS:-}
[Ubuntu]
source=$REPO_URL
keyring=ubuntu-keyring
suite=focal
packages=$PACKAGES $EXTRA_PKGS
EOF
multistrap -a "$DEB_ARCH" -d "$rootfs_dir" -f "$multistrap_conf"
rm -rf "$rootfs_dir/var/run"
ln -s /run "$rootfs_dir/var/run"
cp --remove-destination /etc/resolv.conf "$rootfs_dir/etc"
# In case rootfs is created using repositories allow user to modify
# the default URL
local REPO_URL=${REPO_URL:-YOUR_REPO}
# PATH where files this script is placed
# Use it to refer to files in the same directory
# Example: ${CONFIG_DIR}/foo
local CONFIG_DIR=${CONFIG_DIR}
# Populate ROOTFS_DIR
# Must provide /sbin/init and /bin/${BIN_AGENT}
DEBOOTSTRAP="debootstrap"
check_root
mkdir -p "${ROOTFS_DIR}"
if [ -n "${PKG_MANAGER}" ]; then
info "debootstrap path provided by user: ${PKG_MANAGER}"
elif check_program $DEBOOTSTRAP ; then
PKG_MANAGER=$DEBOOTSTRAP
else
die "$DEBOOTSTRAP is not installed"
fi
# trim whitespace
PACKAGES=$(echo $PACKAGES |xargs )
# add comma as debootstrap needs , separated package names.
# Don't change $PACKAGES in config.sh to include ','
# This is done to maintain consistency
PACKAGES=$(echo $PACKAGES | sed -e 's/ /,/g' )
${PKG_MANAGER} --variant=minbase \
--arch=${ARCHITECTURE}\
--include="$PACKAGES" \
${OS_NAME} \
${ROOTFS_DIR}
[ -n "${EXTRA_PKGS}" ] && chroot $ROOTFS_DIR apt-get install -y ${EXTRA_PKGS}
# Reduce image size and memory footprint
# removing not needed files and directories.
chroot $ROOTFS_DIR rm -rf /usr/share/{bash-completion,bug,doc,info,lintian,locale,man,menu,misc,pixmaps,terminfo,zoneinfo,zsh}
# Reduce image size and memory footprint by removing unnecessary files and directories.
rm -rf $rootfs_dir/usr/share/{bash-completion,bug,doc,info,lintian,locale,man,menu,misc,pixmaps,terminfo,zsh}
}

View File

@@ -7,7 +7,6 @@
set -e
KATA_REPO=${KATA_REPO:-github.com/kata-containers/kata-containers}
MUSL_VERSION=${MUSL_VERSION:-"null"}
# Give preference to variable set by CI
yq_file="${script_dir}/../../../ci/install_yq.sh"
kata_versions_file="${script_dir}/../../../versions.yaml"
@@ -204,107 +203,27 @@ generate_dockerfile()
dir="$1"
[ -d "${dir}" ] || die "${dir}: not a directory"
local architecture=$(uname -m)
local rustarch=${architecture}
local muslarch=${architecture}
local libc=musl
case "$(uname -m)" in
"ppc64le")
rustarch=powerpc64le
muslarch=powerpc64
libc=gnu
;;
"s390x")
libc=gnu
;;
*)
;;
esac
local rustarch="$ARCH"
[ "$ARCH" = ppc64le ] && rustarch=powerpc64le
[ -n "${http_proxy:-}" ] && readonly set_proxy="RUN sed -i '$ a proxy="${http_proxy:-}"' /etc/dnf/dnf.conf /etc/yum.conf; true"
# Rust agent
# rust installer should set path apropiately, just in case
# install musl for compiling rust-agent
local musl_source_url="https://git.zv.io/toolchains/musl-cross-make.git"
local musl_source_dir="musl-cross-make"
install_musl=
if [ "${muslarch}" == "aarch64" ]; then
local musl_tar="${muslarch}-linux-musl-native.tgz"
local musl_dir="${muslarch}-linux-musl-native"
local aarch64_musl_target="aarch64-linux-musl"
install_musl="
RUN cd /tmp; \
mkdir -p /usr/local/musl/; \
if curl -sLO --fail https://musl.cc/${musl_tar}; then \
tar -zxf ${musl_tar}; \
cp -r ${musl_dir}/* /usr/local/musl/; \
else \
git clone ${musl_source_url}; \
TARGET=${aarch64_musl_target} make -j$(nproc) -C ${musl_source_dir} install; \
cp -r ${musl_source_dir}/output/* /usr/local/musl/; \
cp /usr/local/musl/bin/aarch64-linux-musl-g++ /usr/local/musl/bin/g++; \
fi
ENV PATH=\$PATH:/usr/local/musl/bin
RUN ln -sf /usr/local/musl/bin/g++ /usr/bin/g++
"
else
local musl_tar="musl-${MUSL_VERSION}.tar.gz"
local musl_dir="musl-${MUSL_VERSION}"
install_musl="
RUN pushd /root; \
curl -sLO https://www.musl-libc.org/releases/${musl_tar}; tar -zxf ${musl_tar}; \
cd ${musl_dir}; \
sed -i \"s/^ARCH = .*/ARCH = ${muslarch}/g\" dist/config.mak; \
./configure > /dev/null 2>\&1; \
make > /dev/null 2>\&1; \
make install > /dev/null 2>\&1; \
echo \"/usr/local/musl/lib\" > /etc/ld-musl-${muslarch}.path; \
popd
ENV PATH=\$PATH:/usr/local/musl/bin
"
fi
readonly install_rust="
RUN curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSLf --output /tmp/rust-init; \
chmod a+x /tmp/rust-init; \
export http_proxy=${http_proxy:-}; \
export https_proxy=${http_proxy:-}; \
/tmp/rust-init -y --default-toolchain ${RUST_VERSION}
RUN . /root/.cargo/env; \
export http_proxy=${http_proxy:-}; \
export https_proxy=${http_proxy:-}; \
cargo install cargo-when; \
rustup target install ${rustarch}-unknown-linux-${libc}
RUN ln -sf /usr/bin/g++ /bin/musl-g++
ENV http_proxy=${http_proxy:-}
ENV https_proxy=${http_proxy:-}
RUN curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSLf | \
sh -s -- -y --default-toolchain ${RUST_VERSION} -t ${rustarch}-unknown-linux-${LIBC}
RUN . /root/.cargo/env; cargo install cargo-when
"
pushd "${dir}"
dockerfile_template="Dockerfile.in"
dockerfile_arch_template="Dockerfile-${architecture}.in"
# if arch-specific docker file exists, swap the univesal one with it.
if [ -f "${dockerfile_arch_template}" ]; then
dockerfile_template="${dockerfile_arch_template}"
else
[ -f "${dockerfile_template}" ] || die "${dockerfile_template}: file not found"
fi
# ppc64le and s390x have no musl target
if [ "${architecture}" == "ppc64le" ] || [ "${architecture}" == "s390x" ]; then
sed \
-e "s|@OS_VERSION@|${OS_VERSION:-}|g" \
-e "s|@INSTALL_MUSL@||g" \
-e "s|@INSTALL_RUST@|${install_rust//$'\n'/\\n}|g" \
-e "s|@SET_PROXY@|${set_proxy:-}|g" \
"${dockerfile_template}" > Dockerfile
else
sed \
-e "s|@OS_VERSION@|${OS_VERSION:-}|g" \
-e "s|@INSTALL_MUSL@|${install_musl//$'\n'/\\n}|g" \
-e "s|@INSTALL_RUST@|${install_rust//$'\n'/\\n}|g" \
-e "s|@SET_PROXY@|${set_proxy:-}|g" \
"${dockerfile_template}" > Dockerfile
fi
sed \
-e "s#@OS_VERSION@#${OS_VERSION:-}#g" \
-e "s#@ARCH@#$ARCH#g" \
-e "s#@INSTALL_RUST@#${install_rust//$'\n'/\\n}#g" \
-e "s#@SET_PROXY@#${set_proxy:-}#g" \
Dockerfile.in > Dockerfile
popd
}
@@ -345,17 +264,6 @@ detect_rust_version()
[ -n "$RUST_VERSION" ]
}
detect_musl_version()
{
info "Detecting musl version"
local yq_path="externals.musl.version"
info "Get musl version from ${kata_versions_file}"
MUSL_VERSION="$(get_package_version_from_kata_yaml "$yq_path")"
[ -n "$MUSL_VERSION" ]
}
before_starting_container() {
return 0
}

View File

@@ -640,8 +640,6 @@ test_dracut()
die "Could not detect the required Go version for AGENT_VERSION='${AGENT_VERSION:-master}'."
detect_rust_version ||
die "Could not detect the required rust version for AGENT_VERSION='${AGENT_VERSION:-master}'."
detect_musl_version ||
die "Could not detect the required musl version for AGENT_VERSION='${AGENT_VERSION:-master}'."
generate_dockerfile ${dracut_dir}
info "Creating container for dracut"