Skip to content

Commit 94c46aa

Browse files
geyslanrscampos
geyslan
and
rscampos
authored
[v0.21.0] release build fix (#4146)
* chore(ci): use dev tag for docker image building (#4138) When SNAPSHOT=1, the local docker image will be tagged with dev tag to differentiate it from the official release which is tagged with the latest tag. commit: 1085fc5 (main), cherry-pick * chore: install last version of golang commit: 6c111b4 (main), cherry-pick * chore: golang binary move to tmp commit: 221b0ac (main), cherry-pick * fix: arm64 clang issue commit: 6cc06b2 (main), cherry-pick * fix(ci): make release rule to have prerequisites (#4141) These changes ensure that the 'release' rule will require the other rules to be executed (splitting the commands into different rules). This way, if any some of the rules fail, the build will be aborted right away. commit: 86c2c16 (main), cherry-pick * fix(build): extract OPA 0.66 from OPA dev image This workaround is required since OPA 0.65.0 (latest published release) has cve-2024-24790. After solved we can rollback to the previouw installation method. commit: ef7d74e (main), cherry-pick * fix(build): mv gh release logic to release rule (#4145) Continuation of #4141. commit: 6f94719 (main), cherry-pick --------- Co-authored-by: Raphael Campos <[email protected]>
1 parent 60266ab commit 94c46aa

File tree

4 files changed

+100
-37
lines changed

4 files changed

+100
-37
lines changed

‎builder/Dockerfile.alpine-tracee-container‎

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,20 @@
55
ARG BTFHUB=0
66
ARG FLAVOR=tracee-ebpf-core
77

8+
#
9+
# Version
10+
#
11+
12+
ARG GO_VERSION=1.22.0
13+
ARG OPA_VERSION=v0.63.0
14+
15+
16+
# This workaround is required since OPA 0.65.0 (latest published release) has cve-2024-24790.
17+
# After solved we can rollback to the commented installation lines below.
18+
#
19+
# Stage 1: Set the base image to get the OPA binary
20+
FROM openpolicyagent/opa:0.66.0-dev-static as opa-extractor
21+
822
#
923
# tracee-base
1024
#
@@ -23,9 +37,13 @@ RUN apk --no-cache update && \
2337

2438
# install OPA
2539

26-
RUN altarch=$(uname -m | sed 's:x86_64:amd64:g' | sed 's:aarch64:arm64:g') && \
27-
curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/v0.63.0/opa_linux_${altarch}_static && \
28-
chmod 755 /usr/bin/opa
40+
# ARG OPA_VERSION
41+
# RUN altarch=$(uname -m | sed 's:x86_64:amd64:g' | sed 's:aarch64:arm64:g') && \
42+
# curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/${OPA_VERSION}/opa_linux_${altarch}_static && \
43+
# chmod 755 /usr/bin/opa
44+
45+
# Stage 2: Copy the OPA binary from the OPA extractor
46+
COPY --from=opa-extractor /opa /usr/bin/opa
2947

3048
#
3149
# tracee-make-base
@@ -41,13 +59,14 @@ RUN apk --no-cache update && \
4159
apk --no-cache add bash git rsync && \
4260
apk --no-cache add coreutils findutils && \
4361
apk --no-cache add llvm14 clang14 && \
44-
apk --no-cache add go make gcc && \
62+
apk --no-cache add make gcc && \
4563
apk --no-cache add musl-dev && \
4664
apk --no-cache add linux-headers && \
4765
apk --no-cache add elfutils-dev && \
4866
apk --no-cache add libelf-static && \
4967
apk --no-cache add zlib-static && \
5068
apk --no-cache add zstd-static && \
69+
apk --no-cache add binutils-gold && \
5170
rm -f /usr/bin/cc && \
5271
rm -f /usr/bin/clang && \
5372
rm -f /usr/bin/clang++ && \
@@ -81,6 +100,17 @@ RUN apk --no-cache update && \
81100
ln -s /usr/lib/llvm14/bin/llvm-readelf /usr/bin/llvm-readelf && \
82101
ln -s /usr/lib/llvm14/bin/opt /usr/bin/opt
83102

103+
# install GO
104+
ARG GO_VERSION
105+
RUN altarch=$(uname -m | sed 's:x86_64:amd64:g' | sed 's:aarch64:arm64:g') && \
106+
curl -L -o go${GO_VERSION}.linux-${altarch}.tar.gz https://go.dev/dl/go${GO_VERSION}.linux-${altarch}.tar.gz && \
107+
tar -C /usr/local -xzf go${GO_VERSION}.linux-${altarch}.tar.gz && \
108+
echo 'export PATH=$PATH:/usr/local/go/bin' >> /etc/profile && \
109+
echo 'export GOROOT=/usr/local/go' >> /etc/profile && \
110+
echo 'export GOPATH=$HOME/go' >> /etc/profile && \
111+
echo 'export GOTOOLCHAIN=auto' >> /etc/profile && \
112+
echo 'export PATH=$PATH:$GOPATH/bin' >> /etc/profile
113+
84114
# install bpftool from btfhub
85115

86116
RUN cd /tmp && \
@@ -101,7 +131,8 @@ WORKDIR /tracee
101131

102132
COPY . /tracee
103133

104-
RUN make clean && \
134+
RUN source /etc/profile && \
135+
make clean && \
105136
BTFHUB=$BTFHUB make tracee && \
106137
BTFHUB=$BTFHUB make tracee-ebpf && \
107138
make tracee-rules && \

‎builder/Dockerfile.ubuntu-tracee-make‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,13 @@ FROM ubuntu:jammy
77
ARG uid=1000
88
ARG gid=1000
99

10+
#
11+
# Version
12+
#
13+
14+
ARG GO_VERSION=1.22.0
15+
ARG OPA_VERSION=v0.63.0
16+
1017
# install needed environment
1118

1219
RUN export DEBIAN_FRONTEND=noninteractive && \
@@ -30,9 +37,8 @@ RUN cd /tmp && \
3037
./3rdparty/bpftool.sh
3138

3239
# install OPA
33-
3440
RUN altarch=$(uname -m | sed 's:x86_64:amd64:g' | sed 's:aarch64:arm64:g') && \
35-
curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/v0.63.0/opa_linux_${altarch}_static && \
41+
curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/${OPA_VERSION}/opa_linux_${altarch}_static && \
3642
chmod 755 /usr/bin/opa
3743

3844
# extra tools for testing things
@@ -66,12 +72,11 @@ RUN export uid=$uid gid=$gid && \
6672
ln -s /home/tracee/.bashrc /home/tracee/.profile
6773

6874
# install extra packages (if needed)
69-
7075
RUN export DEBIAN_FRONTEND=noninteractive && \
7176
altarch=$(uname -m | sed 's:x86_64:amd64:g' | sed 's:aarch64:arm64:g') && \
7277
apt-get update && \
73-
curl -L -o /tmp/golang.tar.xz https://go.dev/dl/go1.21.5.linux-${altarch}.tar.gz && \
74-
tar -C /usr/local -xzf /tmp/golang.tar.xz && \
78+
curl -L -o /tmp/golang.tar.gz https://go.dev/dl/go${GO_VERSION}.linux-${altarch}.tar.gz && \
79+
tar -C /usr/local -xzf /tmp/golang.tar.gz && \
7580
update-alternatives --install /usr/bin/go go /usr/local/go/bin/go 1 && \
7681
update-alternatives --install /usr/bin/gofmt gofmt /usr/local/go/bin/gofmt 1
7782

‎builder/Makefile.release‎

Lines changed: 46 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -145,38 +145,16 @@ PUSH_DOCKER_REPO ?= aquasec/tracee
145145
.PHONY: release
146146
release: \
147147
$(OUTPUT_DIR) \
148+
build-tracee-btfhub \
149+
build-tracee-binary-static \
150+
build-tracee-binary-shared \
151+
archive \
148152
| .check_tree \
149153
.check_$(CMD_DOCKER) \
150154
.check_$(CMD_TAR) \
151155
.check_$(CMD_CHECKSUM) \
152156
.check_$(CMD_GITHUB)
153157
#
154-
# SNAPSHOT
155-
#
156-
157-
#
158-
# build official container image (CO-RE + BTFHUB).
159-
#
160-
$(MAKE) -f builder/Makefile.tracee-make alpine-prepare
161-
$(MAKE) -f builder/Makefile.tracee-make alpine-make ARG="clean"
162-
#
163-
BTFHUB=1 $(MAKE) -f builder/Makefile.tracee-container build-tracee
164-
#
165-
# build binaries (tracee, tracee-ebpf, tracee-rules, rules)
166-
#
167-
$(MAKE) -f builder/Makefile.tracee-make ubuntu-prepare
168-
$(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="clean"
169-
# static
170-
BTFHUB=0 STATIC=1 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="tracee-ebpf"
171-
BTFHUB=0 STATIC=1 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="tracee"
172-
$(CMD_MV) dist/tracee-ebpf dist/tracee-ebpf-static
173-
$(CMD_MV) dist/tracee dist/tracee-static
174-
# shared libs
175-
BTFHUB=0 STATIC=0 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="all"
176-
# tarball
177-
$(CMD_TAR) -cvzf $(OUT_ARCHIVE) $(RELEASE_FILES)
178-
$(CMD_CHECKSUM) $(OUT_ARCHIVE) > $(OUT_CHECKSUMS)
179-
#
180158
# note: TAGS created by release-snapshot workflow
181159
#
182160

@@ -212,6 +190,48 @@ endif
212190

213191
endif
214192

193+
#
194+
# build tracee
195+
#
196+
197+
.PHONY: alpine-prepare
198+
alpine-prepare:
199+
$(MAKE) -f builder/Makefile.tracee-make alpine-prepare && \
200+
$(MAKE) -f builder/Makefile.tracee-make alpine-prepare ARG="clean"
201+
202+
.PHONY: build-tracee-btfhub
203+
build-tracee-btfhub: alpine-prepare
204+
# build official container image (CO-RE + BTFHUB)
205+
BTFHUB=1 SNAPSHOT=$(SNAPSHOT) $(MAKE) -f builder/Makefile.tracee-container build-tracee
206+
207+
#
208+
# build binaries (tracee, tracee-ebpf, tracee-rules, rules)
209+
#
210+
211+
.PHONY: ubuntu-prepare
212+
ubuntu-prepare:
213+
$(MAKE) -f builder/Makefile.tracee-make ubuntu-prepare && \
214+
$(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="clean"
215+
216+
.PHONY: build-tracee-binary-static
217+
build-tracee-binary-static: ubuntu-prepare
218+
# static
219+
BTFHUB=0 STATIC=1 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="tracee-ebpf" && \
220+
BTFHUB=0 STATIC=1 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="tracee" && \
221+
$(CMD_MV) dist/tracee-ebpf dist/tracee-ebpf-static
222+
$(CMD_MV) dist/tracee dist/tracee-static
223+
224+
.PHONY: build-tracee-binary-shared
225+
build-tracee-binary-shared: ubuntu-prepare
226+
# shared libs
227+
BTFHUB=0 STATIC=0 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="all"
228+
229+
.PHONY: archive
230+
archive:
231+
# tarball
232+
$(CMD_TAR) -cvzf $(OUT_ARCHIVE) $(RELEASE_FILES) && \
233+
$(CMD_CHECKSUM) $(OUT_ARCHIVE) > $(OUT_CHECKSUMS)
234+
215235
.PHONY: clean
216236
clean:
217237
#

‎builder/Makefile.tracee-container‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,14 @@ ifeq ($(BTFHUB),)
101101
BTFHUB=0
102102
endif
103103

104-
TRACEE_CONT_NAME = tracee:latest
104+
SNAPSHOT ?= 0
105+
TAG ?= latest
106+
107+
ifeq ($(SNAPSHOT),1)
108+
TAG=dev
109+
endif
110+
111+
TRACEE_CONT_NAME = tracee:$(TAG)
105112
TRACEE_CONT_DOCKERFILE = builder/Dockerfile.alpine-tracee-container
106113

107114
.PHONY: build-tracee

0 commit comments

Comments
 (0)