mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-18 05:39:50 +08:00
50 lines
2.3 KiB
Docker
50 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Supervisor image build.
|
|
#
|
|
# The final image carries the static `openshell-sandbox` binary used by Docker
|
|
# extraction, Podman image volumes, and Kubernetes side-loading. It also carries
|
|
# a materialized helper runtime used for trusted network setup and enforcement.
|
|
#
|
|
# The Rust binary is built natively before this image build runs and staged at:
|
|
# deploy/docker/.build/prebuilt-binaries/<arch>/openshell-sandbox
|
|
#
|
|
# Use tasks/scripts/docker-build-image.sh supervisor (or `mise run build:docker:supervisor`)
|
|
# to stage the binary and build the image in one step. CI builds the binary
|
|
# per-architecture via the `rust-native-build.yml` workflow (with the musl
|
|
# target) and uploads it as an artifact, which is downloaded into the same
|
|
# staging directory before the image build job runs.
|
|
|
|
FROM alpine:3.22 AS supervisor
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN apk add --no-cache iproute2 nftables iptables iptables-legacy \
|
|
&& mkdir -p /openshell-runtime/usr /openshell-runtime/etc \
|
|
&& cp -aL /bin /sbin /lib /openshell-runtime/ \
|
|
&& cp -aL /usr/bin /usr/sbin /usr/lib /openshell-runtime/usr/ \
|
|
&& if [ -d /etc/iproute2 ]; then \
|
|
cp -aL /etc/iproute2 /openshell-runtime/etc/; \
|
|
fi \
|
|
&& if [ -d /usr/share/nftables ]; then \
|
|
mkdir -p /openshell-runtime/usr/share; \
|
|
cp -aL /usr/share/nftables /openshell-runtime/usr/share/; \
|
|
fi \
|
|
&& loader="$(find /openshell-runtime/lib -maxdepth 1 -type f -name 'ld-musl-*.so.1' | head -n 1)" \
|
|
&& test -n "$loader" \
|
|
&& "$loader" --library-path /openshell-runtime/lib:/openshell-runtime/usr/lib \
|
|
/openshell-runtime/sbin/ip -Version \
|
|
&& "$loader" --library-path /openshell-runtime/lib:/openshell-runtime/usr/lib \
|
|
/openshell-runtime/usr/sbin/nft --version
|
|
|
|
# --chmod=0555 restores execute bits after the actions/upload-artifact +
|
|
# download-artifact roundtrip strips them. Ownership stays root (0:0) for
|
|
# Podman image-volume mounts, while world-execute lets the Kubernetes
|
|
# network sidecar run this binary as the dedicated non-root proxy UID.
|
|
COPY --chmod=0555 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-sandbox /openshell-sandbox
|
|
|
|
ENTRYPOINT ["/openshell-sandbox"]
|