Implement Docker best practices (#6373)

* Pin versions for connectedhomeip/chip-build image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-efr32 image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-android image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-cirque image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-esp32 image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-esp32-qemu image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-k32w image

Signed-off-by: Victor Morales <v.morales@samsung.com>

* Pin versions for connectedhomeip/chip-build-nrf-platform image

Signed-off-by: Victor Morales <v.morales@samsung.com>

integrations/docker/images/chip-build-android/Dockerfile

@@ -6,10 +6,10 @@ FROM connectedhomeip/chip-build:${VERSION}
 # doesn't work with JDK 11.
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- openjdk-8-jdk \
- rsync \
- swig \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ openjdk-8-jdk=8u292-b10-0ubuntu1~20.04 \
+ rsync=3.1.3-8 \
+ swig=4.0.1-5build1 \
  && rm -rf /var/lib/apt/lists/ \
  && : # last line
 

integrations/docker/images/chip-build-cirque/Dockerfile

@@ -1,44 +1,47 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # Bazel
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- curl gnupg \
- && curl -fsSL https://bazel.build/bazel-release.pub.gpg | gpg --dearmor > bazel.gpg \
- && mv bazel.gpg /etc/apt/trusted.gpg.d/ \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ curl=7.68.0-1ubuntu2.5 gnupg=2.2.19-3ubuntu2.1 \
+ && curl -fsSL https://bazel.build/bazel-release.pub.gpg | gpg --dearmor > /etc/apt/trusted.gpg.d/bazel.gpg \
  && echo "deb [arch=amd64] https://storage.googleapis.com/bazel-apt stable jdk1.8" | tee /etc/apt/sources.list.d/bazel.list \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- bazel \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ bazel=4.0.0 \
+ && rm -rf /var/lib/apt/lists/ \
  && : # aids diffs
 
 # Docker
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- curl gnupg-agent apt-transport-https ca-certificates \
- software-properties-common \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ curl=7.68.0-1ubuntu2.5 gnupg-agent=2.2.19-3ubuntu2.1 apt-transport-https=2.0.5 ca-certificates=20210119~20.04.1 \
+ software-properties-common=0.98.9.4 \
  && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
  && add-apt-repository \
  "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- docker-ce docker-ce-cli containerd.io \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ docker-ce=5:20.10.6~3-0~ubuntu-focal docker-ce-cli=5:20.10.6~3-0~ubuntu-focal containerd.io=1.4.4-1 \
+ && rm -rf /var/lib/apt/lists/ \
  && : # aids diffs
 
 # Other Cirque prereqs
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- sudo socat psmisc tigervnc-standalone-server tigervnc-viewer \
- python3-pip python3-venv python3-setuptools libdbus-glib-1-dev \
- uuid-runtime libgirepository1.0-dev \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ sudo=1.8.31-1ubuntu1.2 socat=1.7.3.3-2 psmisc=23.3-1 tigervnc-standalone-server=1.10.1+dfsg-3 tigervnc-viewer=1.10.1+dfsg-3 \
+ python3-pip=20.0.2-5ubuntu1.3 python3-venv=3.8.2-0ubuntu2 python3-setuptools=45.2.0-1 libdbus-glib-1-dev=0.110-5fakssync1 \
+ uuid-runtime=2.34-0.1ubuntu9.1 libgirepository1.0-dev=1.64.1-1~ubuntu20.04.1 \
+ && rm -rf /var/lib/apt/lists/ \
  && : # aids diffs
 
 COPY requirements_nogrpc.txt /requirements.txt
 
 RUN set -x \
- && pip3 install -r requirements.txt \
+ && pip3 install --no-cache-dir -r requirements.txt \
  && : # aids diffs

integrations/docker/images/chip-build-efr32/Dockerfile

@@ -1,13 +1,12 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
-
-
-
 # GNU ARM Embedded toolchain, cross compiler for various platform builds
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
- gcc-arm-none-eabi \
- binutils-arm-none-eabi \
- ccache
+ && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+ gcc-arm-none-eabi=15:9-2019-q4-0ubuntu1 \
+ binutils-arm-none-eabi=2.34-4ubuntu1+13ubuntu1 \
+ ccache=3.7.7-1 \
+ && rm -rf /var/lib/apt/lists/ \
+ && : # last line

integrations/docker/images/chip-build-esp32-qemu/Dockerfile

@@ -1,14 +1,13 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build-esp32:${VERSION}
 
+WORKDIR /opt/espressif/qemu
+
 # Setup QEMU emulator for ESP32 platform
 RUN set -x \
- && mkdir -p /opt/espressif \
- && git clone --progress --depth 1 --branch esp-develop-20210220 https://github.com/espressif/qemu.git /opt/espressif/qemu-src \
- && mkdir -p /opt/espressif/qemu \
- && (cd /opt/espressif/qemu \
+ && git clone --depth 1 --branch esp-develop-20210220 https://github.com/espressif/qemu.git /opt/espressif/qemu-src \
  && ../qemu-src/configure --target-list=xtensa-softmmu --enable-debug --enable-sanitizers --disable-strip --disable-user --disable-capstone --disable-vnc --disable-sdl --disable-gtk \
- && make -j8) \
+ && make -j8 \
  && : # last line
 
 ENV QEMU_ESP32_DIR=/opt/espressif/qemu

integrations/docker/images/chip-build-esp32/Dockerfile

@@ -1,16 +1,17 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
+WORKDIR /opt/espressif/esp-idf
+
 # Setup the ESP-IDF
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -y python libgcrypt20-dev \
- && mkdir -p /opt/espressif \
- && cd /opt/espressif \
- && git clone --progress -b release/v4.2 https://github.com/espressif/esp-idf.git \
- && cd esp-idf \
- && git submodule update --init --progress \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+ python-is-python2=2.7.17-4 libgcrypt20-dev=1.8.5-5ubuntu1 \
+ && git clone --depth=1 -b release/v4.2 https://github.com/espressif/esp-idf.git /opt/espressif/esp-idf \
+ && git submodule update --init \
  && IDF_TOOLS_PATH=/opt/espressif/tools ./install.sh \
+ && rm -rf /var/lib/apt/lists/ \
  && : # last line
 
 ENV IDF_PATH=/opt/espressif/esp-idf/

integrations/docker/images/chip-build-k32w/Dockerfile

@@ -1,19 +1,19 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
+WORKDIR /opt/sdk
+
 # Setup the K32W SDK
 RUN set -x \
  && apt-get update \
- && DEBIAN_FRONTEND=noninteractive apt-get install -y wget unzip \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+ wget=1.20.3-1ubuntu1 unzip=6.0-25ubuntu1 \
  && rm -rf /var/lib/apt/lists/ \
- && mkdir -p /opt/sdk \
- && cd /opt/sdk \
  && wget https://mcuxpresso.nxp.com/eclipse/sdk/2.6.3/plugins/com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
  && unzip com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
- && rm -rf com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
- && cd sdks \
- && unzip 5faab205f2663647c5c7ce05c382d2a8.zip \
- && rm -rf 5faab205f2663647c5c7ce05c382d2a8.zip \
+ && unzip sdks/5faab205f2663647c5c7ce05c382d2a8.zip -d sdks/ \
+ && rm -f com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
+ && rm -f sdk/5faab205f2663647c5c7ce05c382d2a8.zip \
  && : # last line
 
 ENV K32W061_SDK_ROOT=/opt/sdk/sdks

integrations/docker/images/chip-build-nrf-platform/Dockerfile

@@ -8,44 +8,48 @@ ARG NCS_REVISION=v1.5.0
 # nRF Connect SDK dependencies
 # ==================================================
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+WORKDIR /opt/NordicSemiconductor/nRF5_tools/install
+
 # Tools for building, flashing and accessing device logs
 RUN set -x \
  && apt-get update \
- && apt-get install --no-install-recommends -fy device-tree-compiler \
- && (mkdir -p /opt/NordicSemiconductor/nRF5_tools/install && cd /opt/NordicSemiconductor/nRF5_tools/install \
+ && apt-get install --no-install-recommends -fy device-tree-compiler=1.5.1-1 \
  && curl https://www.nordicsemi.com/-/media/Software-and-other-downloads/Desktop-software/nRF-command-line-tools/sw/Versions-10-x-x/10-12-1/nRFCommandLineTools10121Linuxamd64.tar.gz \
  | tar zxvf - \
- && cd .. \
- && tar xvf install/JLink_Linux_V688a_x86_64.tgz \
- && tar xvf install/nRF-Command-Line-Tools_10_12_1.tar \
- && rm -rf ./install /var/lib/apt/lists/) \
+ && tar xvf JLink_Linux_V688a_x86_64.tgz -C /opt/NordicSemiconductor/nRF5_tools/ \
+ && tar xvf nRF-Command-Line-Tools_10_12_1.tar -C /opt/NordicSemiconductor/nRF5_tools/ \
+ && rm -rf ./install /var/lib/apt/lists/ \
  && : # last line
 
 ENV NRF5_TOOLS_ROOT=/opt/NordicSemiconductor/nRF5_tools
 ENV PATH=${NRF5_TOOLS_ROOT}/JLink_Linux_V688a_x86_64:${PATH}
 ENV PATH=${NRF5_TOOLS_ROOT}/mergehex:${NRF5_TOOLS_ROOT}/nrfjprog:${PATH}
 ENV LD_LIBRARY_PATH=${NRF5_TOOLS_ROOT}/JLink_Linux_V688a_x86_64:${LD_LIBRARY_PATH}
 
+WORKDIR /opt/ARM-software
+
 # GNU ARM Embedded toolchain, cross compiler for various platform builds
 RUN set -x \
- && (mkdir -p /opt/ARM-software && cd /opt/ARM-software \
  && curl https://armkeil.blob.core.windows.net/developer/Files/downloads/gnu-rm/9-2019q4/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2 \
- | tar jxvf -) \
+ | tar jxvf - \
  && : # last line
 
 ENV ARM_GCC_INSTALL_ROOT=/opt/ARM-software/gcc-arm-none-eabi-9-2019-q4-major/bin/
 
+WORKDIR /opt/NordicSemiconductor/nrfconnect
+
 # ==================================================
 # nRF Connect SDK
 # ==================================================
 RUN set -x \
- && (mkdir -p /opt/NordicSemiconductor/nrfconnect && cd /opt/NordicSemiconductor/nrfconnect \
- && python3 -m pip install -U --no-cache-dir pip setuptools wheel cmake west \
+ && python3 -m pip install -U --no-cache-dir pip==21.1 setuptools==56.0.0 wheel==0.36.2 cmake==3.18.4.post1 west==0.10.1 \
  && west init -m https://github.com/nrfconnect/sdk-nrf --mr $NCS_REVISION \
  && west update \
  && python3 -m pip install --no-cache-dir -r zephyr/scripts/requirements.txt \
  && python3 -m pip install --no-cache-dir -r nrf/scripts/requirements.txt \
- && python3 -m pip install --no-cache-dir -r bootloader/mcuboot/scripts/requirements.txt) \
+ && python3 -m pip install --no-cache-dir -r bootloader/mcuboot/scripts/requirements.txt \
  && echo "source /opt/NordicSemiconductor/nrfconnect/zephyr/zephyr-env.sh" >> ~/.bashrc \
  && : # last line