mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-01-24 22:15:40 +00:00
kata-deploy: Switch to the rust version
Let's remove the script and rely only on the rust version from now on. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
This commit is contained in:
Fabiano Fidêncio
@@ -1,11 +1,8 @@
|
||||
# Copyright Intel Corporation, 2022 IBM Corp.
|
||||
# Copyright (c) 2025 NVIDIA Corporation
|
||||
#
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
ARG BASE_IMAGE_NAME=alpine
|
||||
ARG BASE_IMAGE_TAG=3.22
|
||||
FROM ${BASE_IMAGE_NAME}:${BASE_IMAGE_TAG} AS base
|
||||
|
||||
#### Nydus snapshotter & nydus image
|
||||
|
||||
FROM golang:1.24-alpine AS nydus-binary-downloader
|
||||
@@ -17,53 +14,219 @@ ARG NYDUS_SNAPSHOTTER_REPO=https://github.com/containerd/nydus-snapshotter
|
||||
|
||||
RUN \
|
||||
mkdir -p /opt/nydus-snapshotter && \
|
||||
ARCH=$(uname -m) && \
|
||||
if [[ "${ARCH}" == "x86_64" ]]; then ARCH=amd64 ; fi && \
|
||||
if [[ "${ARCH}" == "aarch64" ]]; then ARCH=arm64; fi && \
|
||||
ARCH="$(uname -m)" && \
|
||||
if [ "${ARCH}" = "x86_64" ]; then ARCH=amd64 ; fi && \
|
||||
if [ "${ARCH}" = "aarch64" ]; then ARCH=arm64; fi && \
|
||||
apk add --no-cache curl && \
|
||||
curl -fOL --progress-bar ${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz && \
|
||||
tar xvzpf nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz -C /opt/nydus-snapshotter && \
|
||||
rm nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz
|
||||
curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" && \
|
||||
tar xvzpf "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" -C /opt/nydus-snapshotter && \
|
||||
rm "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"
|
||||
|
||||
#### Build binary package
|
||||
FROM ubuntu:22.04 AS rust-builder
|
||||
|
||||
#### kata-deploy main image
|
||||
# Default to Rust 1.90.0
|
||||
ARG RUST_TOOLCHAIN=1.90.0
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
ENV RUSTUP_HOME="/opt/rustup"
|
||||
ENV CARGO_HOME="/opt/cargo"
|
||||
ENV PATH="/opt/cargo/bin/:${PATH}"
|
||||
|
||||
# kata-deploy args
|
||||
FROM base
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
|
||||
ARG KATA_ARTIFACTS=./kata-static.tar.zst
|
||||
RUN \
|
||||
mkdir ${RUSTUP_HOME} ${CARGO_HOME} && \
|
||||
chmod -R a+rwX ${RUSTUP_HOME} ${CARGO_HOME}
|
||||
|
||||
RUN \
|
||||
apt-get update && \
|
||||
apt-get --no-install-recommends -y install \
|
||||
ca-certificates \
|
||||
curl \
|
||||
gcc \
|
||||
libc6-dev \
|
||||
musl-tools && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists/ && \
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN}
|
||||
|
||||
WORKDIR /kata-deploy
|
||||
|
||||
# Copy standalone binary project
|
||||
COPY binary /kata-deploy
|
||||
|
||||
# Install target and run tests based on architecture
|
||||
# - AMD64/arm64: use musl for fully static binaries
|
||||
# - PPC64le/s390x: use glibc (musl has issues on these platforms)
|
||||
RUN \
|
||||
HOST_ARCH="$(uname -m)"; \
|
||||
rust_arch=""; \
|
||||
rust_target=""; \
|
||||
case "${HOST_ARCH}" in \
|
||||
"x86_64") \
|
||||
rust_arch="x86_64"; \
|
||||
rust_target="${rust_arch}-unknown-linux-musl"; \
|
||||
echo "Installing musl target for ${rust_target}"; \
|
||||
rustup target add "${rust_target}"; \
|
||||
;; \
|
||||
"aarch64") \
|
||||
rust_arch="aarch64"; \
|
||||
rust_target="${rust_arch}-unknown-linux-musl"; \
|
||||
echo "Installing musl target for ${rust_target}"; \
|
||||
rustup target add "${rust_target}"; \
|
||||
;; \
|
||||
"ppc64le") \
|
||||
rust_arch="powerpc64le"; \
|
||||
rust_target="${rust_arch}-unknown-linux-gnu"; \
|
||||
echo "Using glibc target for ${rust_target} (musl is not well supported on ppc64le)"; \
|
||||
;; \
|
||||
"s390x") \
|
||||
rust_arch="s390x"; \
|
||||
rust_target="${rust_arch}-unknown-linux-gnu"; \
|
||||
echo "Using glibc target for ${rust_target} (musl is not well supported on s390x)"; \
|
||||
;; \
|
||||
*) echo "Unsupported architecture: ${HOST_ARCH}" && exit 1 ;; \
|
||||
esac; \
|
||||
echo "${rust_target}" > /tmp/rust_target
|
||||
|
||||
# Run tests using --test-threads=1 to prevent environment variable pollution between tests,
|
||||
# and this is fine as we'll never ever have multiple binaries running at the same time.
|
||||
RUN \
|
||||
rust_target="$(cat /tmp/rust_target)"; \
|
||||
echo "Running binary tests with target ${rust_target}..." && \
|
||||
RUSTFLAGS="-D warnings" cargo test --target "${rust_target}" -- --test-threads=1 && \
|
||||
echo "All tests passed!"
|
||||
|
||||
RUN \
|
||||
rust_target="$(cat /tmp/rust_target)"; \
|
||||
echo "Building kata-deploy binary for ${rust_target}..." && \
|
||||
RUSTFLAGS="-D warnings" cargo build --release --target "${rust_target}" && \
|
||||
mkdir -p /kata-deploy/bin && \
|
||||
cp "/kata-deploy/target/${rust_target}/release/kata-deploy" /kata-deploy/bin/kata-deploy && \
|
||||
echo "Cleaning up build artifacts to save disk space..." && \
|
||||
rm -rf /kata-deploy/target && \
|
||||
cargo clean
|
||||
|
||||
#### Extract kata artifacts
|
||||
FROM alpine:3.22 AS artifact-extractor
|
||||
|
||||
ARG KATA_ARTIFACTS=kata-static.tar.zst
|
||||
ARG DESTINATION=/opt/kata-artifacts
|
||||
|
||||
COPY ${KATA_ARTIFACTS} /
|
||||
|
||||
# I understand that in order to be on the safer side, it'd
|
||||
# be good to have the alpine packages pointing to a very
|
||||
# specific version, but this may break anyone else trying
|
||||
# to use a different version of alpine for one reason or
|
||||
# another. With this in mind, let's ignore DL3018.
|
||||
# SC2086 is about using double quotes to prevent globbing and
|
||||
# word splitting, which can also be ignored for now.
|
||||
# hadolint ignore=DL3018,SC2086
|
||||
COPY ${KATA_ARTIFACTS} /tmp/
|
||||
RUN \
|
||||
apk --no-cache add bash curl tar zstd && \
|
||||
ARCH=$(uname -m) && \
|
||||
if [ "${ARCH}" = "x86_64" ]; then ARCH=amd64; fi && \
|
||||
if [ "${ARCH}" = "aarch64" ]; then ARCH=arm64; fi && \
|
||||
DEBIAN_ARCH=${ARCH} && \
|
||||
if [ "${DEBIAN_ARCH}" = "ppc64le" ]; then DEBIAN_ARCH=ppc64el; fi && \
|
||||
curl -fL --progress-bar -o /usr/bin/kubectl https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl && \
|
||||
chmod +x /usr/bin/kubectl && \
|
||||
curl -fL --progress-bar -o /usr/bin/jq https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-${DEBIAN_ARCH} && \
|
||||
chmod +x /usr/bin/jq && \
|
||||
mkdir -p ${DESTINATION} && \
|
||||
tar --zstd -xvf ${WORKDIR}/${KATA_ARTIFACTS} -C ${DESTINATION} && \
|
||||
rm -f ${WORKDIR}/${KATA_ARTIFACTS} && \
|
||||
apk del curl tar zstd && \
|
||||
apk --no-cache add py3-pip && \
|
||||
pip install --no-cache-dir yq==3.2.3 --break-system-packages
|
||||
apk add --no-cache tar zstd util-linux-misc && \
|
||||
mkdir -p "${DESTINATION}" && \
|
||||
tar --zstd -xf "/tmp/$(basename "${KATA_ARTIFACTS}")" -C "${DESTINATION}" && \
|
||||
rm -f "/tmp/$(basename "${KATA_ARTIFACTS}")"
|
||||
|
||||
COPY scripts ${DESTINATION}/scripts
|
||||
#### Prepare runtime dependencies (nsenter and required libraries)
|
||||
# This stage assembles all runtime dependencies based on architecture
|
||||
# using ldd to find exact library dependencies
|
||||
FROM debian:bookworm-slim AS runtime-assembler
|
||||
|
||||
ARG DESTINATION=/opt/kata-artifacts
|
||||
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
|
||||
RUN \
|
||||
apt-get update && \
|
||||
apt-get --no-install-recommends -y install \
|
||||
util-linux && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists/
|
||||
|
||||
# Copy the built binary to analyze its dependencies
|
||||
COPY --from=rust-builder /kata-deploy/bin/kata-deploy /tmp/kata-deploy
|
||||
|
||||
# Create output directories
|
||||
RUN mkdir -p /output/lib /output/lib64 /output/usr/bin
|
||||
|
||||
# Use ldd to find and copy all required libraries for the kata-deploy binary and nsenter
|
||||
RUN \
|
||||
HOST_ARCH="$(uname -m)"; \
|
||||
echo "Preparing runtime dependencies for ${HOST_ARCH}"; \
|
||||
case "${HOST_ARCH}" in \
|
||||
"ppc64le"|"s390x") \
|
||||
echo "Using glibc - copying libraries based on ldd output"; \
|
||||
\
|
||||
# Copy nsenter \
|
||||
cp /usr/bin/nsenter /output/usr/bin/nsenter; \
|
||||
\
|
||||
# Show what the binaries need \
|
||||
echo "Libraries needed by kata-deploy:"; \
|
||||
ldd /tmp/kata-deploy || echo "ldd failed"; \
|
||||
echo "Libraries needed by nsenter:"; \
|
||||
ldd /usr/bin/nsenter || echo "ldd failed"; \
|
||||
\
|
||||
# Extract and copy all library paths from both binaries \
|
||||
for binary in /tmp/kata-deploy /usr/bin/nsenter; do \
|
||||
echo "Processing ${binary}..."; \
|
||||
# Get libraries with "=>" (shared libs) \
|
||||
ldd "${binary}" 2>/dev/null | grep "=>" | awk '{print $3}' | sort -u | while read -r lib; do \
|
||||
if [ -n "${lib}" ] && [ -f "${lib}" ]; then \
|
||||
dest_dir="/output$(dirname "${lib}")"; \
|
||||
mkdir -p "${dest_dir}"; \
|
||||
cp -Ln "${lib}" "${dest_dir}/" 2>/dev/null || true; \
|
||||
echo " Copied lib: ${lib}"; \
|
||||
fi; \
|
||||
done; \
|
||||
done; \
|
||||
\
|
||||
# Copy the dynamic linker - it's at /lib/ld64.so.1 (not /lib64/) \
|
||||
echo "Copying dynamic linker:"; \
|
||||
mkdir -p /output/lib; \
|
||||
cp -Ln /lib/ld64.so* /output/lib/ 2>/dev/null || true; \
|
||||
cp -Ln /lib64/ld64.so* /output/lib64/ 2>/dev/null || true; \
|
||||
\
|
||||
echo "glibc" > /output/.libc-type; \
|
||||
;; \
|
||||
*) \
|
||||
echo "amd64/arm64: will use musl-based static binaries"; \
|
||||
echo "musl" > /output/.libc-type; \
|
||||
# Create placeholder so COPY doesn't fail \
|
||||
touch /output/lib/.placeholder; \
|
||||
touch /output/lib64/.placeholder; \
|
||||
touch /output/usr/bin/.placeholder; \
|
||||
;; \
|
||||
esac
|
||||
|
||||
# Copy musl nsenter from alpine for amd64/arm64
|
||||
COPY --from=artifact-extractor /usr/bin/nsenter /output/usr/bin/nsenter-musl
|
||||
COPY --from=artifact-extractor /lib/ld-musl-*.so.1 /output/lib/
|
||||
|
||||
# For amd64/arm64, use the musl nsenter; for ppc64le/s390x, keep the glibc one
|
||||
RUN \
|
||||
HOST_ARCH="$(uname -m)"; \
|
||||
case "${HOST_ARCH}" in \
|
||||
"x86_64"|"aarch64") \
|
||||
mv /output/usr/bin/nsenter-musl /output/usr/bin/nsenter; \
|
||||
;; \
|
||||
*) \
|
||||
rm -f /output/usr/bin/nsenter-musl; \
|
||||
;; \
|
||||
esac
|
||||
|
||||
#### kata-deploy main image
|
||||
FROM gcr.io/distroless/static-debian12@sha256:87bce11be0af225e4ca761c40babb06d6d559f5767fbf7dc3c47f0f1a466b92c
|
||||
|
||||
ARG DESTINATION=/opt/kata-artifacts
|
||||
|
||||
# Copy extracted kata artifacts
|
||||
COPY --from=artifact-extractor ${DESTINATION} ${DESTINATION}
|
||||
|
||||
# Copy Rust binary
|
||||
COPY --from=rust-builder /kata-deploy/bin/kata-deploy /usr/bin/kata-deploy
|
||||
|
||||
# Copy nsenter and required libraries (assembled based on architecture)
|
||||
COPY --from=runtime-assembler /output/usr/bin/nsenter /usr/bin/nsenter
|
||||
COPY --from=runtime-assembler /output/lib/ /lib/
|
||||
COPY --from=runtime-assembler /output/lib64/ /lib64/
|
||||
|
||||
# Copy nydus snapshotter
|
||||
COPY nydus-snapshotter ${DESTINATION}/nydus-snapshotter
|
||||
COPY --from=nydus-binary-downloader /opt/nydus-snapshotter/bin/containerd-nydus-grpc ${DESTINATION}/nydus-snapshotter/
|
||||
COPY --from=nydus-binary-downloader /opt/nydus-snapshotter/bin/nydus-overlayfs ${DESTINATION}/nydus-snapshotter/
|
||||
|
||||
# Copy runtimeclasses and node-feature-rules
|
||||
COPY node-feature-rules ${DESTINATION}/node-feature-rules
|
||||
|
||||
ENTRYPOINT ["/usr/bin/kata-deploy"]
|
||||
|
||||
@@ -1,232 +0,0 @@
|
||||
# Copyright Intel Corporation, 2022 IBM Corp.
|
||||
# Copyright (c) 2025 NVIDIA Corporation
|
||||
#
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
#### Nydus snapshotter & nydus image
|
||||
|
||||
FROM golang:1.24-alpine AS nydus-binary-downloader
|
||||
|
||||
# Keep the version here aligned with "ndyus-snapshotter.version"
|
||||
# in versions.yaml
|
||||
ARG NYDUS_SNAPSHOTTER_VERSION=v0.15.10
|
||||
ARG NYDUS_SNAPSHOTTER_REPO=https://github.com/containerd/nydus-snapshotter
|
||||
|
||||
RUN \
|
||||
mkdir -p /opt/nydus-snapshotter && \
|
||||
ARCH="$(uname -m)" && \
|
||||
if [ "${ARCH}" = "x86_64" ]; then ARCH=amd64 ; fi && \
|
||||
if [ "${ARCH}" = "aarch64" ]; then ARCH=arm64; fi && \
|
||||
apk add --no-cache curl && \
|
||||
curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" && \
|
||||
tar xvzpf "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" -C /opt/nydus-snapshotter && \
|
||||
rm "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"
|
||||
|
||||
#### Build binary package
|
||||
FROM ubuntu:22.04 AS rust-builder
|
||||
|
||||
# Default to Rust 1.90.0
|
||||
ARG RUST_TOOLCHAIN=1.90.0
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
ENV RUSTUP_HOME="/opt/rustup"
|
||||
ENV CARGO_HOME="/opt/cargo"
|
||||
ENV PATH="/opt/cargo/bin/:${PATH}"
|
||||
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
|
||||
RUN \
|
||||
mkdir ${RUSTUP_HOME} ${CARGO_HOME} && \
|
||||
chmod -R a+rwX ${RUSTUP_HOME} ${CARGO_HOME}
|
||||
|
||||
RUN \
|
||||
apt-get update && \
|
||||
apt-get --no-install-recommends -y install \
|
||||
ca-certificates \
|
||||
curl \
|
||||
gcc \
|
||||
libc6-dev \
|
||||
musl-tools && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists/ && \
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN}
|
||||
|
||||
WORKDIR /kata-deploy
|
||||
|
||||
# Copy standalone binary project
|
||||
COPY binary /kata-deploy
|
||||
|
||||
# Install target and run tests based on architecture
|
||||
# - AMD64/arm64: use musl for fully static binaries
|
||||
# - PPC64le/s390x: use glibc (musl has issues on these platforms)
|
||||
RUN \
|
||||
HOST_ARCH="$(uname -m)"; \
|
||||
rust_arch=""; \
|
||||
rust_target=""; \
|
||||
case "${HOST_ARCH}" in \
|
||||
"x86_64") \
|
||||
rust_arch="x86_64"; \
|
||||
rust_target="${rust_arch}-unknown-linux-musl"; \
|
||||
echo "Installing musl target for ${rust_target}"; \
|
||||
rustup target add "${rust_target}"; \
|
||||
;; \
|
||||
"aarch64") \
|
||||
rust_arch="aarch64"; \
|
||||
rust_target="${rust_arch}-unknown-linux-musl"; \
|
||||
echo "Installing musl target for ${rust_target}"; \
|
||||
rustup target add "${rust_target}"; \
|
||||
;; \
|
||||
"ppc64le") \
|
||||
rust_arch="powerpc64le"; \
|
||||
rust_target="${rust_arch}-unknown-linux-gnu"; \
|
||||
echo "Using glibc target for ${rust_target} (musl is not well supported on ppc64le)"; \
|
||||
;; \
|
||||
"s390x") \
|
||||
rust_arch="s390x"; \
|
||||
rust_target="${rust_arch}-unknown-linux-gnu"; \
|
||||
echo "Using glibc target for ${rust_target} (musl is not well supported on s390x)"; \
|
||||
;; \
|
||||
*) echo "Unsupported architecture: ${HOST_ARCH}" && exit 1 ;; \
|
||||
esac; \
|
||||
echo "${rust_target}" > /tmp/rust_target
|
||||
|
||||
# Run tests using --test-threads=1 to prevent environment variable pollution between tests,
|
||||
# and this is fine as we'll never ever have multiple binaries running at the same time.
|
||||
RUN \
|
||||
rust_target="$(cat /tmp/rust_target)"; \
|
||||
echo "Running binary tests with target ${rust_target}..." && \
|
||||
RUSTFLAGS="-D warnings" cargo test --target "${rust_target}" -- --test-threads=1 && \
|
||||
echo "All tests passed!"
|
||||
|
||||
RUN \
|
||||
rust_target="$(cat /tmp/rust_target)"; \
|
||||
echo "Building kata-deploy binary for ${rust_target}..." && \
|
||||
RUSTFLAGS="-D warnings" cargo build --release --target "${rust_target}" && \
|
||||
mkdir -p /kata-deploy/bin && \
|
||||
cp "/kata-deploy/target/${rust_target}/release/kata-deploy" /kata-deploy/bin/kata-deploy && \
|
||||
echo "Cleaning up build artifacts to save disk space..." && \
|
||||
rm -rf /kata-deploy/target && \
|
||||
cargo clean
|
||||
|
||||
#### Extract kata artifacts
|
||||
FROM alpine:3.22 AS artifact-extractor
|
||||
|
||||
ARG KATA_ARTIFACTS=kata-static.tar.zst
|
||||
ARG DESTINATION=/opt/kata-artifacts
|
||||
|
||||
COPY ${KATA_ARTIFACTS} /tmp/
|
||||
RUN \
|
||||
apk add --no-cache tar zstd util-linux-misc && \
|
||||
mkdir -p "${DESTINATION}" && \
|
||||
tar --zstd -xf "/tmp/$(basename "${KATA_ARTIFACTS}")" -C "${DESTINATION}" && \
|
||||
rm -f "/tmp/$(basename "${KATA_ARTIFACTS}")"
|
||||
|
||||
#### Prepare runtime dependencies (nsenter and required libraries)
|
||||
# This stage assembles all runtime dependencies based on architecture
|
||||
# using ldd to find exact library dependencies
|
||||
FROM debian:bookworm-slim AS runtime-assembler
|
||||
|
||||
ARG DESTINATION=/opt/kata-artifacts
|
||||
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
|
||||
RUN \
|
||||
apt-get update && \
|
||||
apt-get --no-install-recommends -y install \
|
||||
util-linux && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists/
|
||||
|
||||
# Copy the built binary to analyze its dependencies
|
||||
COPY --from=rust-builder /kata-deploy/bin/kata-deploy /tmp/kata-deploy
|
||||
|
||||
# Create output directories
|
||||
RUN mkdir -p /output/lib /output/lib64 /output/usr/bin
|
||||
|
||||
# Use ldd to find and copy all required libraries for the kata-deploy binary and nsenter
|
||||
RUN \
|
||||
HOST_ARCH="$(uname -m)"; \
|
||||
echo "Preparing runtime dependencies for ${HOST_ARCH}"; \
|
||||
case "${HOST_ARCH}" in \
|
||||
"ppc64le"|"s390x") \
|
||||
echo "Using glibc - copying libraries based on ldd output"; \
|
||||
\
|
||||
# Copy nsenter \
|
||||
cp /usr/bin/nsenter /output/usr/bin/nsenter; \
|
||||
\
|
||||
# Show what the binaries need \
|
||||
echo "Libraries needed by kata-deploy:"; \
|
||||
ldd /tmp/kata-deploy || echo "ldd failed"; \
|
||||
echo "Libraries needed by nsenter:"; \
|
||||
ldd /usr/bin/nsenter || echo "ldd failed"; \
|
||||
\
|
||||
# Extract and copy all library paths from both binaries \
|
||||
for binary in /tmp/kata-deploy /usr/bin/nsenter; do \
|
||||
echo "Processing ${binary}..."; \
|
||||
# Get libraries with "=>" (shared libs) \
|
||||
ldd "${binary}" 2>/dev/null | grep "=>" | awk '{print $3}' | sort -u | while read -r lib; do \
|
||||
if [ -n "${lib}" ] && [ -f "${lib}" ]; then \
|
||||
dest_dir="/output$(dirname "${lib}")"; \
|
||||
mkdir -p "${dest_dir}"; \
|
||||
cp -Ln "${lib}" "${dest_dir}/" 2>/dev/null || true; \
|
||||
echo " Copied lib: ${lib}"; \
|
||||
fi; \
|
||||
done; \
|
||||
done; \
|
||||
\
|
||||
# Copy the dynamic linker - it's at /lib/ld64.so.1 (not /lib64/) \
|
||||
echo "Copying dynamic linker:"; \
|
||||
mkdir -p /output/lib; \
|
||||
cp -Ln /lib/ld64.so* /output/lib/ 2>/dev/null || true; \
|
||||
cp -Ln /lib64/ld64.so* /output/lib64/ 2>/dev/null || true; \
|
||||
\
|
||||
echo "glibc" > /output/.libc-type; \
|
||||
;; \
|
||||
*) \
|
||||
echo "amd64/arm64: will use musl-based static binaries"; \
|
||||
echo "musl" > /output/.libc-type; \
|
||||
# Create placeholder so COPY doesn't fail \
|
||||
touch /output/lib/.placeholder; \
|
||||
touch /output/lib64/.placeholder; \
|
||||
touch /output/usr/bin/.placeholder; \
|
||||
;; \
|
||||
esac
|
||||
|
||||
# Copy musl nsenter from alpine for amd64/arm64
|
||||
COPY --from=artifact-extractor /usr/bin/nsenter /output/usr/bin/nsenter-musl
|
||||
COPY --from=artifact-extractor /lib/ld-musl-*.so.1 /output/lib/
|
||||
|
||||
# For amd64/arm64, use the musl nsenter; for ppc64le/s390x, keep the glibc one
|
||||
RUN \
|
||||
HOST_ARCH="$(uname -m)"; \
|
||||
case "${HOST_ARCH}" in \
|
||||
"x86_64"|"aarch64") \
|
||||
mv /output/usr/bin/nsenter-musl /output/usr/bin/nsenter; \
|
||||
;; \
|
||||
*) \
|
||||
rm -f /output/usr/bin/nsenter-musl; \
|
||||
;; \
|
||||
esac
|
||||
|
||||
#### kata-deploy main image
|
||||
FROM gcr.io/distroless/static-debian12@sha256:87bce11be0af225e4ca761c40babb06d6d559f5767fbf7dc3c47f0f1a466b92c
|
||||
|
||||
ARG DESTINATION=/opt/kata-artifacts
|
||||
|
||||
# Copy extracted kata artifacts
|
||||
COPY --from=artifact-extractor ${DESTINATION} ${DESTINATION}
|
||||
|
||||
# Copy Rust binary
|
||||
COPY --from=rust-builder /kata-deploy/bin/kata-deploy /usr/bin/kata-deploy
|
||||
|
||||
# Copy nsenter and required libraries (assembled based on architecture)
|
||||
COPY --from=runtime-assembler /output/usr/bin/nsenter /usr/bin/nsenter
|
||||
COPY --from=runtime-assembler /output/lib/ /lib/
|
||||
COPY --from=runtime-assembler /output/lib64/ /lib64/
|
||||
|
||||
# Copy nydus snapshotter
|
||||
COPY nydus-snapshotter ${DESTINATION}/nydus-snapshotter
|
||||
COPY --from=nydus-binary-downloader /opt/nydus-snapshotter/bin/containerd-nydus-grpc ${DESTINATION}/nydus-snapshotter/
|
||||
COPY --from=nydus-binary-downloader /opt/nydus-snapshotter/bin/nydus-overlayfs ${DESTINATION}/nydus-snapshotter/
|
||||
|
||||
# Copy runtimeclasses and node-feature-rules
|
||||
COPY node-feature-rules ${DESTINATION}/node-feature-rules
|
||||
|
||||
ENTRYPOINT ["/usr/bin/kata-deploy"]
|
||||
@@ -290,18 +290,3 @@ Note: EXPERIMENTAL_FORCE_GUEST_PULL only checks containerd.forceGuestPull, not c
|
||||
{{- end -}}
|
||||
{{- join "," $shimNames -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Detect if this is a Rust-based build by checking the image tag
|
||||
Returns "true" if the tag contains "-rust", otherwise returns "false"
|
||||
This is a temporary helper for dual script/rust support
|
||||
*/}}
|
||||
{{- define "kata-deploy.isRustBuild" -}}
|
||||
{{- $tag := default .Chart.AppVersion .Values.image.tag -}}
|
||||
{{- if or (contains "-rust" $tag) (contains "nightly-rust" $tag) -}}
|
||||
true
|
||||
{{- else -}}
|
||||
false
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
@@ -133,11 +133,7 @@ spec:
|
||||
- name: kube-kata
|
||||
image: {{ .Values.image.reference }}:{{ default .Chart.AppVersion .Values.image.tag }}
|
||||
imagePullPolicy: {{ .Values.imagePullPolicy }}
|
||||
{{- if eq (include "kata-deploy.isRustBuild" .) "true" }}
|
||||
command: ["/usr/bin/kata-deploy", "install"]
|
||||
{{- else }}
|
||||
command: ["/opt/kata-artifacts/scripts/kata-deploy.sh", "install"]
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
|
||||
@@ -104,11 +104,7 @@ spec:
|
||||
- name: kube-kata-cleanup
|
||||
image: {{ .Values.image.reference }}:{{ default .Chart.AppVersion .Values.image.tag }}
|
||||
imagePullPolicy: {{ .Values.imagePullPolicy }}
|
||||
{{- if eq (include "kata-deploy.isRustBuild" .) "true" }}
|
||||
command: ["/usr/bin/kata-deploy", "cleanup"]
|
||||
{{- else }}
|
||||
command: ["/opt/kata-artifacts/scripts/kata-deploy.sh", "cleanup"]
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user