Containerfile RawHistoryFolder

1# SPDX-License-Identifier: MIT
2#
3# ermite-runner as an unprivileged container (vm isolation, no jailer), for a
4# rootless Podman host. See docs/container.md.
5#
6# Build from the repository root, after scripts/build-kernel.sh and
7# scripts/build-image.sh have written tmp/image/{vmlinux,base.ext4}:
8#
9#   docker build -f contrib/container/Containerfile --build-arg VERSION=<tag> -t ermite-runner:<tag> .
10#
11# The guest kernel and the base image are part of the image: the runner then
12# needs nothing on the host but /dev/kvm, /dev/net/tun and NET_ADMIN.
13
14ARG GO_VERSION=1.27
15
16FROM docker.io/library/golang:${GO_VERSION} AS build
17WORKDIR /src
18COPY go.mod go.sum ./
19RUN go mod download
20COPY . .
21ARG VERSION=dev
22RUN CGO_ENABLED=0 GOWORK=off go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/ermite-runner .
23
24FROM docker.io/library/alpine:3.22 AS firecracker
25ARG FIRECRACKER_VERSION=v1.17.0
26ARG FIRECRACKER_SHA256=06094a1108ae9e82aa4c23a775aa92758f53f1175d422270d9d6162cb9ade558
27RUN apk add --no-cache curl \
28 && curl -fsSL -o /tmp/fc.tgz "https://github.com/firecracker-microvm/firecracker/releases/download/${FIRECRACKER_VERSION}/firecracker-${FIRECRACKER_VERSION}-x86_64.tgz" \
29 && echo "${FIRECRACKER_SHA256}  /tmp/fc.tgz" | sha256sum -c - \
30 && tar -xzf /tmp/fc.tgz -C /tmp \
31 && install -m 0755 "/tmp/release-${FIRECRACKER_VERSION}-x86_64/firecracker-${FIRECRACKER_VERSION}-x86_64" /out-firecracker
32
33FROM docker.io/library/alpine:3.22
34# ip (TAP devices), nft (job network policy), mkfs.ext4 (scratch and exec
35# disks; e2fsprogs >= 1.47), ca-certificates (Node.js externals downloads).
36RUN apk add --no-cache iproute2 nftables e2fsprogs ca-certificates tini
37COPY --from=firecracker /out-firecracker /usr/local/bin/firecracker
38COPY --from=build /out/ermite-runner /usr/local/bin/ermite-runner
39COPY tmp/image/vmlinux tmp/image/base.ext4 /opt/ermite-runner/image/
40
41ENV ERMITE_RUNNER_ISOLATION=vm \
42    ERMITE_RUNNER_JAILER_MODE=off \
43    ERMITE_RUNNER_IMAGE=/opt/ermite-runner/image \
44    ERMITE_RUNNER_STATE_DIR=/var/lib/ermite-runner \
45    ERMITE_RUNNER_LOCK_FILE=/run/ermite-runner.lock \
46    ERMITE_RUNNER_LOG_FORMAT=json
47
48VOLUME /var/lib/ermite-runner
49ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/ermite-runner"]
50CMD ["run"]