github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-06-19 12:14:11 +00:00
Code Issues Projects Releases Wiki Activity

packaging: Allow passing a container builder to the scripts

Browse Source 
This, combined with the effort of caching builder images *and* only
performing the build itself inside the builder images, is the very first
step for reproducible builds for the project.

Reproducible builds are quite important when we talk about Confidential
Containers, as users may want to verify the content used / provided by
the CSPs, and this is the first step towards that direction.

Fixes: #5517

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio 2022-10-26 14:09:47 +02:00
parent 45668fae15
commit 781ed2986a
7 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh
View File

@ -51,6 +51,13 @@ docker run \
--env CI="${CI:-}" \ --env CI="${CI:-}" \
--env USER=${USER} \ --env USER=${USER} \
--env PUSH_TO_REGISTRY="${PUSH_TO_REGISTRY:-"no"}" \ --env PUSH_TO_REGISTRY="${PUSH_TO_REGISTRY:-"no"}" \
--env INITRAMFS_CONTAINER_BUILDER="${INITRAMFS_CONTAINER_BUILDER:-}" \
--env KERNEL_CONTAINER_BUILDER="${KERNEL_CONTAINER_BUILDER:-}" \
--env OVMF_CONTAINER_BUILDER="${OVMF_CONTAINER_BUILDER:-}" \
--env QEMU_CONTAINER_BUILDER="${QEMU_CONTAINER_BUILDER:-}" \
--env SHIM_V2_CONTAINER_BUILDER="${SHIM_V2_CONTAINER_BUILDER:-}" \
--env TDSHIM_CONTAINER_BUILDER="${TDSHIM_CONTAINER_BUILDER:-}" \
--env VIRTIOFSD_CONTAINER_BUILDER="${VIRTIOFSD_CONTAINER_BUILDER:-}" \
--rm \ --rm \
-w ${script_dir} \ -w ${script_dir} \
build-kata-deploy "${kata_deploy_create}" $@ build-kata-deploy "${kata_deploy_create}" $@

2
tools/packaging/static-build/kernel/build.sh
View File

@ -16,7 +16,7 @@ source "${script_dir}/../../scripts/lib.sh"
DESTDIR=${DESTDIR:-${PWD}} DESTDIR=${DESTDIR:-${PWD}}
PREFIX=${PREFIX:-/opt/kata} PREFIX=${PREFIX:-/opt/kata}
container_image="${BUILDER_REGISTRY}:kernel-$(get_last_modification ${repo_root_dir} ${script_dir})-$(umame -m)" container_image="${KERNEL_CONTAINER_BUILDER:-${BUILDER_REGISTRY}:kernel-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)}"
sudo docker pull ${container_image} || \ sudo docker pull ${container_image} || \
(sudo docker build -t "${container_image}" "${script_dir}" && \ (sudo docker build -t "${container_image}" "${script_dir}" && \

2
tools/packaging/static-build/ovmf/build.sh
View File

@ -16,7 +16,7 @@ source "${script_dir}/../../scripts/lib.sh"
DESTDIR=${DESTDIR:-${PWD}} DESTDIR=${DESTDIR:-${PWD}}
PREFIX=${PREFIX:-/opt/kata} PREFIX=${PREFIX:-/opt/kata}
container_image="${BUILDER_REGISTRY}:ovmf-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)" container_image="${OVMF_CONTAINER_BUILDER:-${BUILDER_REGISTRY}:ovmf-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)}"
ovmf_build="${ovmf_build:-x86_64}" ovmf_build="${ovmf_build:-x86_64}"
kata_version="${kata_version:-}" kata_version="${kata_version:-}"
ovmf_repo="${ovmf_repo:-}" ovmf_repo="${ovmf_repo:-}"

2
tools/packaging/static-build/qemu/build-base-qemu.sh
View File

@ -39,7 +39,7 @@ CACHE_TIMEOUT=$(date +"%Y-%m-%d")
[ -n "${build_suffix}" ] && HYPERVISOR_NAME="kata-qemu-${build_suffix}" || HYPERVISOR_NAME="kata-qemu" [ -n "${build_suffix}" ] && HYPERVISOR_NAME="kata-qemu-${build_suffix}" || HYPERVISOR_NAME="kata-qemu"
[ -n "${build_suffix}" ] && PKGVERSION="kata-static-${build_suffix}" || PKGVERSION="kata-static" [ -n "${build_suffix}" ] && PKGVERSION="kata-static-${build_suffix}" || PKGVERSION="kata-static"
container_image="${BUILDER_REGISTRY}:qemu-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)" container_image="${QEMU_CONTAINER_BUILDER:-${BUILDER_REGISTRY}:qemu-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)}"
sudo docker pull ${container_image} || (sudo "${container_engine}" build \ sudo docker pull ${container_image} || (sudo "${container_engine}" build \
--build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \ --build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \

2
tools/packaging/static-build/shim-v2/build.sh
View File

@ -20,7 +20,7 @@ RUST_VERSION=${RUST_VERSION}
DESTDIR=${DESTDIR:-${PWD}} DESTDIR=${DESTDIR:-${PWD}}
PREFIX=${PREFIX:-/opt/kata} PREFIX=${PREFIX:-/opt/kata}
container_image="${BUILDER_REGISTRY}:shim-v2-go-${GO_VERSION}-rust-${RUST_VERSION}-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)" container_image="${SHIM_V2_CONTAINER_BUILDER:-${BUILDER_REGISTRY}:shim-v2-go-${GO_VERSION}-rust-${RUST_VERSION}-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)}"
sudo docker pull ${container_image} || \ sudo docker pull ${container_image} || \
(sudo docker build \ (sudo docker build \

3
tools/packaging/static-build/td-shim/build.sh
View File

@ -30,7 +30,7 @@ package_output_dir="${package_output_dir:-}"
[ -n "${tdshim_version}" ] || die "Failed to get TD-shim version or commit" [ -n "${tdshim_version}" ] || die "Failed to get TD-shim version or commit"
[ -n "${tdshim_toolchain}" ] || die "Failed to get TD-shim toolchain to be used to build the project" [ -n "${tdshim_toolchain}" ] || die "Failed to get TD-shim toolchain to be used to build the project"
container_image="${BUILDER_REGISTRY}:td-shim-${tdshim_toolchain}-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)" container_image="${TDSHIM_CONTAINER_BUILDER:-${BUILDER_REGISTRY}:td-shim-${tdshim_toolchain}-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)}"
sudo docker pull ${container_image} || (sudo docker build \ sudo docker pull ${container_image} || (sudo docker build \
--build-arg RUST_TOOLCHAIN="${tdshim_toolchain}" \ --build-arg RUST_TOOLCHAIN="${tdshim_toolchain}" \
@ -39,7 +39,6 @@ sudo docker pull ${container_image} || (sudo docker build \
# No-op unless PUSH_TO_REGISTRY is exported as "yes" # No-op unless PUSH_TO_REGISTRY is exported as "yes"
push_to_registry "${container_image}") push_to_registry "${container_image}")
sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
-w "${PWD}" \ -w "${PWD}" \
--env DESTDIR="${DESTDIR}" \ --env DESTDIR="${DESTDIR}" \

2
tools/packaging/static-build/virtiofsd/build.sh
View File

@ -49,7 +49,7 @@ case ${ARCH} in
;; ;;
esac esac
container_image="${BUILDER_REGISTRY}:virtiofsd-${virtiofsd_toolchain}-${libc}-$(get_last_modification ${repo_root_dir} ${script_dir})-$(umame -m)" container_image="${VIRTIOFSD_CONTAINER_BUILDER:-${BUILDER_REGISTRY}:virtiofsd-${virtiofsd_toolchain}-${libc}-$(get_last_modification ${repo_root_dir} ${script_dir})-$(uname -m)}"
sudo docker pull ${container_image} || \ sudo docker pull ${container_image} || \
(sudo docker build \ (sudo docker build \