qubes-mirage-firewall/Dockerfile

# Pin the base image to a specific hash for maximum reproducibility.
# It will probably still work on newer images, though, unless an update
# changes some compiler optimisations (unlikely).
# ubuntu-20.04
FROM ubuntu@sha256:b25ef49a40b7797937d0d23eca3b0a41701af6757afca23d504d50826f0b37ce

RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip make gcc g++ libc-dev
RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.1.3/opam-2.1.3-i686-linux && chmod 755 /usr/bin/opam

ENV OPAMROOT=/tmp
ENV OPAMCONFIRMLEVEL=unsafe-yes
# Pin last known-good version for reproducible builds.
# Remove this line (and the base image pin above) if you want to test with the
# latest versions.
RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#c9b2f766b7c7009be8cd68ac423d0d5b36044aca
RUN opam switch create myswitch 4.14.0
RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5
RUN mkdir /tmp/orb-build
ADD config.ml /tmp/orb-build/config.ml
WORKDIR /tmp/orb-build
CMD opam exec -- sh -exc 'mirage configure -t xen --allocation-policy=best-fit && make depend && make tar'
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# Pin the base image to a specific hash for maximum reproducibility.`
Switch Docker base image from Alpine to Fedora There seems to be a problem with Xen events getting lost on Alpine. 2020-10-26 11:19:30 -04:00			`# It will probably still work on newer images, though, unless an update`
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# changes some compiler optimisations (unlikely).`
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`# ubuntu-20.04`
			`FROM ubuntu@sha256:b25ef49a40b7797937d0d23eca3b0a41701af6757afca23d504d50826f0b37ce`
update docker build for mirage 4.2 2022-08-09 08:16:16 -04:00
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip make gcc g++ libc-dev`
			`RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.1.3/opam-2.1.3-i686-linux && chmod 755 /usr/bin/opam`
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building. 2017-01-28 08:44:21 -05:00
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`ENV OPAMROOT=/tmp`
			`ENV OPAMCONFIRMLEVEL=unsafe-yes`
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building. 2017-01-28 08:44:21 -05:00			`# Pin last known-good version for reproducible builds.`
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# Remove this line (and the base image pin above) if you want to test with the`
			`# latest versions.`
update opam repository commit to get solo5 0.7.5 2022-12-07 13:15:44 -05:00			`RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#c9b2f766b7c7009be8cd68ac423d0d5b36044aca`
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`RUN opam switch create myswitch 4.14.0`
			`RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5`
			`RUN mkdir /tmp/orb-build`
			`ADD config.ml /tmp/orb-build/config.ml`
			`WORKDIR /tmp/orb-build`
			`CMD opam exec -- sh -exc 'mirage configure -t xen --allocation-policy=best-fit && make depend && make tar'`