|
| 1 | +# Copyright OpenSearch Contributors |
| 2 | +# SPDX-License-Identifier: Apache-2.0 |
| 3 | +# |
| 4 | +# The OpenSearch Contributors require contributions made to |
| 5 | +# this file be licensed under the Apache-2.0 license or a |
| 6 | +# compatible open source license. |
| 7 | + |
| 8 | +# This is a docker image specifically for setting up systemd env base for services with root user |
| 9 | +# It is initially designed to test pkg installation, but can be used for anything that requires systemd |
| 10 | +# It used the method posted by Daniel Walsh: https://developers.redhat.com/blog/2014/05/05/running-systemd-within-docker-container |
| 11 | + |
| 12 | +# In order to run images with systemd, you need to run in privileged mode: `docker run --privileged -it -v /sys/fs/cgroup:/sys/fs/cgroup:ro <image_tag>` |
| 13 | +# If you use this image in jenkins pipeline you need to add these arguments: `args '--entrypoint=/usr/sbin/init -u root --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro'` |
| 14 | + |
| 15 | +# 20230920: On Docker host with systemd version > 247 you need to use these args: |
| 16 | +# https://github.com/opensearch-project/opensearch-build/issues/4047 |
| 17 | +# --entrypoint=/usr/lib/systemd/systemd -u root --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:rw --cgroupns=host |
| 18 | + |
| 19 | +########################### Stage 0 ######################## |
| 20 | + |
| 21 | +FROM ubuntu:24.04 AS linux_stage_0 |
| 22 | + |
| 23 | +ENV container docker |
| 24 | +ARG CONTAINER_USER=ci-runner |
| 25 | +ARG CONTAINER_USER_HOME=/home/ci-runner |
| 26 | + |
| 27 | +# Remove ubuntu user which occupies the 1000 userid and groupid since 23.04 |
| 28 | +# https://bugs.launchpad.net/cloud-images/+bug/2005129 |
| 29 | +USER 0 |
| 30 | +RUN touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu |
| 31 | + |
| 32 | +SHELL ["/bin/bash", "-c"] |
| 33 | + |
| 34 | +ARG DEBIAN_FRONTEND=noninteractive |
| 35 | + |
| 36 | +# Install necessary packages |
| 37 | +RUN apt-get update -y && apt-get upgrade -y && apt-get install -y curl git gnupg2 tar procps build-essential cmake zip unzip jq && \ |
| 38 | + apt-get install -y libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libnss3 libxss1 xauth xvfb && \ |
| 39 | + apt-get install -y libxrender1 libxi6 libxtst6 libasound2t64 && \ |
| 40 | + apt-get install -y libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libatspi2.0-dev libxcomposite-dev libxdamage1 libxfixes3 libxfixes-dev libxrandr2 libgbm-dev libxkbcommon-x11-0 libpangocairo-1.0-0 libcairo2 libcairo2-dev libnss3 libnspr4 libnspr4-dev && \ |
| 41 | + apt-get clean -y |
| 42 | + |
| 43 | +# Install yq |
| 44 | +COPY --chown=0:0 config/yq-setup.sh /tmp/ |
| 45 | +RUN /tmp/yq-setup.sh |
| 46 | + |
| 47 | +# Create user group |
| 48 | +RUN groupadd -g 1000 $CONTAINER_USER && \ |
| 49 | + useradd -u 1000 -g 1000 -s /bin/bash -d $CONTAINER_USER_HOME -m $CONTAINER_USER && \ |
| 50 | + mkdir -p $CONTAINER_USER_HOME && \ |
| 51 | + chown -R 1000:1000 $CONTAINER_USER_HOME |
| 52 | + |
| 53 | +# Change User |
| 54 | +USER $CONTAINER_USER |
| 55 | +WORKDIR $CONTAINER_USER_HOME |
| 56 | + |
| 57 | +# Hard code node version and yarn version for now |
| 58 | +# nvm environment variables |
| 59 | +ENV NVM_DIR $CONTAINER_USER_HOME/.nvm |
| 60 | +ENV NODE_VERSION 20.18.3 |
| 61 | +ENV CYPRESS_VERSION 12.13.0 |
| 62 | +ARG CYPRESS_VERSION_LIST="5.6.0 9.5.4 12.13.0" |
| 63 | +ENV CYPRESS_LOCATION $CONTAINER_USER_HOME/.cache/Cypress/$CYPRESS_VERSION |
| 64 | +ENV CYPRESS_LOCATION_954 $CONTAINER_USER_HOME/.cache/Cypress/9.5.4 |
| 65 | +# install nvm |
| 66 | +# https://github.com/creationix/nvm#install-script |
| 67 | +RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash |
| 68 | +# install node and npm |
| 69 | +RUN source $NVM_DIR/nvm.sh \ |
| 70 | + && nvm install $NODE_VERSION \ |
| 71 | + && nvm alias default $NODE_VERSION \ |
| 72 | + && nvm use default |
| 73 | +# add node and npm to path so the commands are available |
| 74 | +ENV NODE_PATH $NVM_DIR/v$NODE_VERSION/lib/node_modules |
| 75 | +ENV PATH $NVM_DIR/versions/node/v$NODE_VERSION/bin:$PATH |
| 76 | +# install yarn |
| 77 | +COPY --chown=$CONTAINER_USER:$CONTAINER_USER config/yarn-version.sh /tmp |
| 78 | +RUN npm install -g yarn@`/tmp/yarn-version.sh main` |
| 79 | +# Add legacy cypress@5.6.0 for 1.x line |
| 80 | +# Add legacy cypress@9.5.4 for pre-2.8.0 releases |
| 81 | +# Add latest cypress@12.13.0 for post-2.8.0 releases |
| 82 | +RUN for cypress_version in $CYPRESS_VERSION_LIST; do npm install -g cypress@$cypress_version && npm cache verify; done |
| 83 | + |
| 84 | +# Need root to get pass the build due to chrome sandbox needs to own by the root |
| 85 | +USER 0 |
| 86 | + |
| 87 | +# Add legacy cypress 5.6.0 / 9.5.4 for ARM64 Architecture |
| 88 | +RUN if [ `uname -m` = "aarch64" ]; then for cypress_version in 5.6.0 9.5.4; do rm -rf $CONTAINER_USER_HOME/.cache/Cypress/$cypress_version && \ |
| 89 | + curl -SLO https://ci.opensearch.org/ci/dbc/tools/Cypress-$cypress_version-arm64.tar.gz && tar -xzf Cypress-$cypress_version-arm64.tar.gz -C $CONTAINER_USER_HOME/.cache/Cypress/ && \ |
| 90 | + chown $CONTAINER_USER:$CONTAINER_USER -R $CONTAINER_USER_HOME/.cache/Cypress/$cypress_version && rm -vf Cypress-$cypress_version-arm64.tar.gz; done; fi |
| 91 | + |
| 92 | +########################### Stage 1 ######################## |
| 93 | +FROM ubuntu:24.04 |
| 94 | + |
| 95 | +ARG CONTAINER_USER=ci-runner |
| 96 | +ARG CONTAINER_USER_HOME=/home/ci-runner |
| 97 | + |
| 98 | +# Remove ubuntu user which occupies the 1000 userid and groupid since 23.04 |
| 99 | +# https://bugs.launchpad.net/cloud-images/+bug/2005129 |
| 100 | +USER 0 |
| 101 | +RUN touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu |
| 102 | + |
| 103 | +SHELL ["/bin/bash", "-c"] |
| 104 | + |
| 105 | +ARG DEBIAN_FRONTEND=noninteractive |
| 106 | + |
| 107 | +# Install python dependencies |
| 108 | +RUN apt-get update -y && apt-get install -y software-properties-common && add-apt-repository ppa:deadsnakes/ppa -y |
| 109 | + |
| 110 | +# Install necessary packages |
| 111 | +RUN apt-get update -y && apt-get upgrade -y && apt-get install -y curl git gnupg2 tar procps build-essential cmake zip unzip jq && \ |
| 112 | + apt-get install -y libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libnss3 libxss1 xauth xvfb && \ |
| 113 | + apt-get install -y libxrender1 libxi6 libxtst6 libasound2t64 && \ |
| 114 | + apt-get install -y libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libatspi2.0-dev libxcomposite-dev libxdamage1 libxfixes3 libxfixes-dev libxrandr2 libgbm-dev libxkbcommon-x11-0 libpangocairo-1.0-0 libcairo2 libcairo2-dev libnss3 libnspr4 libnspr4-dev && \ |
| 115 | + apt-get install -y mandoc less pigz && \ |
| 116 | + apt-get clean -y |
| 117 | + |
| 118 | +# Install python, update awscli to v2 due to lib conflicts on urllib3 v1 vs v2 |
| 119 | +RUN apt-get update -y && apt-get install -y python3.9-full python3.9-dev && \ |
| 120 | + update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.9 100 && \ |
| 121 | + update-alternatives --install /usr/bin/python python /usr/bin/python3.9 100 && \ |
| 122 | + update-alternatives --set python3 /usr/bin/python3.9 && \ |
| 123 | + update-alternatives --set python /usr/bin/python3.9 && \ |
| 124 | + curl -SL https://bootstrap.pypa.io/get-pip.py | python3 - && \ |
| 125 | + pip3 install awscliv2==2.3.1 pipenv==2023.6.12 cmake==3.26.4 && \ |
| 126 | + ln -s `which awsv2` /usr/local/bin/aws && aws --install |
| 127 | + |
| 128 | +# Create user group |
| 129 | +RUN apt-get install -y sudo && \ |
| 130 | + groupadd -g 1000 $CONTAINER_USER && \ |
| 131 | + useradd -u 1000 -g 1000 -s /bin/bash -d $CONTAINER_USER_HOME -m $CONTAINER_USER && \ |
| 132 | + mkdir -p $CONTAINER_USER_HOME && \ |
| 133 | + chown -R 1000:1000 $CONTAINER_USER_HOME && \ |
| 134 | + groupadd -g 1001 opensearch && \ |
| 135 | + useradd -u 1001 -g 1001 -s /bin/bash -d /home/opensearch -m opensearch && \ |
| 136 | + groupadd -g 1002 opensearch-dashboards && \ |
| 137 | + useradd -u 1002 -g 1002 -s /bin/bash -d /home/opensearch-dashboards -m opensearch-dashboards && \ |
| 138 | + usermod -a -G opensearch $CONTAINER_USER && \ |
| 139 | + usermod -a -G opensearch-dashboards $CONTAINER_USER && \ |
| 140 | + usermod -a -G adm $CONTAINER_USER && \ |
| 141 | + id && \ |
| 142 | + echo "$CONTAINER_USER ALL=(root) NOPASSWD:`which systemctl`, `which env`, `which su`, `which usermod`, `which apt`, `which apt-get`, `which apt-key`, `which dpkg`, `which chmod`, `which kill`, `which curl`, `which tee`, `which rm`, /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin" >> /etc/sudoers.d/$CONTAINER_USER |
| 143 | + |
| 144 | +# Copy from Stage0 |
| 145 | +COPY --from=linux_stage_0 --chown=$CONTAINER_USER:$CONTAINER_USER $CONTAINER_USER_HOME $CONTAINER_USER_HOME |
| 146 | +ENV NVM_DIR $CONTAINER_USER_HOME/.nvm |
| 147 | +ENV NODE_VERSION 20.18.3 |
| 148 | +ENV CYPRESS_VERSION 12.13.0 |
| 149 | +ENV CYPRESS_LOCATION $CONTAINER_USER_HOME/.cache/Cypress/$CYPRESS_VERSION |
| 150 | +ENV NODE_PATH $NVM_DIR/v$NODE_VERSION/lib/node_modules |
| 151 | +ENV PATH $NVM_DIR/versions/node/v$NODE_VERSION/bin:$PATH |
| 152 | + |
| 153 | +# By default, awscliv2 will run with docker fallbacks and requires individual user to run `aws --install` to install binaries |
| 154 | +# https://pypi.org/project/awscliv2/ |
| 155 | +USER $CONTAINER_USER |
| 156 | +RUN aws --install |
| 157 | +USER 0 |
| 158 | + |
| 159 | +# Check dirs |
| 160 | +RUN source $NVM_DIR/nvm.sh && ls -al $CONTAINER_USER_HOME && echo $NODE_VERSION $NVM_DIR && nvm use $NODE_VERSION |
| 161 | + |
| 162 | +# Tools setup |
| 163 | +COPY --chown=0:0 config/jdk-setup.sh config/yq-setup.sh config/gh-setup.sh /tmp/ |
| 164 | +RUN apt-get install -y golang-1.22 && /tmp/jdk-setup.sh && /tmp/yq-setup.sh && /tmp/gh-setup.sh && apt-get clean -y && apt-get autoremove -y |
| 165 | + |
| 166 | +# Setup Shared Memory |
| 167 | +RUN chmod -R 777 /dev/shm |
| 168 | + |
| 169 | +# We use the version test to check if packages installed correctly |
| 170 | +# And get added to the PATH |
| 171 | +# This will fail the docker build if any of the packages not exist |
| 172 | +RUN node -v |
| 173 | +RUN npm -v |
| 174 | +RUN yarn -v |
| 175 | +RUN cypress -v |
| 176 | + |
| 177 | +# Possible retain of multi-user.target.wants later due to PA |
| 178 | +# As of now we do not need this |
| 179 | +RUN apt-get -y install systemd procps util-linux openssl libssl-dev && apt-get clean -y && \ |
| 180 | + systemctl set-default multi-user && \ |
| 181 | +(cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ |
| 182 | +rm -f /lib/systemd/system/multi-user.target.wants/*;\ |
| 183 | +rm -f /etc/systemd/system/*.wants/*;\ |
| 184 | +rm -f /lib/systemd/system/local-fs.target.wants/*; \ |
| 185 | +rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ |
| 186 | +rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ |
| 187 | +rm -f /lib/systemd/system/basic.target.wants/*;\ |
| 188 | +rm -f /lib/systemd/system/anaconda.target.wants/*; |
| 189 | + |
| 190 | +CMD ["/usr/sbin/init"] |
0 commit comments