qubes-mirage-firewall/Dockerfile

# Pin the base image to a specific hash for maximum reproducibility.
# It will probably still work on newer images, though, unless an update
# changes some compiler optimisations (unlikely).
# bookworm-slim
FROM debian@sha256:07c6cb2ae86479dcc1942a89b0a1f4049b6e9415f7de327ff641aed58b8e3100
# and set the package source to a specific release too
RUN printf "deb [check-valid-until=no] http://snapshot.notset.fr/archive/debian/20230418T024659Z bookworm main" > /etc/apt/sources.list

RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip bzip2 make gcc g++ libc-dev
RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.1.5/opam-2.1.5-i686-linux && chmod 755 /usr/bin/opam

ENV OPAMROOT=/tmp
ENV OPAMCONFIRMLEVEL=unsafe-yes
# Pin last known-good version for reproducible builds.
# Remove this line (and the base image pin above) if you want to test with the
# latest versions.
RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#28b35f67988702df5018fbf30d1c725734425670
RUN opam switch create myswitch 4.14.1
RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5
RUN mkdir /tmp/orb-build
ADD config.ml /tmp/orb-build/config.ml
WORKDIR /tmp/orb-build
CMD opam exec -- sh -exc 'mirage configure -t xen --allocation-policy=best-fit && make depend && make tar'
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# Pin the base image to a specific hash for maximum reproducibility.`
Switch Docker base image from Alpine to Fedora There seems to be a problem with Xen events getting lost on Alpine. 2020-10-26 11:19:30 -04:00			`# It will probably still work on newer images, though, unless an update`
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# changes some compiler optimisations (unlikely).`
update build script 2023-04-18 05:46:45 -04:00			`# bookworm-slim`
			`FROM debian@sha256:07c6cb2ae86479dcc1942a89b0a1f4049b6e9415f7de327ff641aed58b8e3100`
			`# and set the package source to a specific release too`
do not check valid-until in debian release file: this permits to keep a debian packages list more than one week 2023-05-16 05:18:34 -04:00			`RUN printf "deb [check-valid-until=no] http://snapshot.notset.fr/archive/debian/20230418T024659Z bookworm main" > /etc/apt/sources.list`
update docker build for mirage 4.2 2022-08-09 08:16:16 -04:00
update build script 2023-04-18 05:46:45 -04:00			`RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip bzip2 make gcc g++ libc-dev`
Apply suggestions from code review 2023-07-05 11:06:00 -04:00			`RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.1.5/opam-2.1.5-i686-linux && chmod 755 /usr/bin/opam`
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building. 2017-01-28 08:44:21 -05:00
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`ENV OPAMROOT=/tmp`
			`ENV OPAMCONFIRMLEVEL=unsafe-yes`
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building. 2017-01-28 08:44:21 -05:00			`# Pin last known-good version for reproducible builds.`
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# Remove this line (and the base image pin above) if you want to test with the`
			`# latest versions.`
update build script 2023-04-18 05:46:45 -04:00			`RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#28b35f67988702df5018fbf30d1c725734425670`
			`RUN opam switch create myswitch 4.14.1`
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5`
			`RUN mkdir /tmp/orb-build`
			`ADD config.ml /tmp/orb-build/config.ml`
			`WORKDIR /tmp/orb-build`
			`CMD opam exec -- sh -exc 'mirage configure -t xen --allocation-policy=best-fit && make depend && make tar'`