ENT-13867: Added RHEL 8,9,10 support to build in container #2338
+139
−15
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| ARG BASE_IMAGE=rockylinux/rockylinux:9 | ||
| FROM ${BASE_IMAGE} | ||
|
Contributor
There was a problem hiding this comment. I don't think we should duplicate in a different way what we do in the build host setup. I would be fine with choosing either policy or scripts but not both.
Contributor
Author
There was a problem hiding this comment. @craigcomstock I took https://github.com/cfengine/buildscripts/blob/master/container/Dockerfile.debian as reference, you mean install cfengine to install dependencies? If yes I'd like to have scripts rather than policies in this case to avoid chicken\egg problem when new platforms added. |
||
|
|
||
| # allow older packages when the newest has unmet deps (as build hosts do). | ||
| RUN echo "best=False" >> /etc/dnf/dnf.conf | ||
|
|
||
| # Enable CRB (crb on 9+, powertools on 8) + EPEL for the -devel/build packages. | ||
| ARG CRB_REPO=crb | ||
| RUN dnf install -y dnf-plugins-core epel-release \ | ||
| && dnf config-manager --set-enabled ${CRB_REPO} \ | ||
| && dnf clean all | ||
|
|
||
| # Deps like zlib build without full debug symbols; disable debuginfo extraction | ||
| # so rpm doesn't abort with "No debugging symbols". We don't ship debuginfo here. | ||
| RUN echo '%debug_package %{nil}' > /etc/rpm/macros.cfengine-nodebug | ||
|
|
||
| # Build toolchain (see redhat section of ci/cfengine-build-host-setup.cf). | ||
| # "Development Tools" provides gcc, make, autotools, rpm-build, core perl, etc. | ||
| RUN dnf groupinstall -y "Development Tools" \ | ||
| && dnf install -y \ | ||
| gcc-c++ pam-devel ncurses ncurses-devel expat expat-devel gettext \ | ||
| rpm-build-libs selinux-policy selinux-policy-devel \ | ||
| pkgconf pkgconf-pkg-config \ | ||
| perl perl-Module-Load-Conditional perl-ExtUtils-MakeMaker perl-IPC-Cmd \ | ||
| perl-IO-Compress \ | ||
| python3 python3-pip python3-devel \ | ||
| git rsync wget which psmisc unzip diffutils file sudo \ | ||
| && dnf clean all | ||
|
|
||
| # Hub tools: Node 20 (system nodejs too old for the node: protocol) + less. | ||
| RUN curl -fsSL https://rpm.nodesource.com/setup_20.x | bash - \ | ||
| && dnf install -y nodejs \ | ||
| && dnf clean all | ||
| RUN npm install -g less | ||
|
|
||
| ARG PHP_MODULE_STREAM="" | ||
| RUN if [ -n "${PHP_MODULE_STREAM}" ]; then \ | ||
| dnf install -y https://rpms.remirepo.net/enterprise/remi-release-$(rpm -E %rhel).rpm \ | ||
| && dnf module reset -y php \ | ||
| && dnf module enable -y php:${PHP_MODULE_STREAM}; \ | ||
| fi \ | ||
| && dnf install -y php-cli php-xml php-mbstring \ | ||
| && (dnf install -y php-json || true) \ | ||
| && (dnf install -y php-zip || dnf install -y php-pecl-zip || true) \ | ||
| && dnf clean all | ||
| RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer.phar | ||
|
|
||
| # Rust + protobuf for the cargo-based leech2 dep (prebuilt tarballs, shared with Debian). | ||
| COPY --from=ci linux-install-protobuf.sh linux-install-rust.sh /tmp/ | ||
| RUN /tmp/linux-install-protobuf.sh | ||
| RUN /tmp/linux-install-rust.sh | ||
|
|
||
| # Per-version extras (rhel-8: cfbs py3_shebang_fix macro; rhel-10: patch). | ||
| RUN if [ -n "${EXTRA_PKGS}" ]; then dnf install -y ${EXTRA_PKGS} && dnf clean all; fi | ||
|
|
||
| # Build user with passwordless sudo (needed by install-dependencies, package, etc.) | ||
| RUN useradd -m -s /bin/bash builder \ | ||
| && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder | ||
|
|
||
| USER builder | ||
| WORKDIR /home/builder | ||
|
|
||
| # Pre-create so a volume mounted here is owned by builder, not root. | ||
| RUN mkdir -p /home/builder/build | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ideally we will use these to build our packages so it seems we should use ubi/rhel images and not rocky.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I looked into UBI, but its repos only contain a free redistributable subset of RHEL, and some packages we need to build (bison, flex, pam-devel, selinux-policy-devel) aren't included, see the public repo listing, e.g. no bison in the appstream: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/b/ . Getting them on UBI requires RHEL entitlement certs inside the image build.