From 917811aa9fa929de3b016e7eab9ddc9f26d073bf Mon Sep 17 00:00:00 2001 From: Mathieu Tarral Date: Mon, 29 Sep 2025 08:27:55 -0700 Subject: [PATCH 1/3] Dockerfile: set vscode user in both tsffs dev and prod images --- Dockerfile | 116 +++++++++++++++++++++++++++++------------------------ 1 file changed, 64 insertions(+), 52 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2b04edff..d61a6405 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,16 +2,49 @@ # SPDX-License-Identifier: Apache-2.0 # hadolint global ignore=DL3041,DL3040 -FROM fedora:42@sha256:f357623dc40edf7803f21b2b954f92417f274a7370f82384ef13c73e08ce1727 AS tsffs-base - # Download links can be obtained from: # https://lemcenter.intel.com/productDownload/?Product=256660e5-a404-4390-b436-f64324d94959 ARG PUBLIC_SIMICS_PKGS_URL="https://registrationcenter-download.intel.com/akdlm/IRC_NAS/ead79ef5-28b5-48c7-8d1f-3cde7760798f/simics-6-packages-2024-05-linux64.ispm" ARG PUBLIC_SIMICS_ISPM_URL="https://registrationcenter-download.intel.com/akdlm/IRC_NAS/ead79ef5-28b5-48c7-8d1f-3cde7760798f/intel-simics-package-manager-1.8.3-linux64.tar.gz" ARG PUBLIC_SIMICS_PACKAGE_VERSION_1000="6.0.185" +ARG USER_UID=1000 +ARG USERNAME=vscode + +FROM fedora:42@sha256:f357623dc40edf7803f21b2b954f92417f274a7370f82384ef13c73e08ce1727 AS create-user +# redeclare ARGs +ARG USER_UID +ARG USERNAME + +# hadolint ignore=DL3004,SC3009 +RUN < /etc/sudoers.d/$USERNAME +sudo -E -u $USERNAME bash -c 'curl https://sh.rustup.rs -sSf | bash -s -- -y --default-toolchain none' +EOF + +FROM create-user AS tsffs-dev +# redeclare ARGs +ARG PUBLIC_SIMICS_PKGS_URL +ARG PUBLIC_SIMICS_ISPM_URL +ARG PUBLIC_SIMICS_PACKAGE_VERSION_1000 +ARG USER_UID +ARG USERNAME ENV SIMICS_BASE="/workspace/simics/simics-${PUBLIC_SIMICS_PACKAGE_VERSION_1000}/" # Add cargo and ispm to the path -ENV PATH="/root/.cargo/bin:/workspace/simics/ispm:${PATH}" +ENV PATH="/home/${USERNAME}/.cargo/bin:/workspace/simics/ispm:${PATH}" SHELL ["/bin/bash", "-o", "pipefail", "-c"] @@ -24,8 +57,6 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"] # hadolint ignore=DL3004,SC3009 RUN <> /root/.bashrc - -FROM tsffs-base AS tsffs-dev -ARG USER_UID=1000 -ARG USERNAME=vscode - -# To build and run the dev image: -# docker build --build-arg USER_UID=$(id -u) --target tsffs-dev -t tsffs:dev . -# docker run --rm -ti --user vscode -v .:/workspace/tsffs tsffs:dev - -# hadolint ignore=DL3004,SC3009 -RUN < /etc/sudoers.d/$USERNAME - -# set /workspace/simics permissions to vscode:dev -chown -R vscode:dev /workspace/{simics,projects,tsffs} - -# install Rust nightly for the user -sudo -E -u $USERNAME bash -c 'curl https://sh.rustup.rs -sSf | bash -s -- -y --default-toolchain none' - -# copy Simics ISPM config -mkdir -p /home/$USERNAME/.config -cp -r "/root/.config/Intel Simics Package Manager/" "/home/$USERNAME/.config/" -chown -R $USERNAME:$USERNAME "/home/$USERNAME/.config/" -EOF +USER vscode +RUN echo 'echo "To run the demo, run ./simics -no-gui --no-win fuzz.simics"' >> ~/.bashrc WORKDIR /workspace/tsffs -FROM fedora:42@sha256:f357623dc40edf7803f21b2b954f92417f274a7370f82384ef13c73e08ce1727 AS tsffs-prod +FROM create-user AS tsffs-prod +# redeclare ARGs +ARG PUBLIC_SIMICS_PKGS_URL +ARG PUBLIC_SIMICS_ISPM_URL +ARG PUBLIC_SIMICS_PACKAGE_VERSION_1000 +ENV SIMICS_BASE="/workspace/simics/simics-${PUBLIC_SIMICS_PACKAGE_VERSION_1000}/" +# Add cargo and ispm to the path +ENV PATH="/home/${USERNAME}/.cargo/bin:/workspace/simics/ispm:${PATH}" # Install minimal runtime dependencies only # hadolint ignore=DL3004,SC3009 RUN < Date: Mon, 6 Oct 2025 14:52:00 -0700 Subject: [PATCH 2/3] Dockerfile: pin all simics packages --- Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index d61a6405..e3b1d76a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -189,9 +189,9 @@ umask 002 # Create the example project ispm projects /workspace/projects/example/ --create \ 1000-${PUBLIC_SIMICS_PACKAGE_VERSION_1000} \ - 2096-latest \ - 8112-latest \ - 1030-latest \ + 2096-6.0.73 \ + 8112-6.0.21 \ + 1030-6.0.7 \ 31337-latest --ignore-existing-files --non-interactive # Copy required files From b8d68d329adec998abd4497c6afcafd4cbfeb4b1 Mon Sep 17 00:00:00 2001 From: Mathieu Tarral Date: Mon, 6 Oct 2025 22:41:46 -0700 Subject: [PATCH 3/3] ci: cleanup github runner in build_dist job to space space --- .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9715b419..f54eb370 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -633,6 +633,38 @@ jobs: name: Build for Distribution runs-on: ubuntu-22.04 steps: + - name: Aggressive cleanup + run: | + # Remove Java (JDKs) + sudo rm -rf /usr/lib/jvm + + # Remove .NET SDKs + sudo rm -rf /usr/share/dotnet + + # Remove Swift toolchain + sudo rm -rf /usr/share/swift + + # Remove Haskell (GHC) + sudo rm -rf /usr/local/.ghcup + + # Remove Julia + sudo rm -rf /usr/local/julia* + + # Remove Android SDKs + sudo rm -rf /usr/local/lib/android + + # Remove Chromium (optional if not using for browser tests) + sudo rm -rf /usr/local/share/chromium + + # Remove Microsoft/Edge and Google Chrome builds + sudo rm -rf /opt/microsoft /opt/google + + # Remove Azure CLI + sudo rm -rf /opt/az + + # Remove PowerShell + sudo rm -rf /usr/local/share/powershell + - name: Harden Runner uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 with: