feat: Dockerfile for new Bazel releases

[f0rmiga]

Part of #1060.

Used dive to analyse the previously released image. There are still some packages that I may be missing from the 3.x release series.

Let me know if you spot any missing packages.

[f0rmiga]

cc @alexeagle

[alexeagle]

Cool, could you say something about the methodology you used to make it similar to images previously published with Bazel releases?

[alexeagle]

Testing this out a bit - looks like the ENTRYPOINT needs to be set to /usr/local/bin/bazel and some packages are missing (at least python is needed)

[f0rmiga]

@alexeagle since Python 2 is already past EOL, I'm installing only Python 3. Do we need to symlink python to python3?

[philwo]

Thank you so much for this contribution.

I think it can't hurt to have apt install python-is-python3 in the Dockerfile to symlink /usr/bin/python -> /usr/bin/python3. Bazel itself shouldn't require it, but we install it on Bazel CI, too, in case someone still depends on it.

[alexeagle]

That newest one worked for me to build Bazel 5.0.0rc3 inside the container 👍🏻

[f0rmiga]

Rolling back to Ubuntu 16.04 since linking against the newer glibc on 20.04 breaks running @alexeagle's Bazel 5.0.0rc3 on older systems.

[alexeagle]

Ubuntu 16 matches what l.gcr.io/bazel:latest has as well, so we are just changing one thing at a time :)

[davidvandebunte]

Some random comments from an outsider:

• On Bazel CI Release Process should build and publish Bazel docker containers #1060 some others suggested we need to get off 16.04 for security reasons, and that still seems legitimate. It seems like an "introductory" image like this should not be so worried about supporting older systems (e.g. dropping Python 2).
• Why doesn't this use rules_docker to build, the approach apparently taking by previous images? On a related note, many packages are unpinned. Not a huge deal, I just wonder why.
• Should this install at least the docker client, as the current image does? It's necessary for my use case. On 20.04 this is as simple as docker.io.

Still, useful code and the direction seems right!

[alexeagle]

@meteorcloudy this is ready for review, PTAL

[meteorcloudy]

Looks good to me, @philwo Can you do the final check?

[philwo]

I added two comments, but feel free to address them in a follow-up.

Thank you so much for preparing this!

[philwo]

Can we make this architecture aware to support containers that work on arm64, too?

[philwo]

Should we use OpenJDK 11 now? Bazel itself at least no longer supports JDK 8 (although I think you can still use it to build stuff).

[alexeagle]

@meteorcloudy do you have the next steps for publishing Bazel 5 to gcr?

[meteorcloudy]

I can setup a CI pipeline to regularly update the docker image for each Bazel LTS release after merging this.

[alexeagle]

@meteorcloudy how about manually pushing a recent Bazel, if the automation is too much work to prioritize right now?

[meteorcloudy]

Sorry for the delay here. I want to keep publishing to marketplace.gcr.io/google/bazel, but this is synced with a repo that's owned by a different Google team, I tried to migrate the staging repo to gcr.io/bazel-public/bazel, but that process hasn't gone well. Maybe I can first push to gcr.io/bazel-public/bazel, then people can pull docker images from the new URL?

[meteorcloudy]

I have built and pushed images for all missing Bazel release versions to gcr.io/bazel-public/bazel, currently working with an internal team to make sure they are synced to marketplace.gcr.io/google/bazel

[loeffel-io]

@meteorcloudy would love to see a bazel 5.2 gcr.io/bazel-public/bazel image ✌️

[meteorcloudy]

5.2 is already on gcr.io/bazel-public/bazel, but unfortunately I'm still going through the process of publishing missing versions to marketplace.gcr.io/google/bazel

[meteorcloudy]

Vulnerabilities has been detected in the docker images built from this Dockerfile, for example
CVE-2022-1292.
@f0rmiga @alexeagle Any idea how to fix those problems so that it can pass the vulnerabilities scan required for publishing to marketplace.gcr.io/google/bazel

[tetsuok]

It would be great if 5.3 is on gcr.io/bazel-public/bazel.

[meteorcloudy]

@tetsuok Pushed!

[tetsuok]

@meteorcloudy Great! Thank you very much!