qubes-mirage-firewall/Dockerfile

# Pin the base image to a specific hash for maximum reproducibility.
# It will probably still work on newer images, though, unless an update
# changes some compiler optimisations (unlikely).
# bookworm-slim taken from https://hub.docker.com/_/debian/tags?page=1&name=bookworm-slim
FROM debian@sha256:3d5df92588469a4c503adbead0e4129ef3f88e223954011c2169073897547cac
# install remove default packages repository
RUN rm /etc/apt/sources.list.d/debian.sources
# and set the package source to a specific release too
# taken from https://snapshot.debian.org/archive/debian
RUN printf "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20240419T024211Z bookworm main\n" > /etc/apt/sources.list
# taken from https://snapshot.debian.org/archive/debian-security/
RUN printf "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20240419T111010Z bookworm-security main\n" >> /etc/apt/sources.list

RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip bzip2 make gcc g++ libc-dev
RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.2.1/opam-2.2.1-i686-linux && chmod 755 /usr/bin/opam
# taken from https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh
RUN test `sha512sum /usr/bin/opam | cut -d' ' -f1` = \
"bf16d573137835ce9abbcf6b99cb94a1da69ab58804a4de7c90233f0b354d5e68e9c47ee16670ca9d59866d58c7db345d9723e6eb5fc3a1cb8dca371f0e90225" || exit

ENV OPAMROOT=/tmp
ENV OPAMCONFIRMLEVEL=unsafe-yes
# Pin last known-good version for reproducible builds.
# Remove this line (and the base image pin above) if you want to test with the
# latest versions.
# taken from https://github.com/ocaml/opam-repository
RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#5d3f0d1d655199e596a1e785e69fae8fad78cad3
RUN opam switch create myswitch 4.14.2
RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5
RUN mkdir /tmp/orb-build
ADD config.ml /tmp/orb-build/config.ml
WORKDIR /tmp/orb-build
CMD opam exec -- sh -exc 'mirage configure -t xen --extra-repos=\
opam-overlays:https://github.com/dune-universe/opam-overlays.git#4e75ee36715b27550d5bdb87686bb4ae4c9e89c4,\
mirage-overlays:https://github.com/dune-universe/mirage-opam-overlays.git#797cb363df3ff763c43c8fbec5cd44de2878757e \
&& make depend && make tar'
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# Pin the base image to a specific hash for maximum reproducibility.`
Switch Docker base image from Alpine to Fedora There seems to be a problem with Xen events getting lost on Alpine. 2020-10-26 11:19:30 -04:00			`# It will probably still work on newer images, though, unless an update`
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# changes some compiler optimisations (unlikely).`
change snapshots for debian ones 2023-11-07 07:47:12 -05:00			`# bookworm-slim taken from https://hub.docker.com/_/debian/tags?page=1&name=bookworm-slim`
update the compilation toolchain, including upgrade to mirage 4.5.0 2024-04-23 12:10:32 -04:00			`FROM debian@sha256:3d5df92588469a4c503adbead0e4129ef3f88e223954011c2169073897547cac`
check opam hashsum in Dockerfile 2023-11-09 08:41:16 -05:00			`# install remove default packages repository`
change snapshots for debian ones 2023-11-07 07:47:12 -05:00			`RUN rm /etc/apt/sources.list.d/debian.sources`
update build script 2023-04-18 05:46:45 -04:00			`# and set the package source to a specific release too`
change snapshots for debian ones 2023-11-07 07:47:12 -05:00			`# taken from https://snapshot.debian.org/archive/debian`
update the compilation toolchain, including upgrade to mirage 4.5.0 2024-04-23 12:10:32 -04:00			`RUN printf "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20240419T024211Z bookworm main\n" > /etc/apt/sources.list`
change snapshots for debian ones 2023-11-07 07:47:12 -05:00			`# taken from https://snapshot.debian.org/archive/debian-security/`
update the compilation toolchain, including upgrade to mirage 4.5.0 2024-04-23 12:10:32 -04:00			`RUN printf "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20240419T111010Z bookworm-security main\n" >> /etc/apt/sources.list`
update docker build for mirage 4.2 2022-08-09 08:16:16 -04:00
update build script 2023-04-18 05:46:45 -04:00			`RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip bzip2 make gcc g++ libc-dev`
use a newer opam, 2.2.1, instead of 2.1.5 2024-10-15 15:44:31 -04:00			`RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.2.1/opam-2.2.1-i686-linux && chmod 755 /usr/bin/opam`
check opam hashsum in Dockerfile 2023-11-09 08:41:16 -05:00			`# taken from https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh`
			RUN test `sha512sum /usr/bin/opam \| cut -d' ' -f1` = \
use a newer opam, 2.2.1, instead of 2.1.5 2024-10-15 15:44:31 -04:00			`"bf16d573137835ce9abbcf6b99cb94a1da69ab58804a4de7c90233f0b354d5e68e9c47ee16670ca9d59866d58c7db345d9723e6eb5fc3a1cb8dca371f0e90225" \|\| exit`
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building. 2017-01-28 08:44:21 -05:00
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`ENV OPAMROOT=/tmp`
			`ENV OPAMCONFIRMLEVEL=unsafe-yes`
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building. 2017-01-28 08:44:21 -05:00			`# Pin last known-good version for reproducible builds.`
Pin Docker base image to a specific hash Requested by Joanna Rutkowska. 2017-01-31 04:26:57 -05:00			`# Remove this line (and the base image pin above) if you want to test with the`
			`# latest versions.`
change snapshots for debian ones 2023-11-07 07:47:12 -05:00			`# taken from https://github.com/ocaml/opam-repository`
update opam repository commit to use solo5 0.9 and mirage 4.8.1 2024-10-15 15:48:14 -04:00			`RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#5d3f0d1d655199e596a1e785e69fae8fad78cad3`
use OCaml 4.14.2 -- the latest LTS release 2024-05-09 06:58:52 -04:00			`RUN opam switch create myswitch 4.14.2`
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker 2022-11-13 06:22:59 -05:00			`RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5`
			`RUN mkdir /tmp/orb-build`
			`ADD config.ml /tmp/orb-build/config.ml`
			`WORKDIR /tmp/orb-build`
pin to specific overlays hashes 2023-11-08 04:20:59 -05:00			`CMD opam exec -- sh -exc 'mirage configure -t xen --extra-repos=\`
update the compilation toolchain, including upgrade to mirage 4.5.0 2024-04-23 12:10:32 -04:00			`opam-overlays:https://github.com/dune-universe/opam-overlays.git#4e75ee36715b27550d5bdb87686bb4ae4c9e89c4,\`
			`mirage-overlays:https://github.com/dune-universe/mirage-opam-overlays.git#797cb363df3ff763c43c8fbec5cd44de2878757e \`
			`&& make depend && make tar'`