Introduce isolation in artifacts.yaml

.github/workflows/artifacts.yaml

@@ -75,15 +75,21 @@ jobs:
         path: ${{ env.x86_64_image_path }}
   export-docker-image-arm64:
     runs-on: arm-ubuntu-arm-22.04-4core
+    container:
+      image: arm64v8/ubuntu:22.04
+      options: --security-opt=no-new-privileges
     steps:
     - name: Checkout repository
       uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
+    - name: Install wget
+      run: |
+        apt-get update && apt-get install -y wget
     - name: Get docker image name
       run: |
         short_sha=$(echo ${{ github.sha }} | cut -c1-8)
         echo "arm64_image_path=orchestration-image-arm64-${short_sha}.tar" >> $GITHUB_ENV
     - name: Install bazel
-      run: sudo bash tools/buildutils/installbazel.sh
+      run: bash tools/buildutils/installbazel.sh
     - name: bazel version
       run: bazel version
     - name: Build docker image

docker/image-builder.sh

@@ -1,24 +1,28 @@
 #!/usr/bin/env bash
 
-# This shell script exists for building docker image.
-# Docker image includes HO(Host Orchestrator) inside,
-# so it could execute CF instance with API in HO.
+# This shell script exists for building Docker image using Docker Buildx.
+# The image includes HO (Host Orchestrator) inside, so it can execute CF instance with API in HO.
 
-script_location=`realpath -s $(dirname ${BASH_SOURCE[0]})`
-android_cuttlefish_root_dir=$(realpath -s $script_location/..)
+set -e
+
+script_location=$(realpath -s $(dirname "${BASH_SOURCE[0]}"))
+android_cuttlefish_root_dir=$(realpath -s "$script_location/..")
 
 if [[ "$1" == "" ]]; then
-    tag=cuttlefish-orchestration
+    tag="cuttlefish-orchestration"
 else
-    tag=$1
+    tag="$1"
 fi
 
-# Build docker image
-pushd $android_cuttlefish_root_dir
-docker build \
+# Set up Docker Buildx if not already set up
+docker buildx create --use || true
+
+# Build the Docker image using Buildx for x86_64 and arm64 platforms
+pushd "$android_cuttlefish_root_dir"
+docker buildx build \
     --force-rm \
     --no-cache \
     -f docker/Dockerfile \
-    -t $tag \
-    .
+    -t "$tag" \
+    --load .
 popd