Skip to content

Commit ae535cd

Browse files
rpardinirpardini
committed
Multi-arch, multi-distro matrix build
1 parent 2cca39d commit ae535cd

12 files changed

+380
-0
lines changed

Diff for: ‎.dockerignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.git
2+
.github
3+
out

Diff for: ‎.github/workflows/main-latest.yml

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
name: main-latest
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
7+
jobs:
8+
9+
prepare:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Prepare release ID
13+
id: prep
14+
run: |
15+
echo ::set-output name=created::$(date -u +'%Y%m%d-%H%M')
16+
outputs:
17+
created: ${{ steps.prep.outputs.created }} # refer to as ${{needs.prepare.outputs.created}}
18+
19+
20+
build:
21+
needs: [ prepare ]
22+
runs-on: ubuntu-latest # soon to support hosted runners for arm64
23+
strategy:
24+
fail-fast: false # let other jobs try to complete if one fails
25+
matrix:
26+
arch: [ 'amd64' , 'arm64' ]
27+
distro: [ 'ubuntu:impish', 'ubuntu:hirsute', 'golang:1.16-bullseye', 'debian:sid' ]
28+
# FIXME: if you know of an updated multiarch Ubuntu Focal image with 1.16 golang please PR
29+
steps:
30+
31+
- name: Checkout
32+
uses: actions/checkout@v2
33+
34+
- name: Set up QEMU
35+
uses: docker/setup-qemu-action@v1
36+
37+
- name: Set up Docker Buildx
38+
id: buildx
39+
uses: docker/setup-buildx-action@v1
40+
41+
- name: Cache Docker layers ${{ matrix.arch }} ${{ matrix.distro }}
42+
uses: actions/cache@v2
43+
with:
44+
path: /tmp/.buildx-cache
45+
key: ${{ runner.os }}-buildx-${{ matrix.arch }}-${{ matrix.distro }}-${{ github.sha }}
46+
restore-keys: |
47+
${{ runner.os }}-buildx-${{ matrix.arch }}-${{ matrix.distro }}
48+
49+
- name: Build ${{ matrix.arch }} ${{ matrix.distro }}
50+
uses: docker/build-push-action@v2
51+
with:
52+
context: .
53+
file: ./Dockerfile
54+
platforms: linux/${{ matrix.arch }}
55+
load: true
56+
pull: true # bring in updated versions of preexisting GH images
57+
push: false
58+
tags: k8s-worker-containerd:${{ matrix.arch }}
59+
cache-from: type=local,src=/tmp/.buildx-cache
60+
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
61+
build-args: |
62+
PACKAGE_VERSION=${{needs.prepare.outputs.created}}
63+
BASE_IMAGE=${{ matrix.distro }}
64+
OS_ARCH=${{ matrix.arch }}
65+
66+
- name: Extract artifacts from docker ${{ matrix.arch }} ${{ matrix.distro }}
67+
run: docker cp $(docker create --rm k8s-worker-containerd:${{ matrix.arch }}):/out ./
68+
69+
- name: Upload deb as artifact ${{ matrix.arch }} ${{ matrix.distro }}
70+
uses: actions/upload-artifact@v2
71+
with:
72+
name: deb
73+
path: out/*.deb
74+
75+
- name: Upload tarball as artifact ${{ matrix.arch }} ${{ matrix.distro }}
76+
uses: actions/upload-artifact@v2
77+
with:
78+
name: tarball
79+
path: out/*.tar.gz
80+
81+
# Temp fix: https://github.com/docker/build-push-action/issues/252
82+
- name: Move caches ${{ matrix.arch }} ${{ matrix.distro }}
83+
run: |
84+
echo "Old ${{ matrix.arch }} ${{ matrix.distro }} cache..."
85+
ls -lahtR /tmp/.buildx-cache || true
86+
if [[ -d /tmp/.buildx-cache-new ]]; then
87+
echo "New ${{ matrix.arch }} ${{ matrix.distro }} cache..."
88+
ls -lahtR /tmp/.buildx-cache-new
89+
echo "Flipping ${{ matrix.arch }} ${{ matrix.distro }} cache..."
90+
rm -rf /tmp/.buildx-cache
91+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
92+
fi
93+
94+
release:
95+
needs: [ prepare, build ] # depend on the previous jobs...
96+
if: "${{ always() }}" # ... but run even if (some of) them failed.
97+
runs-on: ubuntu-latest
98+
steps:
99+
# Download the built artifacts from GH artifacts.
100+
- uses: actions/download-artifact@v2
101+
name: Download deb artifacts
102+
with:
103+
name: deb
104+
path: out
105+
106+
- uses: actions/download-artifact@v2
107+
name: Download tarball artifacts
108+
with:
109+
name: tarball
110+
path: out
111+
112+
- name: List artifacts downloaded
113+
run: |
114+
ls -lahtR
115+
116+
# Release the artifacts into GitHub Releases
117+
- name: "GH specific release"
118+
uses: "marvinpinto/action-automatic-releases@latest"
119+
with:
120+
repo_token: "${{ secrets.GITHUB_TOKEN }}"
121+
automatic_release_tag: "${{needs.prepare.outputs.created}}"
122+
prerelease: false
123+
title: "${{needs.prepare.outputs.created}}"
124+
files: |
125+
out/*.deb
126+
out/*.tar.gz
127+
128+
#- name: "GH latest release"
129+
# uses: "marvinpinto/action-automatic-releases@latest"
130+
# with:
131+
# repo_token: "${{ secrets.GITHUB_TOKEN }}"
132+
# automatic_release_tag: "latest"
133+
# prerelease: false
134+
# title: "Latest: ${{needs.prepare.outputs.created}}"
135+
# files: |
136+
# out/*.deb
137+
# out/*.tar.gz
138+

Diff for: ‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
.idea
2+
out

Diff for: ‎Dockerfile

+144
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
ARG BASE_IMAGE="ubuntu:hirsute"
2+
FROM ${BASE_IMAGE} as build
3+
4+
ARG OS_ARCH="amd64"
5+
6+
ENV DEBIAN_FRONTEND=noninteractive
7+
RUN apt-get -y update
8+
RUN apt-get -y dist-upgrade
9+
RUN apt-get -y install git bash wget curl build-essential devscripts debhelper libseccomp-dev libapparmor-dev libassuan-dev libbtrfs-dev libc6-dev libdevmapper-dev libglib2.0-dev libgpgme-dev libgpg-error-dev libprotobuf-dev libprotobuf-c-dev libseccomp-dev libselinux1-dev libsystemd-dev pkg-config
10+
SHELL ["/bin/bash", "-e", "-c"]
11+
RUN which go || apt-get -y install golang-go
12+
13+
14+
# See https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/79a3f79b27bd28f82f071bb877a266c2e62ee506/docs/09-bootstrapping-kubernetes-workers.md#download-and-install-worker-binaries
15+
16+
# Build runc from source
17+
FROM build as runc
18+
WORKDIR /src
19+
ARG RUNC_VERSION="v1.0.2"
20+
RUN git clone --depth=1 --single-branch --branch=${RUNC_VERSION} https://github.com/opencontainers/runc /src/runc
21+
WORKDIR /src/runc
22+
RUN make
23+
24+
# Build conmon from source
25+
FROM build as conmon
26+
WORKDIR /src
27+
ARG CONMON_VERSION="v2.0.30"
28+
RUN git clone --depth=1 --single-branch --branch=${CONMON_VERSION} https://github.com/containers/conmon.git /src/conmon
29+
WORKDIR /src/conmon
30+
RUN make
31+
32+
# Build podman from source.
33+
FROM build as podman
34+
WORKDIR /src
35+
ARG PODMAN_VERSION="v3.4.1"
36+
RUN git clone --depth=1 --single-branch --branch=${PODMAN_VERSION} https://github.com/containers/podman.git /src/podman
37+
WORKDIR /src/podman
38+
RUN make BUILDTAGS="selinux seccomp systemd"
39+
40+
# Build containerd from source
41+
FROM build as containerd
42+
WORKDIR /src
43+
ARG CONTAINERD_VERSION="v1.5.7"
44+
RUN git clone --depth=1 --single-branch --branch=${CONTAINERD_VERSION} https://github.com/containerd/containerd /src/containerd
45+
WORKDIR /src/containerd
46+
RUN BUILDTAGS=no_btrfs make
47+
48+
# Build cri-tools from source
49+
FROM build as cri-tools
50+
WORKDIR /src
51+
ARG CRI_TOOLS_VERSION="v1.22.0"
52+
RUN git clone --depth=1 --single-branch --branch=${CRI_TOOLS_VERSION} https://github.com/kubernetes-sigs/cri-tools /src/cri-tools
53+
WORKDIR /src/cri-tools
54+
RUN make
55+
56+
# Build cfssl from source
57+
FROM build as cfssl
58+
WORKDIR /src
59+
ARG CFSSL_VERSION="v1.6.1"
60+
RUN git clone --depth=1 --single-branch --branch=${CFSSL_VERSION} https://github.com/cloudflare/cfssl /src/cfssl
61+
WORKDIR /src/cfssl
62+
RUN make
63+
64+
# Build nerdctl from source
65+
FROM build as nerdctl
66+
WORKDIR /src
67+
ARG NERDCTL_VERSION="v0.12.1"
68+
RUN git clone --depth=1 --single-branch --branch=${NERDCTL_VERSION} https://github.com/containerd/nerdctl /src/nerdctl
69+
WORKDIR /src/nerdctl
70+
RUN make
71+
72+
# Prepare the results in /out
73+
FROM build as packager
74+
WORKDIR /out/usr/sbin
75+
COPY --from=runc /src/runc/runc .
76+
77+
WORKDIR /out/usr/bin
78+
COPY --from=cri-tools /src/cri-tools/build/bin/crictl crictl-latest
79+
COPY --from=cri-tools /src/cri-tools/build/bin/critest .
80+
COPY --from=containerd /src/containerd/bin/* .
81+
COPY --from=podman /src/podman/bin/podman .
82+
COPY --from=conmon /src/conmon/bin/conmon .
83+
COPY --from=cfssl /src/cfssl/bin/cfssl .
84+
COPY --from=cfssl /src/cfssl/bin/cfssljson .
85+
COPY --from=nerdctl /src/nerdctl/_output/nerdctl .
86+
87+
# add podman default configs
88+
WORKDIR /out/etc/containers
89+
RUN curl -L -o /out/etc/containers/registries.conf https://src.fedoraproject.org/rpms/containers-common/raw/main/f/registries.conf
90+
RUN curl -L -o /out/etc/containers/policy.json https://src.fedoraproject.org/rpms/containers-common/raw/main/f/default-policy.json
91+
92+
# Prepare debian binary package
93+
WORKDIR /pkg/src
94+
ADD debian /pkg/src/debian
95+
RUN cp -rvp /out/* /pkg/src/
96+
# Create the .install file with the binaries to be installed, without leading slash
97+
RUN find /out -type f | sed -e 's/^\/out\///g' > debian/k8s-worker-containerd.install
98+
99+
# Create the "Architecture: amd64" field in control
100+
RUN echo "Architecture: ${OS_ARCH}" >> /pkg/src/debian/control
101+
RUN cat /pkg/src/debian/control
102+
103+
# Create the Changelog, fake. The atrocities we do in dockerfiles.
104+
ARG PACKAGE_VERSION="20210928"
105+
RUN echo "k8s-worker-containerd (${PACKAGE_VERSION}) stable; urgency=medium" >> /pkg/src/debian/changelog
106+
RUN echo "" >> /pkg/src/debian/changelog
107+
RUN echo " * Not a real changelog. Sorry." >> /pkg/src/debian/changelog
108+
RUN echo "" >> /pkg/src/debian/changelog
109+
RUN echo " -- Ricardo Pardini <[email protected]> Wed, 15 Sep 2021 14:18:33 +0200" >> /pkg/src/debian/changelog
110+
RUN cat /pkg/src/debian/changelog
111+
112+
113+
# Build the package, don't sign it, don't lint it, compress fast with xz
114+
WORKDIR /pkg/src
115+
RUN debuild --no-lintian --build=binary -us -uc -Zxz -z1
116+
RUN file /pkg/*.deb
117+
118+
# Show package info
119+
RUN dpkg-deb -I /pkg/*.deb || true
120+
RUN dpkg-deb -f /pkg/*.deb || true
121+
122+
# Install it to make sure it works
123+
RUN dpkg -i /pkg/*.deb
124+
RUN runc --version
125+
RUN containerd --version
126+
RUN crictl-latest --version # Real bin
127+
RUN crictl --version # symlink in usr/local/bin
128+
RUN podman --version
129+
RUN conmon --version
130+
RUN cfssl version
131+
RUN cfssljson --version
132+
RUN nerdctl --version
133+
RUN dpkg -L k8s-worker-containerd
134+
135+
# Now prepare the real output: a tarball of /out, and the .deb for this arch.
136+
WORKDIR /artifacts
137+
RUN cp -v /pkg/*.deb k8s-worker-containerd_${OS_ARCH}_$(lsb_release -c -s).deb
138+
WORKDIR /out
139+
RUN tar czvf /artifacts/k8s-worker-containerd_${OS_ARCH}_$(lsb_release -c -s).tar.gz *
140+
141+
# Final stage is just alpine so we can start a fake container just to get at its contents using docker in GHA
142+
FROM alpine:3.14.2
143+
COPY --from=packager /artifacts/* /out/
144+

Diff for: ‎build-docker.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
3+
rm -rf ./out
4+
docker buildx build --progress=plain --platform=linux/amd64 --build-arg BASE_IMAGE=golang:1.16-bullseye -t containerd:amd64 .
5+
docker cp $(docker create --rm containerd:amd64):/out ./
6+
ls -lah ./out/

Diff for: ‎debian/compat

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
14

Diff for: ‎debian/control

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
Maintainer: Ricardo Pardini <[email protected]>
2+
Source: k8s-worker-containerd
3+
Section: admin
4+
Priority: optional
5+
Build-Depends: debhelper (>=9.2), lsb-release, bash (>= 4.0)
6+
Standards-Version: 3.9.6
7+
Homepage: https://containerd.io/
8+
9+
Package: k8s-worker-containerd
10+
Provides: golang-cfssl, containerd, runc, podman, conman, golang-github-containers-image, golang-github-containers-common, cri-tools
11+
Conflicts: golang-cfssl, containerd, runc, podman, conman, golang-github-containers-image, golang-github-containers-common
12+
Description: containerd/run/cri-tools/podman/conman for k8s
13+
containerd/run/cri-tools/podman/conman
14+
Built from source. Docker-free stuff.
15+
Section: admin
16+
Pre-Depends: bash (>= 4.0)
17+
Depends: ${misc:Depends}, ${shlibs:Depends}

Diff for: ‎debian/copyright

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Files: debian/*
2+
Copyright: 2021-2021 Ricardo Pardini <[email protected]>
3+
License: Apache

Diff for: ‎debian/k8s-worker-containerd.containerd.service

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Copyright The containerd Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
[Unit]
16+
Description=containerd container runtime
17+
Documentation=https://containerd.io
18+
After=network.target local-fs.target
19+
20+
[Service]
21+
ExecStartPre=-/sbin/modprobe overlay
22+
ExecStart=/usr/bin/containerd
23+
24+
Type=notify
25+
Delegate=yes
26+
KillMode=process
27+
Restart=always
28+
RestartSec=5
29+
# Having non-zero Limit*s causes performance problems due to accounting overhead
30+
# in the kernel. We recommend using cgroups to do container-local accounting.
31+
LimitNPROC=infinity
32+
LimitCORE=infinity
33+
LimitNOFILE=infinity
34+
# Comment TasksMax if your systemd version does not supports it.
35+
# Only systemd 226 and above support this version.
36+
TasksMax=infinity
37+
OOMScoreAdjust=-999
38+
39+
[Install]
40+
WantedBy=multi-user.target

Diff for: ‎debian/k8s-worker-containerd.postinst

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/sh
2+
set -e
3+
4+
#DEBHELPER#
5+
6+
echo "k8s-worker-containerd: cri-tools: Installink symlink to /usr/bin/crictl-latest as /usr/local/bin/crictl"
7+
rm -f /usr/local/bin/crictl
8+
ln -s /usr/bin/crictl-latest /usr/local/bin/crictl
9+
/usr/local/bin/crictl --version
10+
11+
exit 0

Diff for: ‎debian/rules

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/make -f
2+
# -*- makefile -*-
3+
4+
# Uncomment this to turn on verbose mode.
5+
#export DH_VERBOSE=1
6+
export DEB_BUILD_OPTIONS=nostrip
7+
8+
%:
9+
dh $@
10+
11+
12+
override_dh_installsystemd:
13+
dh_installsystemd --name=containerd --no-enable --no-start
14+

Diff for: ‎debian/source/format

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3.0 (native)

0 commit comments

Comments
 (0)