From 9bb838f456e0395ce97b9aff01b248bdfd8b509a Mon Sep 17 00:00:00 2001 From: Joshua White Date: Tue, 8 Sep 2026 14:28:22 -0700 Subject: [PATCH 1/2] Initial fix implementation for docker caching issue --- .github/workflows/docker_build_tpls.yml | 4 ++++ docker/tpl-rockylinux.Dockerfile | 3 ++- docker/tpl-ubuntu-hip.Dockerfile | 3 ++- docker/tpl-ubuntu.Dockerfile | 1 + scripts/docker-build.sh | 2 +- 5 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker_build_tpls.yml b/.github/workflows/docker_build_tpls.yml index d900a231..c85574ce 100644 --- a/.github/workflows/docker_build_tpls.yml +++ b/.github/workflows/docker_build_tpls.yml @@ -181,10 +181,12 @@ jobs: lfs: true - name: Set up Docker Buildx + id: buildx_hosted if: matrix.RUNS_ON != 'streak2' uses: docker/setup-buildx-action@v4 - name: Set up Docker Buildx + id: buildx_streak2 if: matrix.RUNS_ON == 'streak2' uses: docker/setup-buildx-action@v4 with: @@ -256,6 +258,8 @@ jobs: COMMIT: ${{ github.sha }} BUILD_DIR: ${{ github.workspace }} DOCKER_TAG: ${{ github.event.number }}-${{ github.run_number }} + DOCKER_BUILDER: ${{ steps.buildx_streak2.outputs.name || steps.buildx_hosted.outputs.name }} + DOCKER_LOAD: 1 DOCKER_NETWORK: ${{ matrix.RUNS_ON == 'streak2' && 'host' || '' }} run: bash -x ./scripts/docker-build.sh diff --git a/docker/tpl-rockylinux.Dockerfile b/docker/tpl-rockylinux.Dockerfile index 856435c1..66eaa3e4 100644 --- a/docker/tpl-rockylinux.Dockerfile +++ b/docker/tpl-rockylinux.Dockerfile @@ -25,7 +25,8 @@ ENV GEOSX_TPL_DIR=$INSTALL_DIR # (curl vs curl-minimal, etc.); here we only add things the base images # don't preinstall. RUN dnf clean all && \ - dnf -y install dnf-plugins-core || true && \ + dnf -y upgrade --refresh && \ + (dnf -y install dnf-plugins-core || true) && \ (dnf config-manager --set-enabled powertools 2>/dev/null || \ dnf config-manager --set-enabled crb 2>/dev/null || \ dnf config-manager --set-enabled devel 2>/dev/null || true) && \ diff --git a/docker/tpl-ubuntu-hip.Dockerfile b/docker/tpl-ubuntu-hip.Dockerfile index 0c965574..da9e7110 100644 --- a/docker/tpl-ubuntu-hip.Dockerfile +++ b/docker/tpl-ubuntu-hip.Dockerfile @@ -46,7 +46,8 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ > /etc/apt/apt.conf.d/99-llnl-ca; \ fi && \ ln -fs /usr/share/zoneinfo/America/Los_Angeles /etc/localtime && \ - apt-get update + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get upgrade -y # Packages needed both for the TPL build and for the downstream GEOS build, # plus the ROCm math libraries GEOS links against. diff --git a/docker/tpl-ubuntu.Dockerfile b/docker/tpl-ubuntu.Dockerfile index a27ae817..1d686398 100644 --- a/docker/tpl-ubuntu.Dockerfile +++ b/docker/tpl-ubuntu.Dockerfile @@ -47,6 +47,7 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ > /etc/apt/apt.conf.d/99-llnl-ca; \ fi && \ apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \ DEBIAN_FRONTEND=noninteractive TZ=America/Los_Angeles \ apt-get install -y --no-install-recommends \ ca-certificates \ diff --git a/scripts/docker-build.sh b/scripts/docker-build.sh index d057db65..bffaa777 100644 --- a/scripts/docker-build.sh +++ b/scripts/docker-build.sh @@ -52,7 +52,7 @@ for v in HTTP_PROXY HTTPS_PROXY NO_PROXY http_proxy https_proxy no_proxy; do fi done -docker build --progress=plain \ +docker buildx build --progress=plain \ "${BUILDER_ARGS[@]}" \ --build-arg HOST_CONFIG=${HOST_CONFIG} \ --build-arg DOCKER_BASE_IMAGE=${DOCKER_BASE_IMAGE} \ From 439ed95c49b218e27687675433499c911c711ee8 Mon Sep 17 00:00:00 2001 From: Joshua White Date: Wed, 9 Sep 2026 17:28:48 -0700 Subject: [PATCH 2/2] Address identified sphinx package load issue --- .github/workflows/docker_build_tpls.yml | 16 ++++++++++++++++ docker/tpl-rockylinux.Dockerfile | 3 +-- docker/tpl-ubuntu-hip.Dockerfile | 14 +++++++++----- docker/tpl-ubuntu.Dockerfile | 9 +++++++-- scripts/docker-build.sh | 6 +++++- 5 files changed, 38 insertions(+), 10 deletions(-) diff --git a/.github/workflows/docker_build_tpls.yml b/.github/workflows/docker_build_tpls.yml index c85574ce..76b930fb 100644 --- a/.github/workflows/docker_build_tpls.yml +++ b/.github/workflows/docker_build_tpls.yml @@ -184,12 +184,15 @@ jobs: id: buildx_hosted if: matrix.RUNS_ON != 'streak2' uses: docker/setup-buildx-action@v4 + with: + cleanup: true - name: Set up Docker Buildx id: buildx_streak2 if: matrix.RUNS_ON == 'streak2' uses: docker/setup-buildx-action@v4 with: + cleanup: true driver-opts: network=host - name: Print environment @@ -276,6 +279,19 @@ jobs: DOCKER_TAG: ${{ github.event.number }}-${{ github.run_number }} run: docker push ${DOCKER_REPOSITORY}:${DOCKER_TAG} + - name: Remove local Docker image + if: always() && matrix.RUNS_ON == 'streak2' + env: + DOCKER_REPOSITORY: ${{ matrix.DOCKER_REPOSITORY }} + DOCKER_TAG: ${{ github.event.number }}-${{ github.run_number }} + run: | + image="${DOCKER_REPOSITORY}:${DOCKER_TAG}" + if docker image inspect "${image}" >/dev/null 2>&1; then + docker image rm "${image}" || echo "::warning::Failed to remove local image ${image}" + else + echo "No local image to remove: ${image}" + fi + # Convenience job - passes when all docker images are built. check_that_all_images_built: runs-on: ubuntu-22.04 diff --git a/docker/tpl-rockylinux.Dockerfile b/docker/tpl-rockylinux.Dockerfile index 66eaa3e4..856435c1 100644 --- a/docker/tpl-rockylinux.Dockerfile +++ b/docker/tpl-rockylinux.Dockerfile @@ -25,8 +25,7 @@ ENV GEOSX_TPL_DIR=$INSTALL_DIR # (curl vs curl-minimal, etc.); here we only add things the base images # don't preinstall. RUN dnf clean all && \ - dnf -y upgrade --refresh && \ - (dnf -y install dnf-plugins-core || true) && \ + dnf -y install dnf-plugins-core || true && \ (dnf config-manager --set-enabled powertools 2>/dev/null || \ dnf config-manager --set-enabled crb 2>/dev/null || \ dnf config-manager --set-enabled devel 2>/dev/null || true) && \ diff --git a/docker/tpl-ubuntu-hip.Dockerfile b/docker/tpl-ubuntu-hip.Dockerfile index da9e7110..10879e0d 100644 --- a/docker/tpl-ubuntu-hip.Dockerfile +++ b/docker/tpl-ubuntu-hip.Dockerfile @@ -18,6 +18,7 @@ ARG BLD_DIR=$TMP_DIR/build ARG DOCKER_BASE_IMAGE=rocm/dev-ubuntu-24.04:6.4.3 FROM ${DOCKER_BASE_IMAGE} AS tpl_toolchain_intersect_geosx_toolchain ARG SRC_DIR +ARG SPEC # streak2 hosts can enable kernel FIPS mode even though this Ubuntu image has # no FIPS provider. Use OpenSSL's default provider for package downloads and @@ -46,11 +47,12 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ > /etc/apt/apt.conf.d/99-llnl-ca; \ fi && \ ln -fs /usr/share/zoneinfo/America/Los_Angeles /etc/localtime && \ - apt-get update && \ - DEBIAN_FRONTEND=noninteractive apt-get upgrade -y + apt-get update # Packages needed both for the TPL build and for the downstream GEOS build, -# plus the ROCm math libraries GEOS links against. +# plus the ROCm math libraries GEOS links against. Sphinx is limited to +# documentation builds because it pulls system Jinja2 and certifi packages +# that can trigger host filesystem scanners. RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ wget \ gnupg \ @@ -69,7 +71,6 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ python3 \ python3-dev \ python3-pip \ - python3-sphinx \ doxygen \ pkg-config \ xz-utils \ @@ -98,6 +99,10 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ rocrand-dev \ rocthrust-dev \ git && \ + if printf '%s\n' "${SPEC}" | grep -Eq '(^|[[:space:]])\+docs($|[[:space:]])'; then \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + python3-sphinx ; \ + fi && \ if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ mkdir -p /usr/local/share/ca-certificates && \ awk 'BEGIN {n=0} /-----BEGIN/ {n++; f=sprintf("/usr/local/share/ca-certificates/llnl-%03d.crt", n)} n>0 {print > f}' \ @@ -242,7 +247,6 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update && \ ghostscript \ ninja-build \ python3-dev \ - python3-sphinx \ python3-mpi4py \ python3-scipy \ python3-virtualenv \ diff --git a/docker/tpl-ubuntu.Dockerfile b/docker/tpl-ubuntu.Dockerfile index 1d686398..542fc29b 100644 --- a/docker/tpl-ubuntu.Dockerfile +++ b/docker/tpl-ubuntu.Dockerfile @@ -21,6 +21,7 @@ ARG DOCKER_BASE_IMAGE=ubuntu:24.04 FROM ${DOCKER_BASE_IMAGE} AS tpl_toolchain_intersect_geosx_toolchain ARG SRC_DIR ARG CLANG_VERSION +ARG SPEC # streak2 hosts can enable kernel FIPS mode even though this Ubuntu image has # no FIPS provider. Use OpenSSL's default provider for the image's package @@ -40,6 +41,8 @@ ENV GEOSX_TPL_DIR=$INSTALL_DIR # The streak2 workflow injects the LLNL CA bundle before this stage. Configure # APT to use that bundle before the first update, since the base image does not # yet trust the runner's MITM certificate and ca-certificates is installed below. +# Sphinx is limited to documentation builds because it pulls system Jinja2 and +# certifi packages that can trigger host filesystem scanners. RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ mkdir -p /etc/apt/apt.conf.d && \ printf '%s\n' \ @@ -47,7 +50,6 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ > /etc/apt/apt.conf.d/99-llnl-ca; \ fi && \ apt-get update && \ - DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \ DEBIAN_FRONTEND=noninteractive TZ=America/Los_Angeles \ apt-get install -y --no-install-recommends \ ca-certificates \ @@ -57,7 +59,6 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ openmpi-bin \ libopenmpi-dev \ python3-pip \ - python3-sphinx \ python3-dev \ python3-venv \ python3-virtualenv \ @@ -68,6 +69,10 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ lbzip2 \ bzip2 \ gnupg && \ + if printf '%s\n' "${SPEC}" | grep -Eq '(^|[[:space:]])\+docs($|[[:space:]])'; then \ + DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + python3-sphinx ; \ + fi && \ if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \ mkdir -p /usr/local/share/ca-certificates && \ awk 'BEGIN {n=0} /-----BEGIN/ {n++; f=sprintf("/usr/local/share/ca-certificates/llnl-%03d.crt", n)} n>0 {print > f}' \ diff --git a/scripts/docker-build.sh b/scripts/docker-build.sh index bffaa777..5267de8a 100644 --- a/scripts/docker-build.sh +++ b/scripts/docker-build.sh @@ -42,7 +42,11 @@ if [ -n "${SPACK_BUILD_JOBS:-}" ]; then EXTRA_BUILD_ARGS+=(--build-arg "SPACK_BU BUILDER_ARGS=() if [ -n "${DOCKER_BUILDER:-}" ]; then BUILDER_ARGS+=(--builder "${DOCKER_BUILDER}"); fi -if [ "${DOCKER_LOAD:-0}" = 1 ]; then BUILDER_ARGS+=(--load); fi +case "${DOCKER_LOAD:-1}" in + 1) BUILDER_ARGS+=(--load) ;; + 0) ;; + *) echo "DOCKER_LOAD must be 0 or 1" >&2; exit 2 ;; +esac if [ -n "${DOCKER_NETWORK:-}" ]; then BUILDER_ARGS+=(--network "${DOCKER_NETWORK}"); fi # Forward proxy settings into RUN steps (BuildKit special-cases these args).