-
Notifications
You must be signed in to change notification settings - Fork 54
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Allow copa to use buildkit from dockerd (#233)
Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com>
- Loading branch information
Showing
22 changed files
with
843 additions
and
62 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -eu -o pipefail | ||
|
|
||
| SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)" | ||
|
|
||
| # Collect all the modes into a bash array | ||
| modes=() | ||
| for i in ${SCRIPT_DIR}/buildkitenvs/*; do | ||
| base="${i##*/}" | ||
| for j in "${i}"/*; do | ||
| modes+=(${base}/${j##*/}) | ||
| done | ||
| done | ||
|
|
||
| # Convert bash array to json | ||
| jq -c --null-input '$ARGS.positional' --args -- "${modes[@]}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| #!/usr/bin/env sh | ||
|
|
||
| docker buildx create --use | ||
| docker buildx inspect --bootstrap | ||
| export COPA_BUILDKIT_ADDR="buildx://" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| #!/usr/bin/env sh | ||
|
|
||
| docker buildx create --name testpatch | ||
| docker buildx inspect --bootstrap testpatch | ||
| export COPA_BUILDKIT_ADDR="buildx://testpatch" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| #!/usr/bin/env sh | ||
|
|
||
|
|
||
| : "${BUILDKIT_PORT:=30321}" | ||
| : "${BUILDKIT_VERSION=0.12.0}" | ||
|
|
||
| _buildkit_direct_tcp_id="$(docker run --detach --rm --privileged -p 127.0.0.1::${BUILDKIT_PORT}/tcp --entrypoint buildkitd "moby/buildkit:v$BUILDKIT_VERSION" --addr tcp://0.0.0.0:${BUILDKIT_PORT})" | ||
| _buildkitd_tcp_addr="$(docker port ${_buildkit_direct_tcp_id} ${BUILDKIT_PORT})" | ||
| export COPA_BUILDKIT_ADDR="tcp://${_buildkitd_tcp_addr}" | ||
|
|
||
| _cleanup() { | ||
| docker rm -f "${_buildkit_direct_tcp_id}" | ||
| } | ||
|
|
||
| trap '_cleanup' EXIT | ||
|
|
||
| _check_buildkitd_tcp() { | ||
| buildctl --addr ${COPA_BUILDKIT_ADDR} debug info | ||
| } | ||
|
|
||
| echo "[INFO] Wait for buildkitd to be ready @ ${COPA_BUILDKIT_ADDR}" | ||
| while ! _check_buildkitd_tcp; do | ||
| sleep 1 | ||
| done |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| #!/usr/bin/env sh | ||
|
|
||
| # dockerd requires containerd snapshotter support to be enabled otherwise required features for buildkit are disabled. | ||
| docker build -t dind -<<EOF | ||
| FROM docker:24.0-dind | ||
| RUN mkdir -p /etc/docker && echo '{"features": { "containerd-snapshotter": true }}' > /etc/docker/daemon.json | ||
| ENTRYPOINT ["dockerd"] | ||
| EOF | ||
|
|
||
| : "${DOCKER_DIND_VOLUME:="copa-docker-dind"}" | ||
|
|
||
| sock_dir="$(mktemp -d)" | ||
|
|
||
| docker_custom_unix_id="$(docker run -d --privileged --mount=type=bind,source="${sock_dir}",target=/run --mount=type=volume,source="${DOCKER_DIND_VOLUME}",target=/var/lib/docker dind --group "$(id -g)")" | ||
|
|
||
| _cleanup() { | ||
| docker rm -f "$docker_custom_unix_id" | ||
| sudo rm -rf "${sock_dir}" | ||
| } | ||
|
|
||
| trap '_cleanup' EXIT | ||
|
|
||
| _check_docker_dind() { | ||
| docker -H "unix://${sock_dir}/docker.sock" info | ||
| } | ||
|
|
||
| while ! _check_docker_dind; do | ||
| check_docker_dind || sleep 1 | ||
| done | ||
|
|
||
| export COPA_BUILDKIT_ADDR="docker://unix://${sock_dir}/docker.sock" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -eu -o pipefail | ||
|
|
||
| curl -sfL https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.deb -o trivy.deb | ||
| sudo dpkg -i trivy.deb | ||
| rm trivy.deb | ||
|
|
||
| curl -sfL https://github.com/moby/buildkit/releases/download/v${BUILDKIT_VERSION}/buildkit-v${BUILDKIT_VERSION}.linux-amd64.tar.gz -o buildkit.tar.gz | ||
| sudo tar -zxvf buildkit.tar.gz -C /usr/local/ | ||
| rm buildkit.tar.gz |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package trivy | ||
|
|
||
| import data.lib.trivy | ||
|
|
||
| default ignore = false | ||
|
|
||
| ignore_vulnerability_ids := { | ||
| # centos 7.6.1810 | ||
| # bind-license package version "9.11.4-26.P2.el7_9.14" does not exist | ||
| "CVE-2023-2828" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package integration | ||
|
|
||
| import ( | ||
| "flag" | ||
| "os" | ||
| "testing" | ||
| ) | ||
|
|
||
| var ( | ||
| buildkitAddr string | ||
| copaPath string | ||
| ) | ||
|
|
||
| func TestMain(m *testing.M) { | ||
| flag.StringVar(&buildkitAddr, "addr", "", "buildkit address to pass through to copa binary") | ||
| flag.StringVar(&copaPath, "copa", "./copa", "path to copa binary") | ||
| flag.Parse() | ||
|
|
||
| if copaPath == "" { | ||
| panic("missing --copa") | ||
| } | ||
|
|
||
| ec := m.Run() | ||
| os.Exit(ec) | ||
| } |
Oops, something went wrong.