| 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # |
| 3 | # The sandbox's Linux: what `g1t-runner sandbox up` runs on a person's own |
| 4 | # computer, in a VM of the runner's own (crates/runner/src/selfhosted/launcher/). |
| 5 | # It holds a Docker Engine with Sysbox and the runner's binary; the runner |
| 6 | # itself runs as the runner's image (deploy/runner/Dockerfile) under |
| 7 | # `--runtime=sysbox-runc`, as on a Linux server, and each job is a container |
| 8 | # inside that. Three walls from the computer: the job's container, the |
| 9 | # runner's Sysbox container, and the VM. |
| 10 | # |
| 11 | # Two targets, built by scripts/sandbox-image.mjs for each release: |
| 12 | # |
| 13 | # wsl A root filesystem for a WSL distribution on Windows (`wsl --import`), |
| 14 | # with /etc/wsl.conf turning off drives, Windows programs and PATH. |
| 15 | # vm The same with a kernel and systemd, made into a disk for a VM on |
| 16 | # macOS (vfkit) or Linux (QEMU) with no shared folders. |
| 17 | # |
| 18 | # Build context: this folder plus `g1t-runner`, the static Linux build for |
| 19 | # the image's platform. |
| 20 | |
| 21 | FROM docker:28-dind AS docker |
| 22 | |
| 23 | FROM debian:bookworm-slim AS sysbox |
| 24 | ARG TARGETARCH |
| 25 | # Sysbox 0.7 or later: earlier ones cannot run runc 1.2's checks of /proc |
| 26 | # inside a Sysbox container ("unsafe procfs detected"), which Docker 28's |
| 27 | # runc does. Pinned by SHA-256. |
| 28 | ARG SYSBOX_VERSION=0.7.1 |
| 29 | ARG SYSBOX_SHA256_AMD64=9d6d5484f980d0a17f86c492c1262015c2afb66280bdb97215b79fde6a0261c5 |
| 30 | ARG SYSBOX_SHA256_ARM64=04ca894ae0b53f0fa54eaacc173ce40363c9a95ea5450f773716a84ef650a69b |
| 31 | ADD https://github.com/nestybox/sysbox/releases/download/v${SYSBOX_VERSION}/sysbox-ce_${SYSBOX_VERSION}.linux_${TARGETARCH}.deb /tmp/sysbox.deb |
| 32 | RUN expected="$([ "$TARGETARCH" = arm64 ] && echo "$SYSBOX_SHA256_ARM64" || echo "$SYSBOX_SHA256_AMD64")" \ |
| 33 | && echo "$expected /tmp/sysbox.deb" | sha256sum -c - \ |
| 34 | && dpkg-deb -x /tmp/sysbox.deb /tmp/sysbox \ |
| 35 | && mkdir -p /out && cp /tmp/sysbox/usr/bin/sysbox-runc /tmp/sysbox/usr/bin/sysbox-mgr /tmp/sysbox/usr/bin/sysbox-fs /out/ |
| 36 | |
| 37 | FROM debian:bookworm-slim AS base |
| 38 | # iptables: the engine's networks and the rules that keep jobs off the |
| 39 | # computer; rsync and fuse3: Sysbox's; e2fsprogs and util-linux: the VM's |
| 40 | # state disk. |
| 41 | RUN apt-get update \ |
| 42 | && apt-get install -y --no-install-recommends ca-certificates iptables rsync fuse3 procps kmod e2fsprogs util-linux \ |
| 43 | && rm -rf /var/lib/apt/lists/* /var/cache/apt/* \ |
| 44 | && mkdir -p /var/lib/g1t-sandbox/state /etc/docker |
| 45 | COPY --from=docker /usr/local/bin/dockerd /usr/local/bin/containerd /usr/local/bin/containerd-shim-runc-v2 \ |
| 46 | /usr/local/bin/runc /usr/local/bin/docker-proxy /usr/local/bin/docker-init /usr/local/bin/docker /usr/local/bin/ |
| 47 | COPY --from=sysbox /out/ /usr/local/bin/ |
| 48 | COPY --chmod=0755 g1t-runner /usr/local/bin/g1t-runner |
| 49 | ARG IMAGE_VERSION=dev |
| 50 | RUN echo "$IMAGE_VERSION" > /etc/g1t-sandbox-version |
| 51 | |
| 52 | FROM base AS wsl |
| 53 | COPY wsl.conf /etc/wsl.conf |
| 54 | |
| 55 | FROM base AS vm |
| 56 | # A kernel, an init, and the unit that runs the sandbox at boot. The VM's |
| 57 | # console (hvc0) is where it says how it is (launcher/vm.rs reads it). |
| 58 | RUN apt-get update \ |
| 59 | && apt-get install -y --no-install-recommends systemd systemd-sysv "linux-image-cloud-$(dpkg --print-architecture)" \ |
| 60 | && rm -rf /var/lib/apt/lists/* /var/cache/apt/* \ |
| 61 | && echo g1t-sandbox > /etc/hostname \ |
| 62 | && systemctl mask getty@tty1.service serial-getty@hvc0.service serial-getty@ttyS0.service |
| 63 | COPY g1t-sandbox.service /etc/systemd/system/g1t-sandbox.service |
| 64 | COPY vm-network.network /etc/systemd/network/80-g1t.network |
| 65 | RUN systemctl enable g1t-sandbox.service systemd-networkd.service systemd-resolved.service |