Skip to content

Commit cebaca0

Browse files
gyuhogyuho
committed
feat(container/docker): document how to vend source code of dependencies
Signed-off-by: Gyuho Lee <[email protected]>
1 parent 7c6b746 commit cebaca0

File tree

3 files changed

+1113
-2
lines changed

3 files changed

+1113
-2
lines changed

‎Dockerfile‎

Lines changed: 144 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,32 @@
11
# This Dockerfile is designed for multi-architecture builds using `docker buildx`.
2+
# Use scripts/build-docker.sh to build this image.
3+
#
4+
# This image includes source code for all third-party open source components
5+
# in /usr/share/third_party/ for compliance requirements.
26

37
# Define build arguments for OS, version, and CUDA.
48
# Example: --build-arg OS_NAME=ubuntu --build-arg OS_VERSION=24.04
59
ARG OS_NAME="ubuntu"
610
ARG OS_VERSION="22.04"
711
ARG CUDA_VERSION="12.4.1"
812

13+
# ==============================================================================
14+
# Stage 1: Builder - Build gpud binary and vendor Go dependencies
15+
# ==============================================================================
916
FROM golang:1.24.7 AS builder
1017
ARG TARGETOS
1118
ARG TARGETARCH
1219
ARG BUILDPLATFORM
1320

1421
WORKDIR /workspace
22+
1523
# Copy the Go Modules manifests
1624
COPY go.mod go.mod
1725
COPY go.sum go.sum
1826

19-
# Download dependencies as a separate step to take advantage of Docker's caching
20-
RUN go mod download
27+
# Download dependencies and create vendor directory with all source code
28+
RUN go mod download && \
29+
go mod vendor
2130

2231
COPY api/ api/
2332
COPY client/ client/
@@ -28,8 +37,97 @@ COPY pkg/ pkg/
2837
COPY version/ version/
2938
COPY Makefile Makefile
3039

40+
# Build the binary
3141
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} make
3242

43+
# Generate Go module manifest with versions
44+
RUN echo "# Go Module Dependencies" > /workspace/GO_MODULES.txt && \
45+
echo "# Generated at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /workspace/GO_MODULES.txt && \
46+
echo "" >> /workspace/GO_MODULES.txt && \
47+
go list -m -json all 2>/dev/null | \
48+
grep -E '"(Path|Version|Dir)"' | \
49+
sed 's/[",]//g' | \
50+
paste - - - | \
51+
awk '{print $2, $4}' >> /workspace/GO_MODULES.txt || true
52+
53+
# ==============================================================================
54+
# Stage 2: APT Sources - Download source packages for all apt dependencies
55+
# ==============================================================================
56+
FROM ${OS_NAME}:${OS_VERSION} AS apt-sources
57+
58+
# Avoid interactive prompts
59+
ENV DEBIAN_FRONTEND=noninteractive
60+
61+
WORKDIR /apt-sources
62+
63+
# Enable source repositories and install required tools
64+
RUN sed -i 's/^# deb-src/deb-src/' /etc/apt/sources.list && \
65+
apt-get update && \
66+
apt-get install -y --no-install-recommends \
67+
dpkg-dev \
68+
ca-certificates \
69+
curl \
70+
gnupg
71+
72+
# Add Docker's official GPG key and source repository
73+
RUN install -m 0755 -d /etc/apt/keyrings && \
74+
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg && \
75+
chmod a+r /etc/apt/keyrings/docker.gpg && \
76+
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
77+
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list && \
78+
echo "deb-src [signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
79+
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" >> /etc/apt/sources.list.d/docker.list && \
80+
apt-get update
81+
82+
# Download source packages for all runtime dependencies
83+
# Note: Some packages may not have source available via apt-get source
84+
RUN mkdir -p /apt-sources/packages && cd /apt-sources/packages && \
85+
# Standard Ubuntu packages
86+
apt-get source --download-only ca-certificates || true && \
87+
apt-get source --download-only curl || true && \
88+
apt-get source --download-only gnupg2 || true && \
89+
apt-get source --download-only pciutils || true && \
90+
apt-get source --download-only dmidecode || true && \
91+
apt-get source --download-only util-linux || true && \
92+
apt-get source --download-only kmod || true && \
93+
apt-get source --download-only sudo || true
94+
95+
# Download Docker package sources
96+
# First try apt-get source, then fall back to GitHub with matching versions
97+
RUN cd /apt-sources/packages && \
98+
# Get docker-ce-cli source - try apt first, fallback to GitHub
99+
(apt-get source --download-only docker-ce-cli 2>/dev/null || \
100+
(echo "docker-ce-cli source not available via apt, downloading from GitHub..." && \
101+
DOCKER_VERSION=$(apt-cache policy docker-ce-cli 2>/dev/null | grep Candidate | awk '{print $2}' | sed 's/.*://' | cut -d'-' -f1) && \
102+
curl -fsSL -o docker-cli-v${DOCKER_VERSION}-source.tar.gz https://github.com/docker/cli/archive/refs/tags/v${DOCKER_VERSION}.tar.gz)) && \
103+
# Get containerd.io source - try apt first, fallback to GitHub
104+
(apt-get source --download-only containerd.io 2>/dev/null || \
105+
(echo "containerd.io source not available via apt, downloading from GitHub..." && \
106+
CONTAINERD_VERSION=$(apt-cache policy containerd.io 2>/dev/null | grep Candidate | awk '{print $2}' | sed 's/.*://' | cut -d'-' -f1) && \
107+
curl -fsSL -o containerd-v${CONTAINERD_VERSION}-source.tar.gz https://github.com/containerd/containerd/archive/refs/tags/v${CONTAINERD_VERSION}.tar.gz))
108+
109+
# Generate manifest of downloaded sources
110+
RUN echo "# APT Package Sources" > /apt-sources/APT_SOURCES.txt && \
111+
echo "# Generated at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /apt-sources/APT_SOURCES.txt && \
112+
echo "" >> /apt-sources/APT_SOURCES.txt && \
113+
echo "## Downloaded source packages:" >> /apt-sources/APT_SOURCES.txt && \
114+
ls -la /apt-sources/packages/ >> /apt-sources/APT_SOURCES.txt && \
115+
echo "" >> /apt-sources/APT_SOURCES.txt && \
116+
echo "## Package versions installed in final image:" >> /apt-sources/APT_SOURCES.txt && \
117+
echo "ca-certificates: $(apt-cache policy ca-certificates | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
118+
echo "curl: $(apt-cache policy curl | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
119+
echo "gnupg: $(apt-cache policy gnupg | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
120+
echo "pciutils: $(apt-cache policy pciutils | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
121+
echo "dmidecode: $(apt-cache policy dmidecode | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
122+
echo "util-linux: $(apt-cache policy util-linux | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
123+
echo "kmod: $(apt-cache policy kmod | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
124+
echo "sudo: $(apt-cache policy sudo | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
125+
echo "docker-ce-cli: $(apt-cache policy docker-ce-cli | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt && \
126+
echo "containerd.io: $(apt-cache policy containerd.io | grep Candidate | awk '{print $2}')" >> /apt-sources/APT_SOURCES.txt
127+
128+
# ==============================================================================
129+
# Stage 3: Final Runtime Image
130+
# ==============================================================================
33131
# Use the NVIDIA CUDA runtime image as the final base. This provides the necessary
34132
# CUDA libraries to interact with the GPU driver.
35133
FROM nvidia/cuda:${CUDA_VERSION}-runtime-${OS_NAME}${OS_VERSION}
@@ -56,6 +154,50 @@ RUN apt-get update && \
56154
apt-get install -y --no-install-recommends docker-ce-cli containerd.io && \
57155
rm -rf /var/lib/apt/lists/*
58156

157+
# Copy the gpud binary
59158
COPY --from=builder /workspace/bin/gpud /usr/local/bin/gpud
60159

160+
# ==============================================================================
161+
# Third-Party Source Code
162+
# ==============================================================================
163+
# Create third_party directory structure
164+
RUN mkdir -p /usr/share/third_party/go \
165+
/usr/share/third_party/apt
166+
167+
# Copy Go module source code (vendored dependencies)
168+
COPY --from=builder /workspace/vendor /usr/share/third_party/go/vendor
169+
COPY --from=builder /workspace/GO_MODULES.txt /usr/share/third_party/go/
170+
171+
# Copy APT package sources
172+
COPY --from=apt-sources /apt-sources/packages /usr/share/third_party/apt/
173+
COPY --from=apt-sources /apt-sources/APT_SOURCES.txt /usr/share/third_party/apt/
174+
175+
# Generate main manifest file
176+
RUN echo "# Third-Party Open Source Components" > /usr/share/third_party/MANIFEST.txt && \
177+
echo "# Source Code Inclusion for Compliance" >> /usr/share/third_party/MANIFEST.txt && \
178+
echo "# Generated at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> /usr/share/third_party/MANIFEST.txt && \
179+
echo "" >> /usr/share/third_party/MANIFEST.txt && \
180+
echo "This container includes source code for all third-party open source" >> /usr/share/third_party/MANIFEST.txt && \
181+
echo "components as required for compliance." >> /usr/share/third_party/MANIFEST.txt && \
182+
echo "" >> /usr/share/third_party/MANIFEST.txt && \
183+
echo "## Directory Structure" >> /usr/share/third_party/MANIFEST.txt && \
184+
echo "" >> /usr/share/third_party/MANIFEST.txt && \
185+
echo "/usr/share/third_party/" >> /usr/share/third_party/MANIFEST.txt && \
186+
echo " go/ - Go module dependencies (source code)" >> /usr/share/third_party/MANIFEST.txt && \
187+
echo " vendor/ - Vendored Go packages" >> /usr/share/third_party/MANIFEST.txt && \
188+
echo " GO_MODULES.txt - List of Go modules with versions" >> /usr/share/third_party/MANIFEST.txt && \
189+
echo " apt/ - APT package sources" >> /usr/share/third_party/MANIFEST.txt && \
190+
echo " APT_SOURCES.txt - List of APT packages with versions" >> /usr/share/third_party/MANIFEST.txt && \
191+
echo " MANIFEST.txt - This file" >> /usr/share/third_party/MANIFEST.txt && \
192+
echo "" >> /usr/share/third_party/MANIFEST.txt && \
193+
echo "## Go Dependencies" >> /usr/share/third_party/MANIFEST.txt && \
194+
echo "See go/GO_MODULES.txt for complete list" >> /usr/share/third_party/MANIFEST.txt && \
195+
echo "" >> /usr/share/third_party/MANIFEST.txt && \
196+
echo "## APT Dependencies" >> /usr/share/third_party/MANIFEST.txt && \
197+
echo "See apt/APT_SOURCES.txt for complete list" >> /usr/share/third_party/MANIFEST.txt && \
198+
echo "" >> /usr/share/third_party/MANIFEST.txt && \
199+
echo "## Base Image" >> /usr/share/third_party/MANIFEST.txt && \
200+
echo "This image is based on nvidia/cuda runtime image." >> /usr/share/third_party/MANIFEST.txt && \
201+
echo "CUDA base image sources are managed separately by NVIDIA." >> /usr/share/third_party/MANIFEST.txt
202+
61203
ENTRYPOINT ["/usr/local/bin/gpud"]

0 commit comments

Comments
 (0)