Dockerfile RawHistoryFolder
1# SPDX-License-Identifier: MIT
2#
3# ermite-runner-ubuntu-24.04: the minimal CI-1 runner image. The same
4# filesystem is used as an OCI image (container isolation) and exported to an
5# ext4 base image (vm isolation) by scripts/build-image.sh. It holds the OS
6# only: the runner executable is attached by the host at start (never baked
7# in), so a runner upgrade does not need an image rebuild.
8FROM ubuntu:24.04
9
10ARG DEBIAN_FRONTEND=noninteractive
11
12RUN apt-get update \
13 && apt-get install -y --no-install-recommends \
14 bash build-essential ca-certificates curl e2fsprogs git gnupg iproute2 \
15 iptables jq kmod procps python-is-python3 python3 sudo tzdata unzip xz-utils zip \
16 && rm -rf /var/lib/apt/lists/*
17
18# The command-line tools of GitHub's ubuntu-24.04 image that workflows call
19# directly (runner-images, images/ubuntu/toolsets/toolset-2404.json:
20# apt.vital_packages and apt.cmd_packages), minus the daemons and services
21# (haveged, pollinate, sphinxsearch, systemd-coredump). parallel pulls in
22# sysstat, whose collection units are masked: a job image runs no services.
23RUN apt-get update \
24 && apt-get install -y --no-install-recommends \
25 acl aria2 binutils bison brotli bzip2 coreutils file findutils flex ftp \
26 libnss3-tools lz4 m4 mediainfo netcat-openbsd net-tools p7zip-full parallel \
27 patchelf pigz rsync shellcheck sqlite3 openssh-client sshpass swig telnet \
28 time wget \
29 && rm -rf /var/lib/apt/lists/* \
30 && for u in sysstat.service sysstat-collect.timer sysstat-summary.timer; do ln -sf /dev/null /etc/systemd/system/$u; done
31
32# Docker Engine from Docker's apt repository (the job gets its own daemon).
33RUN install -m 0755 -d /etc/apt/keyrings \
34 && curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
35 && chmod a+r /etc/apt/keyrings/docker.asc \
36 && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable" \
37 > /etc/apt/sources.list.d/docker.list \
38 && apt-get update \
39 && apt-get install -y --no-install-recommends \
40 docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
41 && rm -rf /var/lib/apt/lists/*
42
43# Like GitHub-hosted runners: user "runner" (uid 1001), passwordless sudo,
44# member of "docker", with the job layout directories.
45RUN useradd --create-home --uid 1001 --shell /bin/bash runner \
46 && usermod -aG docker runner \
47 && echo 'runner ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/runner \
48 && chmod 0440 /etc/sudoers.d/runner \
49 && mkdir -p /home/runner/work /opt/hostedtoolcache /opt/ermite \
50 && chown -R runner:runner /home/runner /opt/hostedtoolcache
51
52ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache \
53 LANG=C.UTF-8
54
55# The runner executable is bind-mounted (container) or provided by the init
56# disk (vm) here; its init subcommand starts the job's own Docker daemon.
57ENTRYPOINT ["/opt/ermite/ermite-runner", "init"]