Change containerd and runc to use multistage builds from new Alpine base

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

examples/docker.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

examples/gcp.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

examples/minimal.yml

@@ -3,8 +3,8 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:6c9b2dfac4ac446e57ad83e9817db4b5a334301c
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
-  - linuxkit/containerd:60e2486a74c665ba4df57e561729aec20758daed
+  - linuxkit/containerd:987b62d8411bc92f092e6e6e8d1038c4e06f0a53
 onboot:
   - name: dhcpcd
     image: "linuxkit/dhcpcd:2def74ab3f9233b4c09ebb196ba47c27c08b0ed8"

examples/node_exporter.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:6c9b2dfac4ac446e57ad83e9817db4b5a334301c
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:fe1b7f438a234cb6481c6538295115eac2a0596d
 services:
   - name: rngd

examples/packet.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS1 page_poison=1"
 init:
   - linuxkit/init:e10e2efc1b78ef41d196175cbc07e069391f406e
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

examples/redis-os.yml

@@ -5,7 +5,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
 services:
   - name: dhcpcd

examples/sshd.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

examples/swap.yml

@@ -3,8 +3,8 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:42fe8cb1508b3afed39eb89821906e3cc7a70551
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
-  - linuxkit/containerd:60e2486a74c665ba4df57e561729aec20758daed
+  - linuxkit/containerd:987b62d8411bc92f092e6e6e8d1038c4e06f0a53
   - linuxkit/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935
 onboot:
   - name: sysctl

examples/vmware.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

linuxkit.yml

@@ -3,8 +3,8 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:6c9b2dfac4ac446e57ad83e9817db4b5a334301c
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
-  - linuxkit/containerd:60e2486a74c665ba4df57e561729aec20758daed
+  - linuxkit/containerd:987b62d8411bc92f092e6e6e8d1038c4e06f0a53
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:
   - name: sysctl

pkg/containerd/Dockerfile

@@ -1,14 +1,15 @@
-FROM golang:1.8-alpine
+FROM linuxkit/alpine:d0cef04aa75159e373fa08a49478ed6bf4adb9b4@sha256:4d8e181db968645b8b3308d2fe725e6f7bb9d9d44a9c3c7782e86c02a6d9e0f1 as alpine
 RUN \
-  apk update && apk upgrade -a && \
+  apk add \
-  apk add --no-cache \
   btrfs-progs-dev \
   gcc \
   git \
+  go \
   libc-dev \
   linux-headers \
   make \
   && true
+ENV GOPATH=/root/go
 ENV CONTAINERD_COMMIT=25a161bf5d4483bd0bea9e38b0e8fe3ecb17b53e
 RUN mkdir -p $GOPATH/src/github.com/containerd && \
   cd $GOPATH/src/github.com/containerd && \
@@ -19,5 +20,9 @@ RUN make binaries GO_GCFLAGS="-buildmode pie --ldflags '-extldflags \"-fno-PIC -
 RUN cp bin/containerd bin/ctr bin/containerd-shim bin/dist /usr/bin/
 WORKDIR /
 COPY . .
-RUN printf "FROM scratch\nCOPY /usr/bin/* /usr/bin/\nCOPY /etc/containerd/config.toml /etc/containerd/\n" > Dockerfile
+
-CMD ["tar", "cf", "-", "Dockerfile", "usr/bin/containerd", "usr/bin/ctr", "usr/bin/containerd-shim", "etc/containerd/config.toml"]
+FROM scratch
+ENTRYPOINT []
+WORKDIR /
+COPY --from=alpine /usr/bin/containerd /usr/bin/ctr /usr/bin/containerd-shim /usr/bin/
+COPY --from=alpine /etc/containerd/config.toml /etc/containerd/

pkg/containerd/Makefile

@@ -1,33 +1,13 @@
-SHA_IMAGE=alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
-
 .PHONY: tag push
 
-BASE=golang:1.8-alpine
 IMAGE=containerd
 
+HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
+
 default: push
 
-hash: Dockerfile etc/containerd/config.toml
+tag: Dockerfile
-	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
+	docker build -t linuxkit/$(IMAGE):$(HASH) .
-	tar cf - $^ | docker build --no-cache -t $(IMAGE):build0 -
-	docker run --rm $(IMAGE):build0 | docker build --no-cache -t $(IMAGE):build -
-	docker rmi $(IMAGE):build0
-	find $^ -type f | xargs cat | docker run --rm -i $(SHA_IMAGE) sha1sum - | sed 's/ .*//' > $@
 
-push: hash
+push: tag
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
+	docker pull linuxkit/$(IMAGE):$(HASH) || docker push linuxkit/$(IMAGE):$(HASH)
-		(docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash) && \
-		 docker push linuxkit/$(IMAGE):$(shell cat hash))
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-tag: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash)
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-clean:
-	rm -f hash
-
-.DELETE_ON_ERROR:

pkg/runc/Dockerfile

@@ -1,15 +1,16 @@
-FROM golang:1.7-alpine3.5
+FROM linuxkit/alpine:d0cef04aa75159e373fa08a49478ed6bf4adb9b4@sha256:4d8e181db968645b8b3308d2fe725e6f7bb9d9d44a9c3c7782e86c02a6d9e0f1 as alpine
 RUN \
-  apk update && apk upgrade -a && \
+  apk add \
-  apk add --no-cache \
   bash \
   gcc \
   git \
+  go \
   libc-dev \
   libseccomp-dev \
   linux-headers \
   make \
   && true
+ENV GOPATH=/root/go
 ENV RUNC_COMMIT=ac50e77bbb440dcab354a328c79754e2502b79ca
 RUN mkdir -p $GOPATH/src/github.com/opencontainers && \
   cd $GOPATH/src/github.com/opencontainers && \
@@ -19,6 +20,8 @@ RUN git checkout $RUNC_COMMIT
 # TODO static pie, currently no easy way to change build options
 RUN make static BUILDTAGS="seccomp"
 RUN cp runc /usr/bin/
+
+FROM scratch
+ENTRYPOINT []
 WORKDIR /
-RUN printf "FROM scratch\nCOPY /usr/bin/runc /usr/bin/\n" > Dockerfile
+COPY --from=alpine /usr/bin/runc /usr/bin/
-CMD ["tar", "cf", "-", "Dockerfile", "usr/bin/runc"]

pkg/runc/Makefile

@@ -1,33 +1,13 @@
-SHA_IMAGE=alpine:3.5@sha256:dfbd4a3a8ebca874ebd2474f044a0b33600d4523d03b0df76e5c5986cb02d7e8
-
 .PHONY: tag push
 
-BASE=golang:1.7-alpine3.5
 IMAGE=runc
 
+HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
+
 default: push
 
-hash: Dockerfile
+tag: Dockerfile
-	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
+	docker build -t linuxkit/$(IMAGE):$(HASH) .
-	tar cf - $^ | docker build --no-cache -t $(IMAGE):build0 -
-	docker run --rm $(IMAGE):build0 | docker build --no-cache -t $(IMAGE):build -
-	docker rmi $(IMAGE):build0
-	find $^ -type f | xargs cat | docker run --rm -i $(SHA_IMAGE) sha1sum - | sed 's/ .*//' > $@
 
-push: hash
+push: tag
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
+	docker pull linuxkit/$(IMAGE):$(HASH) || docker push linuxkit/$(IMAGE):$(HASH)
-		(docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash) && \
-		 docker push linuxkit/$(IMAGE):$(shell cat hash))
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-tag: hash
-	docker pull linuxkit/$(IMAGE):$(shell cat hash) || \
-		docker tag $(IMAGE):build linuxkit/$(IMAGE):$(shell cat hash)
-	docker rmi $(IMAGE):build
-	rm -f hash
-
-clean:
-	rm -f hash
-
-.DELETE_ON_ERROR:

projects/etcd/etcd.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:6c9b2dfac4ac446e57ad83e9817db4b5a334301c
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:fe1b7f438a234cb6481c6538295115eac2a0596d
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

projects/kubernetes/kube-master.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

projects/kubernetes/kube-node.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

projects/okernel/examples/okernel_simple.yaml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

test/cases/test-docker-bench.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

test/cases/test-kernel-config.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

test/cases/test-ltp.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

test/cases/test-virtsock-server.yml

@@ -7,7 +7,7 @@ kernel:
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
   - linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
 onboot:

test/kmod/kmod.yml

@@ -3,7 +3,7 @@ kernel:
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:63eed9ca7a09d2ce4c0c5e7238ac005fa44f564b
-  - linuxkit/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
+  - linuxkit/runc:2649198589ef0020d99f613adaeda45ce0093a38
   - linuxkit/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
 onboot:
   - name: check