test: ubi9 as runtime stage for arm64 cross compile

Kuadrant · Oct 25, 2023 · e9b3ab6 · e9b3ab6
1 parent 6ef75c2
commit e9b3ab6
Show file tree

Hide file tree

Showing 2 changed files with 75 additions and 48 deletions.
diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml
@@ -20,8 +20,8 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - dockerfile: Dockerfile
-            platform: linux/amd64
+#          - dockerfile: Dockerfile
+#            platform: linux/amd64
           - dockerfile: Dockerfile.aarch64
             platform: linux/arm64
     steps:
@@ -51,11 +51,12 @@ jobs:
             GITHUB_SHA=${{ github.sha }}
           cache-from: type=gha,scope=${{ matrix.platform == 'linux/amd64' && 'build-amd' || 'build-arm'}}
           cache-to: type=gha,mode=max,scope=${{ matrix.platform == 'linux/amd64' && 'build-amd' || 'build-arm'}}
-          outputs: type=image,name=${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador,push-by-digest=true,name-canonical=true,push=true
+#          outputs: type=image,name=${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador,push-by-digest=true,name-canonical=true,push=true
           file: ${{ matrix.dockerfile }}
           platforms: |
             ${{ matrix.platform }}
           provenance: false
+          push: false
       - name: Export digest
         run: |
           mkdir -p /tmp/digests
@@ -68,44 +69,44 @@ jobs:
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
-  merge:
-    runs-on: ubuntu-latest
-    needs:
-      - build
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v3
-        with:
-          name: digests
-          path: /tmp/digests
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador
-          tags: |
-            # type=raw,value=${{ github.sha }}
-            # set latest tag for main branch
-            type=raw,value=latest,enable=${{ github.ref_name == env.MAIN_BRANCH_NAME }}
-            # set ref name tag for non-main branches
-            type=raw,value=${{ github.ref_name }},enable=${{ github.ref_name != env.MAIN_BRANCH_NAME }}
-      - name: Login to container registry
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.IMG_REGISTRY_USERNAME }}
-          password: ${{ secrets.IMG_REGISTRY_TOKEN }}
-          registry: ${{ env.IMG_REGISTRY_HOST }}
-      - name: Create manifest list and push
-        working-directory: /tmp/digests
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador@sha256:%s ' *)
-      - name: Inspect image
-        run: |
-          docker buildx imagetools inspect ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador:${{ steps.meta.outputs.version }}
-      - name: Smoke Test
-        run: |
-          docker run --rm -t ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador:${{ steps.meta.outputs.version }} limitador-server --help
+#  merge:
+#    runs-on: ubuntu-latest
+#    needs:
+#      - build
+#    steps:
+#      - name: Download digests
+#        uses: actions/download-artifact@v3
+#        with:
+#          name: digests
+#          path: /tmp/digests
+#      - name: Set up Docker Buildx
+#        uses: docker/setup-buildx-action@v3
+#      - name: Docker meta
+#        id: meta
+#        uses: docker/metadata-action@v5
+#        with:
+#          images: |
+#            ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador
+#          tags: |
+#            # type=raw,value=${{ github.sha }}
+#            # set latest tag for main branch
+#            type=raw,value=latest,enable=${{ github.ref_name == env.MAIN_BRANCH_NAME }}
+#            # set ref name tag for non-main branches
+#            type=raw,value=${{ github.ref_name }},enable=${{ github.ref_name != env.MAIN_BRANCH_NAME }}
+#      - name: Login to container registry
+#        uses: docker/login-action@v2
+#        with:
+#          username: ${{ secrets.IMG_REGISTRY_USERNAME }}
+#          password: ${{ secrets.IMG_REGISTRY_TOKEN }}
+#          registry: ${{ env.IMG_REGISTRY_HOST }}
+#      - name: Create manifest list and push
+#        working-directory: /tmp/digests
+#        run: |
+#          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+#            $(printf '${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador@sha256:%s ' *)
+#      - name: Inspect image
+#        run: |
+#          docker buildx imagetools inspect ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador:${{ steps.meta.outputs.version }}
+#      - name: Smoke Test
+#        run: |
+#          docker run --rm -t ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/limitador:${{ steps.meta.outputs.version }} limitador-server --help
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
@@ -2,10 +2,12 @@
 # Build Stage cross compiling
 # ------------------------------------------------------------------------------
 
-FROM --platform=${BUILDPLATFORM} rust:1.72 as limitador-build
+# Use bullseye as build image instead of Bookworm as ubi9 does not not have GLIBCXX_3.4.30
+# https://access.redhat.com/solutions/6969351
+FROM --platform=${BUILDPLATFORM} rust:1.72-bullseye as limitador-build
 
 RUN apt update && apt upgrade -y \
-    && apt install -y protobuf-compiler clang g++-aarch64-linux-gnu libc6-dev-arm64-cross
+    && apt install -y protobuf-compiler clang g++-aarch64-linux-gnu libc6-dev-arm64-cross gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu
 
 RUN rustup target add aarch64-unknown-linux-gnu \
     && rustup toolchain install stable-aarch64-unknown-linux-gnu
@@ -17,7 +19,9 @@ ENV GITHUB_SHA=${GITHUB_SHA:-unknown}
 ENV RUSTFLAGS="-C target-feature=-crt-static" \
     CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
     CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc \
-    CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++
+    CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++ \
+    # https://github.com/rust-lang/rust-bindgen/issues/1229
+    BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/aarch64-linux-gnu"
 
 COPY . .
 
@@ -27,12 +31,34 @@ RUN cargo build --release --target aarch64-unknown-linux-gnu
 # Run Stage
 # ------------------------------------------------------------------------------
 
-FROM --platform=$TARGETPLATFORM gcr.io/distroless/cc-debian12
+#FROM gcr.io/distroless/cc-debian12
+#
+#WORKDIR /home/limitador/bin/
+#ENV PATH="/home/limitador/bin:${PATH}"
+#
+#COPY --from=limitador-build /usr/src/limitador/limitador-server/examples/limits.yaml ../
+#COPY --from=limitador-build /usr/src/limitador/target/aarch64-unknown-linux-gnu/release/limitador-server ./limitador-server
+#
+#CMD ["limitador-server"]
+
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.2
+
+# shadow-utils is required for `useradd`
+RUN PKGS="libgcc libstdc++ shadow-utils" \
+    && microdnf --assumeyes install --nodocs $PKGS \
+    && rpm --verify --nogroup --nouser $PKGS \
+    && microdnf -y clean all
+RUN useradd -u 1000 -s /bin/sh -m -d /home/limitador limitador
 
 WORKDIR /home/limitador/bin/
 ENV PATH="/home/limitador/bin:${PATH}"
 
 COPY --from=limitador-build /usr/src/limitador/limitador-server/examples/limits.yaml ../
 COPY --from=limitador-build /usr/src/limitador/target/aarch64-unknown-linux-gnu/release/limitador-server ./limitador-server
 
+RUN chown -R limitador:root /home/limitador \
+    && chmod -R 750 /home/limitador
+
+USER limitador
+
 CMD ["limitador-server"]