Docker build caching leading to security scan failures on streak2

.github/workflows/docker_build_tpls.yml

@@ -181,13 +181,18 @@ jobs:
         lfs: true
 
     - name: Set up Docker Buildx
+      id: buildx_hosted
       if: matrix.RUNS_ON != 'streak2'
       uses: docker/setup-buildx-action@v4
+      with:
+        cleanup: true
 
     - name: Set up Docker Buildx
+      id: buildx_streak2
       if: matrix.RUNS_ON == 'streak2'
       uses: docker/setup-buildx-action@v4
       with:
+        cleanup: true
         driver-opts: network=host
 
     - name: Print environment
@@ -256,6 +261,8 @@ jobs:
         COMMIT: ${{ github.sha }}
         BUILD_DIR: ${{ github.workspace }}
         DOCKER_TAG: ${{ github.event.number }}-${{ github.run_number }}
+        DOCKER_BUILDER: ${{ steps.buildx_streak2.outputs.name || steps.buildx_hosted.outputs.name }}
+        DOCKER_LOAD: 1
         DOCKER_NETWORK: ${{ matrix.RUNS_ON == 'streak2' && 'host' || '' }}
       run: bash -x ./scripts/docker-build.sh
 
@@ -272,6 +279,19 @@ jobs:
         DOCKER_TAG: ${{ github.event.number }}-${{ github.run_number }}
       run: docker push ${DOCKER_REPOSITORY}:${DOCKER_TAG}
 
+    - name: Remove local Docker image
+      if: always() && matrix.RUNS_ON == 'streak2'
+      env:
+        DOCKER_REPOSITORY: ${{ matrix.DOCKER_REPOSITORY }}
+        DOCKER_TAG: ${{ github.event.number }}-${{ github.run_number }}
+      run: |
+        image="${DOCKER_REPOSITORY}:${DOCKER_TAG}"
+        if docker image inspect "${image}" >/dev/null 2>&1; then
+          docker image rm "${image}" || echo "::warning::Failed to remove local image ${image}"
+        else
+          echo "No local image to remove: ${image}"
+        fi
+
   # Convenience job - passes when all docker images are built.
   check_that_all_images_built:
     runs-on: ubuntu-22.04

docker/tpl-ubuntu-hip.Dockerfile

@@ -18,6 +18,7 @@ ARG BLD_DIR=$TMP_DIR/build
 ARG DOCKER_BASE_IMAGE=rocm/dev-ubuntu-24.04:6.4.3
 FROM ${DOCKER_BASE_IMAGE} AS tpl_toolchain_intersect_geosx_toolchain
 ARG SRC_DIR
+ARG SPEC
 
 # streak2 hosts can enable kernel FIPS mode even though this Ubuntu image has
 # no FIPS provider. Use OpenSSL's default provider for package downloads and
@@ -49,7 +50,9 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \
     apt-get update
 
 # Packages needed both for the TPL build and for the downstream GEOS build,
-# plus the ROCm math libraries GEOS links against.
+# plus the ROCm math libraries GEOS links against. Sphinx is limited to
+# documentation builds because it pulls system Jinja2 and certifi packages
+# that can trigger host filesystem scanners.
 RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         wget \
         gnupg \
@@ -68,7 +71,6 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         python3 \
         python3-dev \
         python3-pip \
-        python3-sphinx \
         doxygen \
         pkg-config \
         xz-utils \
@@ -97,6 +99,10 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         rocrand-dev \
         rocthrust-dev \
         git && \
+    if printf '%s\n' "${SPEC}" | grep -Eq '(^|[[:space:]])\+docs($|[[:space:]])'; then \
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        python3-sphinx ; \
+    fi && \
     if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \
       mkdir -p /usr/local/share/ca-certificates && \
       awk 'BEGIN {n=0} /-----BEGIN/ {n++; f=sprintf("/usr/local/share/ca-certificates/llnl-%03d.crt", n)} n>0 {print > f}' \
@@ -241,7 +247,6 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
     ghostscript \
     ninja-build \
     python3-dev \
-    python3-sphinx \
     python3-mpi4py \
     python3-scipy \
     python3-virtualenv \

docker/tpl-ubuntu.Dockerfile

@@ -21,6 +21,7 @@ ARG DOCKER_BASE_IMAGE=ubuntu:24.04
 FROM ${DOCKER_BASE_IMAGE} AS tpl_toolchain_intersect_geosx_toolchain
 ARG SRC_DIR
 ARG CLANG_VERSION
+ARG SPEC
 
 # streak2 hosts can enable kernel FIPS mode even though this Ubuntu image has
 # no FIPS provider. Use OpenSSL's default provider for the image's package
@@ -40,6 +41,8 @@ ENV GEOSX_TPL_DIR=$INSTALL_DIR
 # The streak2 workflow injects the LLNL CA bundle before this stage. Configure
 # APT to use that bundle before the first update, since the base image does not
 # yet trust the runner's MITM certificate and ca-certificates is installed below.
+# Sphinx is limited to documentation builds because it pulls system Jinja2 and
+# certifi packages that can trigger host filesystem scanners.
 RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \
       mkdir -p /etc/apt/apt.conf.d && \
       printf '%s\n' \
@@ -56,7 +59,6 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \
         openmpi-bin \
         libopenmpi-dev \
         python3-pip \
-        python3-sphinx \
         python3-dev \
         python3-venv \
         python3-virtualenv \
@@ -67,6 +69,10 @@ RUN if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \
         lbzip2 \
         bzip2 \
         gnupg && \
+    if printf '%s\n' "${SPEC}" | grep -Eq '(^|[[:space:]])\+docs($|[[:space:]])'; then \
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        python3-sphinx ; \
+    fi && \
     if [ -f /etc/ssl/certs/llnl-ca-bundle.crt ]; then \
       mkdir -p /usr/local/share/ca-certificates && \
       awk 'BEGIN {n=0} /-----BEGIN/ {n++; f=sprintf("/usr/local/share/ca-certificates/llnl-%03d.crt", n)} n>0 {print > f}' \

scripts/docker-build.sh

@@ -42,7 +42,11 @@ if [ -n "${SPACK_BUILD_JOBS:-}" ]; then EXTRA_BUILD_ARGS+=(--build-arg "SPACK_BU
 
 BUILDER_ARGS=()
 if [ -n "${DOCKER_BUILDER:-}" ]; then BUILDER_ARGS+=(--builder "${DOCKER_BUILDER}"); fi
-if [ "${DOCKER_LOAD:-0}" = 1 ]; then BUILDER_ARGS+=(--load); fi
+case "${DOCKER_LOAD:-1}" in
+    1) BUILDER_ARGS+=(--load) ;;
+    0) ;;
+    *) echo "DOCKER_LOAD must be 0 or 1" >&2; exit 2 ;;
+esac
 if [ -n "${DOCKER_NETWORK:-}" ]; then BUILDER_ARGS+=(--network "${DOCKER_NETWORK}"); fi
 
 # Forward proxy settings into RUN steps (BuildKit special-cases these args).
@@ -52,7 +56,7 @@ for v in HTTP_PROXY HTTPS_PROXY NO_PROXY http_proxy https_proxy no_proxy; do
     fi
 done
 
-docker build --progress=plain \
+docker buildx build --progress=plain \
     "${BUILDER_ARGS[@]}" \
     --build-arg HOST_CONFIG=${HOST_CONFIG} \
     --build-arg DOCKER_BASE_IMAGE=${DOCKER_BASE_IMAGE} \