mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-04 08:25:55 +08:00
Drew Newberry
09fca54293
The first canary run revealed two issues: 1. dockerd failed to start because docker-proxy was not extracted from the Docker static binary tarball. Add it to the extraction list. 2. The GitHub Actions runner injects its own Docker socket into job containers. Without an explicit DOCKER_HOST, the openshell CLI connected to the runner's host Docker daemon instead of our DinD daemon. Start dockerd on a dedicated socket (/var/run/dind.sock) and export DOCKER_HOST so all subsequent steps use it.
96 lines
3.5 KiB
Docker
96 lines
3.5 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# CI runner image with all development tools pre-installed
|
|
# Rebuild triggered automatically when mise.toml or this file changes
|
|
|
|
FROM nvcr.io/nvidia/base/ubuntu:noble-20251013
|
|
|
|
ARG DOCKER_VERSION=29.3.0
|
|
ARG BUILDX_VERSION=v0.32.1
|
|
ARG TARGETARCH
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
ENV MISE_DATA_DIR=/opt/mise
|
|
ENV MISE_CACHE_DIR=/opt/mise/cache
|
|
ENV PATH="/opt/mise/shims:/root/.cargo/bin:/root/.local/bin:$PATH"
|
|
|
|
# Install system dependencies.
|
|
# iptables is required for Docker-in-Docker networking (dockerd uses it for
|
|
# container NAT and bridge rules).
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
build-essential \
|
|
pkg-config \
|
|
libssl-dev \
|
|
openssh-client \
|
|
python3 \
|
|
python3-venv \
|
|
cmake \
|
|
socat \
|
|
unzip \
|
|
xz-utils \
|
|
jq \
|
|
rsync \
|
|
iptables \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Docker CLI, daemon, and buildx plugin.
|
|
# The full daemon (dockerd + containerd + runc) is needed for Docker-in-Docker
|
|
# workflows like the release canary test, where the CI container runs its own
|
|
# Docker daemon instead of mounting the host socket.
|
|
RUN case "$TARGETARCH" in \
|
|
amd64) docker_arch=x86_64; buildx_arch=amd64 ;; \
|
|
arm64) docker_arch=aarch64; buildx_arch=arm64 ;; \
|
|
*) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac \
|
|
&& curl -fsSL "https://download.docker.com/linux/static/stable/${docker_arch}/docker-${DOCKER_VERSION}.tgz" \
|
|
| tar xz --strip-components=1 -C /usr/local/bin \
|
|
docker/docker docker/dockerd docker/containerd \
|
|
docker/containerd-shim-runc-v2 docker/runc docker/docker-proxy \
|
|
&& mkdir -p /usr/local/lib/docker/cli-plugins \
|
|
&& curl -fsSL "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-${buildx_arch}" \
|
|
-o /usr/local/lib/docker/cli-plugins/docker-buildx \
|
|
&& chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
|
|
|
|
# Install GitHub CLI used by install.sh and CI jobs
|
|
ARG GH_VERSION=2.74.1
|
|
RUN case "$TARGETARCH" in \
|
|
amd64) gh_arch=amd64 ;; \
|
|
arm64) gh_arch=arm64 ;; \
|
|
*) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac \
|
|
&& curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${gh_arch}.tar.gz" \
|
|
| tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"
|
|
|
|
# Install AWS CLI v2 used for ECR publishing
|
|
RUN case "$TARGETARCH" in \
|
|
amd64) aws_arch=x86_64 ;; \
|
|
arm64) aws_arch=aarch64 ;; \
|
|
*) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac \
|
|
&& curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${aws_arch}.zip" -o /tmp/awscliv2.zip \
|
|
&& unzip -q /tmp/awscliv2.zip -d /tmp \
|
|
&& /tmp/aws/install \
|
|
&& rm -rf /tmp/aws /tmp/awscliv2.zip
|
|
|
|
# Install mise
|
|
RUN curl https://mise.run | sh
|
|
|
|
# Copy mise.toml and task includes, then install all tools via mise
|
|
COPY mise.toml /opt/mise/mise.toml
|
|
COPY tasks/ /opt/mise/tasks/
|
|
WORKDIR /opt/mise
|
|
ARG MISE_GITHUB_TOKEN
|
|
RUN mise trust /opt/mise/mise.toml && \
|
|
env -u RUSTC_WRAPPER mise install && \
|
|
/root/.cargo/bin/rustup component remove rust-docs || true && \
|
|
rm -rf /root/.rustup/toolchains/*/share/doc /root/.rustup/toolchains/*/share/man
|
|
|
|
# Set working directory for CI jobs
|
|
WORKDIR /builds
|