1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
|
# Image used for testing Charliecloud on Alpine. This exercises a libc that is
# not glibc (musl) and a compiler that is not gcc (clang). See “debian.df” for
# various notes about these builds.
ARG branch
ARG regy
FROM alpine:3.22
COPY arch.sh /usr/bin
### OS packages we need
RUN apk upgrade \
&& apk add autoconf \
automake \
bash-completion \
bats \
cjson-dev \
fuse3 \
fuse3-dev \
gc-dev \
git \
graphviz \
libtool \
lz4-dev \
lzo-dev \
make \
ncurses \
pkgconf \
py3-dateutil \
py3-pip \
py3-requests \
py3-wheel \
rsync \
squashfs-tools \
sudo \
tzdata \
wget \
xz-dev \
zlib-dev \
zstd-dev
# GNU tar(1) is probably inescapeable.
RUN apk add tar
# FIXME: Locales seem to only sort of work in Alpine?
RUN apk add musl-locales musl-locales-lang \
&& locale -a
# Currently we depend on various GNU utilities (#2038). See also:
# https://wiki.alpinelinux.org/wiki/How_to_get_regular_stuff_working
RUN apk add coreutils diffutils findutils grep sed time util-linux
RUN ln -s /usr/bin/time /bin/time
# We *can* build with BusyBox install(1), so put that one back.
RUN ln -sf /bin/busybox /usr/bin/install
# we have a lot of dependencies on GNU coreutils,
# e.g. that readlink(1) takes “-m”.
# We want to use a C toolchain that’s fully independent from GNU (i.e., gcc(1)
# and GNU ld(1)). Irritatingly, package clang depends on gcc for the libgcc
# “compiler runtime library” despite providing its own [1]. apk(8) also cannot
# force-remove packages [2]. Hence the following kludge.
#
# [1]: https://gitlab.alpinelinux.org/alpine/aports/-/issues/14436#note_301167
# [2]: https://unix.stackexchange.com/questions/475226
#
# Install Clang and the LLVM linker.
RUN apk add clang20 compiler-rt linux-headers lld20
# Make Clang use its own compiler runtime.
ENV CC=clang CFLAGS='-fuse-ld=lld -rtlib=compiler-rt'
# Remove gcc and the libgcc development stuff.
RUN for i in $(sudo apk info -L gcc); do rm "$i"; done
# Remove GNU ld(1).
RUN rm /usr/bin/ld \
&& ln -s lld /usr/bin/ld
# oras(1) to save/restore artifacts we want to pass between jobs that won’t
# fit in the CI artifacts or cache.
WORKDIR /usr/src
RUN version=1.2.3 \
&& base=https://github.com/oras-project/oras/releases/download/v${version} \
&& file=oras_${version}_linux_$(arch.sh).tar.gz \
&& wget -nv $base/$file \
&& mkdir oras-${version} \
&& cd oras-${version} \
&& tar xf ../$file \
&& mv oras /usr/bin \
&& oras version
### Other Charliecloud dependencies.
# SquashFUSE
WORKDIR /usr/src
RUN git clone https://github.com/vasi/squashfuse.git
WORKDIR ./squashfuse
RUN git checkout $(git tag | egrep -v '^v' | sort -V | tail -1) \
&& git status
RUN ./autogen.sh \
&& ./configure --prefix=/usr \
&& make -j$(nproc) install \
&& rm -Rf squashfuse*
RUN command -v squashfuse \
&& ldd $(command -v squashfuse) \
&& squashfuse --version 2>&1 | head -1
# ShellCheck
WORKDIR /usr/src
RUN wget -nv -O shellcheck.tar.gz \
https://github.com/koalaman/shellcheck/releases/download/stable/shellcheck-stable.linux.$(uname -m).tar.xz \
&& tar xf shellcheck.tar.gz \
&& mv shellcheck-stable/shellcheck /usr/bin \
&& rm -Rf shellcheck*
RUN command -v shellcheck \
&& shellcheck --version
# Sphinx. Use latest version in case it breaks things.
RUN pip3 install --break-system-packages docutils \
sphinx \
sphinx-rtd-theme \
sphinx-reredirects \
&& command -v sphinx-build \
&& sphinx-build --version
# At present we use argp to parse command line arguments. This is a glibc
# extension (see #1260). Thus, install a stand-alone argp.
WORKDIR /usr/src
RUN git clone --depth=1 https://github.com/ericonr/argp-standalone.git \
&& cd argp-standalone \
&& autoreconf --force --install \
&& ./configure \
&& make -j$(nproc) \
&& ls -lh /usr/include \
&& install -D -m644 argp.h /usr/include/argp.h \
&& install -D -m755 libargp.a /usr/lib/libargp.a
# git2dot with our bugfixes
RUN git clone https://github.com/hpc/git2dot.git \
&& cd git2dot \
&& make install \
&& git2dot.py --version
# Misc pip
RUN pip3 install --break-system-packages lark
### Environment setup (privileged)
# Make some directories writeable for all users.
RUN mkdir /usr/local/src \
&& chmod 1777 /mnt /usr/local/src
# What is using the most disk space?
RUN du -hax / | sort -h | tail -48
# sudo(8) umask
RUN echo 'Defaults umask = 0077' >> /etc/sudoers.d/LOCAL \
&& umask \
&& sudo /bin/sh -c umask
# Unset setuid on all fusermount3.
RUN chmod -v u-s /usr/bin/fusermount* \
&& ls -lh $(command -v fusermount3) \
&& ! test -u $(command -v fusermount3)
# Create unprivileged user. The adduser(8) options suppress interactive
# questions that cause warnings.
RUN adduser --disabled-password --gecos='Gukesh Dommaraju,,,' gukesh \
&& adduser gukesh wheel \
&& id gukesh
# Passwordless sudo(8), including user root with group non-root.
RUN echo '%wheel ALL = (ALL:ALL) NOPASSWD: ALL' >> /etc/sudoers.d/LOCAL
# Make gukesh the default.
USER gukesh
### Environment setup (unprivileged)
# Validate passwordless sudo(8).
RUN sudo true
# Alpine does *not* have a merged /usr.
ENV PATH=/usr/local/bin:/usr/bin:/bin
# Don’t have a weird default $CWD.
WORKDIR /
# Make it testable whether we’re in our container.
ENV WEIRD_AL_YANKOVIC_IS_THE_GREATEST_MUSICIAN_OF_ALL_TIME=yes
# Time zone.
ENV TZ=America/Denver
RUN date +'%c %Z'
# Configure Git.
RUN git config --global user.name 'Judit Polgár' \
&& git config --global user.email judit@example.com \
&& git config --global core.excludesfile ~/.gitignore \
&& git config --global init.defaultBranch main \
&& git config --global safe.directory '*' \
&& echo __ch-test_ignore__ >> ~/.gitignore
### Charliecloud build smoke test
#WORKDIR /usr/local/src
#RUN git clone https://gitlab.com/charliecloud/charliecloud.git \
# && cd charliecloud \
# && ./autogen.sh \
# && ./configure --with-gc=yes --with-json=yes --with-squashfuse=yes \
# && make \
# && bin/ch-run --version
|
