OpenShell/deploy/docker/Dockerfile.ci

# syntax=docker/dockerfile:1.4

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# CI runner image with all development tools pre-installed
# Rebuild triggered automatically when mise.toml, mise.lock, tasks, or this file changes

FROM nvcr.io/nvidia/base/ubuntu:noble-20251013

ARG DOCKER_VERSION=29.5.1
ARG BUILDX_VERSION=v0.34.0
ARG NPM_VERSION=11.13.0
ARG TARGETARCH

ENV DEBIAN_FRONTEND=noninteractive
ENV MISE_DATA_DIR=/usr/local/share/openshell/mise
ENV RUSTUP_HOME=/usr/local/share/openshell/mise/rustup
ENV PATH="/usr/local/share/openshell/mise/shims:/usr/local/bin:/usr/local/share/openshell/mise/cargo/bin:/root/.local/bin:$PATH"

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    git \
    build-essential \
    clang \
    libclang-dev \
    libnss-wrapper \
    libz3-dev \
    pkg-config \
    libssl-dev \
    musl-tools \
    openssh-client \
    python3 \
    python3-venv \
    cmake \
    socat \
    unzip \
    xz-utils \
    jq \
    iptables \
    iproute2 \
    nftables \
    rsync \
    util-linux \
    zstd \
    && apt-get install -y --only-upgrade gpgv python3 \
    && rm -rf /var/lib/apt/lists/*

# Install Docker CLI and buildx plugin used by CI jobs
RUN case "$TARGETARCH" in \
      amd64) docker_arch=x86_64; buildx_arch=amd64 ;; \
      arm64) docker_arch=aarch64; buildx_arch=arm64 ;; \
      *) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
    esac \
    && curl -fsSL "https://download.docker.com/linux/static/stable/${docker_arch}/docker-${DOCKER_VERSION}.tgz" \
    | tar xz --strip-components=1 -C /usr/local/bin docker/docker \
    && mkdir -p /usr/local/lib/docker/cli-plugins \
    && curl -fsSL "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-${buildx_arch}" \
      -o /usr/local/lib/docker/cli-plugins/docker-buildx \
    && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx

# Install GitHub CLI used by install.sh and CI jobs
ARG GH_VERSION=2.92.0
RUN case "$TARGETARCH" in \
      amd64) gh_arch=amd64 ;; \
      arm64) gh_arch=arm64 ;; \
      *) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
    esac \
    && curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${gh_arch}.tar.gz" \
    | tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"

# Install mise (NOTE: keep this version in sync with mise.toml)
ARG MISE_VERSION=v2026.4.25
RUN curl https://mise.run | MISE_VERSION=$MISE_VERSION sh \
    && install -D -m 0755 /root/.local/bin/mise /usr/local/bin/mise

# The VM sandbox runs as the unprivileged `sandbox` user and does not preserve
# Docker image ENV metadata, so expose mise through system paths and profiles.
RUN printf '%s\n' \
      'export MISE_DATA_DIR="${MISE_DATA_DIR:-/usr/local/share/openshell/mise}"' \
      'export MISE_CACHE_DIR="${MISE_CACHE_DIR:-${HOME:-/tmp}/.cache/mise}"' \
      'export CARGO_HOME="${CARGO_HOME:-${HOME:-/tmp}/.cargo}"' \
      'export RUSTUP_HOME="${RUSTUP_HOME:-/usr/local/share/openshell/mise/rustup}"' \
      'case ":${PATH}:" in *:/usr/local/share/openshell/mise/shims:*) ;; *) export PATH="/usr/local/share/openshell/mise/shims:${PATH}" ;; esac' \
      'case ":${PATH}:" in *:/usr/local/share/openshell/mise/cargo/bin:*) ;; *) export PATH="/usr/local/share/openshell/mise/cargo/bin:${PATH}" ;; esac' \
      'case ":${PATH}:" in *:/usr/local/bin:*) ;; *) export PATH="/usr/local/bin:${PATH}" ;; esac' \
      > /etc/profile.d/openshell-mise.sh \
    && printf '%s\n' '' '[ -r /etc/profile.d/openshell-mise.sh ] && . /etc/profile.d/openshell-mise.sh' >> /etc/bash.bashrc

COPY deploy/docker/devshell-bootstrap.sh /usr/local/bin/openshell-devshell-bootstrap
RUN chmod 0755 /usr/local/bin/openshell-devshell-bootstrap

# Copy mise.toml and task includes, then install all tools via mise
COPY mise.toml /usr/local/share/openshell/mise/mise.toml
COPY mise.lock /usr/local/share/openshell/mise/mise.lock
COPY tasks/ /usr/local/share/openshell/mise/tasks/
WORKDIR /usr/local/share/openshell/mise
RUN --mount=type=secret,id=MISE_GITHUB_TOKEN \
    export MISE_GITHUB_TOKEN="$(cat /run/secrets/MISE_GITHUB_TOKEN 2>/dev/null || true)" && \
    export CARGO_HOME=/usr/local/share/openshell/mise/cargo && \
    export RUSTUP_HOME=/usr/local/share/openshell/mise/rustup && \
    /usr/local/bin/mise trust /usr/local/share/openshell/mise/mise.toml && \
    env -u RUSTC_WRAPPER /usr/local/bin/mise install --locked && \
    /usr/local/bin/mise reshim && \
    npm install -g "npm@${NPM_VERSION}" && \
    /usr/local/bin/mise reshim && \
    find /usr/local/share/openshell/mise/shims -type l -exec ln -sfn /usr/local/bin/mise {} \; && \
    (/usr/local/share/openshell/mise/cargo/bin/rustup component remove rust-docs || true) && \
    rm -rf /usr/local/share/openshell/mise/rustup/toolchains/*/share/doc /usr/local/share/openshell/mise/rustup/toolchains/*/share/man && \
    helm plugin install https://github.com/helm-unittest/helm-unittest --verify=false

# Set working directory for CI jobs
WORKDIR /builds