Dockerfile RawHistoryFolder

1# SPDX-License-Identifier: MIT
2#
3# ermite-runner-ubuntu-26.04: the minimal CI-1 runner image. The same
4# filesystem is used as an OCI image (container isolation) and exported to an
5# ext4 base image (vm isolation) by scripts/build-image.sh. It holds the OS
6# only: the runner executable is attached by the host at start (never baked
7# in), so a runner upgrade does not need an image rebuild.
8FROM ubuntu:26.04
9
10ARG DEBIAN_FRONTEND=noninteractive
11
12RUN apt-get update \
13 && apt-get install -y --no-install-recommends \
14      bash build-essential ca-certificates curl e2fsprogs git gnupg iproute2 \
15      iptables jq kmod procps python-is-python3 python3 ruby sudo tzdata unzip xz-utils zip \
16 && rm -rf /var/lib/apt/lists/*
17
18# The command-line tools of GitHub's ubuntu-24.04 image that workflows call
19# directly (runner-images, images/ubuntu/toolsets/toolset-2404.json, the
20# latest published toolset:
21# apt.vital_packages and apt.cmd_packages), minus the daemons and services
22# (haveged, pollinate, sphinxsearch, systemd-coredump). parallel pulls in
23# sysstat, whose collection units are masked: a job image runs no services.
24RUN apt-get update \
25 && apt-get install -y --no-install-recommends \
26      acl aria2 binutils bison brotli bzip2 coreutils file findutils flex ftp \
27      libnss3-tools lz4 m4 mediainfo netcat-openbsd net-tools p7zip-full parallel \
28      patchelf pigz rsync shellcheck sqlite3 openssh-client sshpass swig telnet \
29      time wget \
30 && rm -rf /var/lib/apt/lists/* \
31 && for u in sysstat.service sysstat-collect.timer sysstat-summary.timer; do ln -sf /dev/null /etc/systemd/system/$u; done
32
33# Docker Engine from Docker's apt repository (the job gets its own daemon).
34RUN install -m 0755 -d /etc/apt/keyrings \
35 && curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
36 && chmod a+r /etc/apt/keyrings/docker.asc \
37 && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu resolute stable" \
38      > /etc/apt/sources.list.d/docker.list \
39 && apt-get update \
40 && apt-get install -y --no-install-recommends \
41      docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
42 && rm -rf /var/lib/apt/lists/*
43
44# Node.js 22 and yarn 1 system-wide in /usr/local, like GitHub's image
45# (runner-images, install-nodejs.sh:11-24 and toolset-2404.json: node.default
46# 22, node_modules yarn). The tarball is checked against the SHA-256 published
47# in https://nodejs.org/dist/v22.23.3/SHASUMS256.txt. /usr/local/lib/node_modules
48# and /usr/local/bin are world-writable so that "npm install -g" works as the
49# runner user (runner-images issue 3727).
50ARG NODE_VERSION=22.23.3
51ARG NODE_SHA256_AMD64=df450af89261115ef9f9e3830c3eeb2cc9213b63c720b1af623cb5dcbe2e02de
52ARG NODE_SHA256_ARM64=a44aeb94849a299b22df10b9e622ec2f605c2183501bc40590705131de7c740f
53RUN arch=$(dpkg --print-architecture) \
54 && case "$arch" in \
55      amd64) node_arch=x64; node_sha=$NODE_SHA256_AMD64 ;; \
56      arm64) node_arch=arm64; node_sha=$NODE_SHA256_ARM64 ;; \
57      *) echo "unsupported architecture $arch" >&2; exit 1 ;; \
58    esac \
59 && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.xz" -o /tmp/node.tar.xz \
60 && echo "${node_sha}  /tmp/node.tar.xz" | sha256sum -c - \
61 && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 --no-same-owner \
62      --exclude='*/CHANGELOG.md' --exclude='*/LICENSE' --exclude='*/README.md' \
63 && rm /tmp/node.tar.xz \
64 && npm install -g yarn@1.22.22 \
65 && npm cache clean --force \
66 && chmod -R 777 /usr/local/lib/node_modules \
67 && chmod 777 /usr/local/bin
68
69# Like GitHub-hosted runners: user "runner" (uid 1001), passwordless sudo,
70# member of "docker", with the job layout directories.
71RUN useradd --create-home --uid 1001 --shell /bin/bash runner \
72 && usermod -aG docker runner \
73 && echo 'runner ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/runner \
74 && chmod 0440 /etc/sudoers.d/runner \
75 && mkdir -p /home/runner/work /opt/hostedtoolcache /opt/ermite \
76 && chown -R runner:runner /home/runner /opt/hostedtoolcache
77
78ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache \
79    LANG=C.UTF-8
80
81COPY toolcache.lock install-toolcache.sh /tmp/toolcache/
82RUN sh /tmp/toolcache/install-toolcache.sh /tmp/toolcache/toolcache.lock \
83 && rm -rf /tmp/toolcache
84
85# The runner executable is bind-mounted (container) or provided by the init
86# disk (vm) here; its init subcommand starts the job's own Docker daemon.
87ENTRYPOINT ["/opt/ermite/ermite-runner", "init"]