Skip to content

Commit e1e07c3

Browse files
PastaPastaPastaPastaPastaPasta
authored
Merge pull request #5449 from kittywhiskers/alpine_guix
build: add ability to interactively run guix builds, use container that has unprivileged user
2 parents 0e53540 + 7399ea5 commit e1e07c3

File tree

7 files changed

+184
-15
lines changed

7 files changed

+184
-15
lines changed

‎.github/workflows/guix-build.yml‎

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,12 @@ jobs:
1717
- name: Set up Docker Buildx
1818
uses: docker/setup-buildx-action@v1
1919

20-
- name: Hash Dockerfile
20+
- name: Commit variables
2121
id: dockerfile
2222
run: |
23-
echo "::set-output name=hash::$(sha256sum ./contrib/guix/Dockerfile | cut -d ' ' -f1)"
23+
echo "::set-output name=hash::$(sha256sum ./contrib/containers/guix/Dockerfile | cut -d ' ' -f1)"
24+
echo "::set-output name=host_user_id::$(id -u)"
25+
echo "::set-output name=host_group_id::$(id -g)"
2426
2527
- name: Cache Docker layers
2628
uses: actions/cache@v2
@@ -33,25 +35,27 @@ jobs:
3335
- name: Build Docker image
3436
uses: docker/build-push-action@v2
3537
with:
36-
context: .
37-
file: ./contrib/guix/Dockerfile
38+
context: ${{ github.workspace }}
39+
build-args: |
40+
USER_ID=${{ steps.dockerfile.outputs.host_user_id }}
41+
GROUP_ID=${{ steps.dockerfile.outputs.host_group_id }}
42+
build-contexts: |
43+
docker_root=${{ github.workspace }}/contrib/containers/guix
44+
file: ./contrib/containers/guix/Dockerfile
3845
load: true
39-
tags: alpine-guix:latest
46+
tags: guix_ubuntu:latest
4047
cache-from: type=local,src=/tmp/.buildx-cache
4148
cache-to: type=local,dest=/tmp/.buildx-cache
4249

4350
- name: Run Guix build
4451
run: |
45-
export ADDITIONAL_GUIX_COMMON_FLAGS='--max-jobs=32' && \
46-
mkdir -p depends/SDKs && \
47-
mkdir -p /tmp/guix-store && \
48-
curl -L https://bitcoincore.org/depends-sources/sdks/Xcode-12.1-12A7403-extracted-SDK-with-libcxx-headers.tar.gz | tar -xz -C depends/SDKs && \
49-
docker run --privileged -d --name guix-daemon --rm -v ${{ github.workspace }}:/dash -w /dash alpine-guix:latest && \
50-
docker exec guix-daemon bash -c "\
51-
chmod 777 /dash/depends && \
52-
git config --global --add safe.directory /dash && \
53-
cd /dash && \
54-
contrib/guix/guix-build"
52+
docker run --privileged -d --rm -t \
53+
--name guix-daemon \
54+
-e ADDITIONAL_GUIX_COMMON_FLAGS='--max-jobs=32' \
55+
-v ${{ github.workspace }}:/src/dash \
56+
-w /src/dash \
57+
guix_ubuntu:latest && \
58+
docker exec guix-daemon bash -c "/usr/local/bin/guix-start"
5559
5660
- name: Ensure build passes
5761
run: |

‎contrib/containers/guix/Dockerfile‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Note: Using 'docker compose up' will leave you hanging, you need
2+
# to use 'docker compose run guix_ubuntu' to drop into an
3+
# interactive shell
4+
5+
FROM ubuntu:focal
6+
7+
SHELL ["/bin/bash", "-c"]
8+
9+
RUN apt-get update && \
10+
apt-get install -y --no-install-recommends --no-upgrade \
11+
build-essential \
12+
bzip2 \
13+
ca-certificates \
14+
curl \
15+
git \
16+
locales \
17+
netbase \
18+
sudo \
19+
wget \
20+
xz-utils && \
21+
rm -rf /var/lib/apt/lists/*
22+
23+
ARG guix_download_path=ftp://ftp.gnu.org/gnu/guix
24+
ARG guix_version=1.4.0
25+
ARG guix_checksum_aarch64=72d807392889919940b7ec9632c45a259555e6b0942ea7bfd131101e08ebfcf4
26+
ARG guix_checksum_x86_64=236ca7c9c5958b1f396c2924fcc5bc9d6fdebcb1b4cf3c7c6d46d4bf660ed9c9
27+
ARG builder_count=32
28+
29+
ENV PATH /usr/local/bin:/usr/local/guix/current/bin:$PATH
30+
31+
# Application Setup
32+
# https://guix.gnu.org/manual/en/html_node/Application-Setup.html
33+
ENV GUIX_LOCPATH="/usr/local/guix/profile" \
34+
LC_ALL="C"
35+
36+
RUN guix_file_name=guix-binary-${guix_version}.$(uname -m)-linux.tar.xz && \
37+
eval "guix_checksum=\${guix_checksum_$(uname -m)}" && \
38+
cd /tmp && \
39+
wget -q -O "$guix_file_name" "${guix_download_path}/${guix_file_name}" && \
40+
echo "${guix_checksum} ${guix_file_name}" | sha256sum -c && \
41+
tar xJf "$guix_file_name" && \
42+
mv var/guix /var/ && \
43+
mv gnu / && \
44+
mkdir -p /usr/local/guix && \
45+
ln -sf /var/guix/profiles/per-user/root/current-guix /usr/local/guix/current && \
46+
ln -sf /var/guix/profiles/per-user/root/guix-profile /usr/local/guix/profile && \
47+
chmod 1777 /tmp /var/tmp && \
48+
source /usr/local/guix/current/etc/profile
49+
50+
RUN touch /etc/nsswitch.conf
51+
52+
RUN guix archive --authorize < /usr/local/guix/current/share/guix/ci.guix.gnu.org.pub && \
53+
guix archive --authorize < /usr/local/guix/current/share/guix/bordeaux.guix.gnu.org.pub
54+
55+
# Build Environment Setup
56+
# https://guix.gnu.org/manual/en/html_node/Build-Environment-Setup.html
57+
RUN groupadd --system guixbuild && \
58+
for i in $(seq -w 1 ${builder_count}); do \
59+
useradd -g guixbuild -G guixbuild \
60+
-d /var/empty -s $(which nologin) \
61+
-c "Guix build user ${i}" --system \
62+
"guixbuilder${i}" ; \
63+
done
64+
65+
# Create unprivileged user
66+
ARG USER_ID=1000 \
67+
GROUP_ID=1000 \
68+
USERNAME=ubuntu
69+
RUN groupadd -g ${GROUP_ID} ${USERNAME} && \
70+
useradd -u ${USER_ID} -g ${USERNAME} -s /bin/bash -m -d /home/${USERNAME} ${USERNAME}
71+
72+
# Grant it passwordless admin permissions
73+
RUN usermod -aG sudo ${USERNAME} && \
74+
echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
75+
76+
# Copy required files to container
77+
COPY --from=docker_root ./motd.txt /etc/motd
78+
COPY --from=docker_root ./scripts/entrypoint /usr/local/bin/entrypoint
79+
COPY --from=docker_root ./scripts/guix-check /usr/local/bin/guix-check
80+
COPY --from=docker_root ./scripts/guix-start /usr/local/bin/guix-start
81+
82+
# Create directory for mounting and grant necessary permissions
83+
RUN mkdir -p /src/dash && \
84+
chown -R ${USER_ID}:${GROUP_ID} /src
85+
WORKDIR "/src/dash"
86+
87+
# Switch to unprivileged context
88+
USER ${USERNAME}
89+
90+
# Set entrypoint to copied file
91+
ENTRYPOINT ["/usr/local/bin/entrypoint"]

‎contrib/containers/guix/docker-compose.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
version: "3.9"
2+
services:
3+
guix_ubuntu:
4+
build:
5+
context: '../../..'
6+
additional_contexts:
7+
- docker_root=.
8+
dockerfile: './contrib/containers/guix/Dockerfile'
9+
args:
10+
USER_ID: 1000 # set this to $(id -u) of the host
11+
GROUP_ID: 1000 # set this to $(id -g) of the host
12+
container_name: guix_ubuntu
13+
tty: true
14+
stdin_open: true
15+
privileged: true
16+
network_mode: host
17+
volumes:
18+
- "../../..:/src/dash:rw"

‎contrib/containers/guix/motd.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#####################################################
2+
To get started, run 'guix-start' and then calculate
3+
hashes using 'guix-check'
4+
#####################################################

‎contrib/containers/guix/scripts/entrypoint‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
# Read instructions
6+
cat /etc/motd
7+
8+
# Start the Guix daemon
9+
sudo env PATH=${PATH} guix-daemon \
10+
--build-users-group='guixbuild' \
11+
--substitute-urls='https://bordeaux.guix.gnu.org https://ci.guix.gnu.org' < /dev/null 2>&1 |
12+
sudo tee /var/log/guix.log > /dev/null &
13+
14+
# Hand over control
15+
exec bash

‎contrib/containers/guix/scripts/guix-check‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
cd /src/dash
6+
COMMIT_ID=$(git rev-parse --short=12 HEAD)
7+
8+
printf "Binaries:\n"
9+
( \
10+
SRC_PATH_PREFIX=guix-build-${COMMIT_ID}/distsrc- && \
11+
sha256sum ${SRC_PATH_PREFIX}*/src/dash{d,-cli,-tx,-wallet}{,.exe} && \
12+
sha256sum ${SRC_PATH_PREFIX}*/src/qt/dash-qt{,.exe} && \
13+
sha256sum ${SRC_PATH_PREFIX}*/src/test/test_dash{,.exe} \
14+
) | sort -k 2
15+
16+
printf "Archives:\n"
17+
find guix-build-"${COMMIT_ID}"/output -type f | grep -v SHA256 | xargs sha256sum | sort -k 2

‎contrib/containers/guix/scripts/guix-start‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
XCODE_VERSION="12.1"
6+
XCODE_RELEASE="12A7403"
7+
XCODE_ARCHIVE="Xcode-${XCODE_VERSION}-${XCODE_RELEASE}-extracted-SDK-with-libcxx-headers"
8+
9+
# Check if macOS SDK is present, if not, download it
10+
if [ ! -d "/src/dash/depends/SDKs/${XCODE_ARCHIVE}" ]
11+
then
12+
mkdir -p /src/dash/depends/SDKs
13+
curl -L https://bitcoincore.org/depends-sources/sdks/${XCODE_ARCHIVE}.tar.gz | tar -xz -C /src/dash/depends/SDKs
14+
fi
15+
16+
cd /src/dash
17+
git status >> /dev/null
18+
git config --global --add safe.directory /src/dash
19+
20+
./contrib/guix/guix-build

0 commit comments

Comments
 (0)