Dockerfile: install criu from binary repo#41739
Dockerfile: install criu from binary repo#41739kolyshkin wants to merge 1 commit intomoby:masterfrom
Conversation
|
Cc @adrianreber |
Dockerfile
Outdated
There was a problem hiding this comment.
CI probably fails because this needs to be /usr/sbin/criu
There was a problem hiding this comment.
I tested this patch (with make BIND_DIR=. shell) and it works with the following change:
-COPY --from=criu /usr/bin/criu /usr/local/bin
+COPY --from=criu /usr/sbin/criu /usr/local/binThere was a problem hiding this comment.
Ah, so stupid of me; fixed now.
|
@thaJeztah PTAL (this simplifies and speeds up build) |
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
| echo 'deb https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_10/ /' > /etc/apt/sources.list.d/criu.list \ | ||
| && curl -fsSL https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_10/Release.key | apt-key add - \ |
There was a problem hiding this comment.
Somewhat confusing the the "debian" packages are on a "opensuse" repository 😅
Do we need to replace the use of apt-key add here @tianon ? (recalling I was in the middle of reviewing docker/docs#11990)
There was a problem hiding this comment.
We don't immediately "need" to, but we will soon and definitely should.
If we don't actually care about the provenance, we can just download the file straight to /etc/apt/trusted.gpg.d/something.gpg.asc (probably criu.gpg.asc) and it will work in this instance (and be at least as secure as piping to apt-key add -...)
There was a problem hiding this comment.
I gave it a quick try, and that works; tried to use ADD instead of curl (so that cache would be invalidated would the key change), but ran into a bug, LOL (opened moby/buildkit#2114)
ADD --chmod=0644 https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_10/Release.key /etc/apt/trusted.gpg.d/criu.gpg.asc
# FIXME: workaround for https://github.com/moby/buildkit/issues/2114
RUN chmod 0644 /etc/apt/trusted.gpg.d/criu.gpg.asc
RUN --mount=type=cache,sharing=locked,id=moby-criu-aptlib,target=/var/lib/apt \
--mount=type=cache,sharing=locked,id=moby-criu-aptcache,target=/var/cache/apt \
echo 'deb https://download.opensuse.org/repositories/devel:/tools:/criu/Debian_10/ /' > /etc/apt/sources.list.d/criu.list \
&& apt-get update \
&& apt-get install -y --no-install-recommends criu \
&& install -D /usr/sbin/criu /build/Let me know what you think @tianon @kolyshkin
There was a problem hiding this comment.
Actually, let me add install -D /usr/sbin/criu /build/ so that we can revert the change to the COPY --from as well
| COPY --from=tini /build/ /usr/local/bin/ | ||
| COPY --from=registry /build/ /usr/local/bin/ | ||
| COPY --from=criu /build/ /usr/local/ | ||
| COPY --from=criu /usr/sbin/criu /usr/local/bin |
There was a problem hiding this comment.
I guess apt-get install does not have a --prefix option (unless compiling form source) 😓 (would've been nice if we could keep the same paths)
There was a problem hiding this comment.
We could do something cute like criu="$(which criu)"; ln "$criu" /build/ after the apt-get install 
There was a problem hiding this comment.
Given that we don't run the intermediate criu stage, and only use it to download the package, I took a different approach in https://github.com/moby/moby/pull/41739/files#r634478731
There was a problem hiding this comment.
We can literally have images in ghcr or hub for all of these things we currently build in the Dockerfile..
Speed things up a lot.
There was a problem hiding this comment.
But then we'd have to maintain (multi-arch) images for each of those stages?
There was a problem hiding this comment.
Shouldn't be terribly difficult.
We only need to add the versions we pull in here.
|
Thanks! Overall looks good, but left a question for Tianon (probably not a blocker anyway, but could make upgrading to newer versions of Debian easier once Debian 11 becomes the new "stable") |
|
Hitting this on s390x (we were discussing this issue on slack) https://ci-next.docker.com/public/blue/rest/organizations/jenkins/pipelines/moby/branches/PR-41739/runs/3/nodes/168/log/?start=0 /cc @cpuguy83 @tonistiigi Details of that machine: Details |
closes #42362
- What I did
We were compiling criu from sources for quite a long time (in CI it is to run checkpoint/restore tests).
It takes a long time and is not really needed, since now we have a repo maintained by criu.
Use it.
- How I did it
vim Dockerfile- How to verify it
- Description for the changelog
not needed
- A picture of a cute animal (not mandatory but encouraged)