Update kopia dockerfile for goboring (#1673)

* update kopia dockerfile for goboring

* keep symbols

* option to build boring

* Use TAG

* use 1.19-buster and update kanistertools

.github/workflows/main.yaml

@@ -87,6 +87,6 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
     - run: tar -xvf ./src.tar.gz
-    - run: make update-kopia-image
+    - run: make update-kopia-image GOBORING=true
     - run: make release-snapshot
     - run: ./build/push_images.sh

Makefile

@@ -266,7 +266,7 @@ release-snapshot:
 	@$(MAKE) run CMD='-c "GORELEASER_CURRENT_TAG=v9.99.9-dev goreleaser --debug release --rm-dist --snapshot"'
 
 update-kopia-image:
-	@/bin/bash ./build/update_kopia_image.sh $(KOPIA_COMMIT_ID) $(KOPIA_REPO)
+	@/bin/bash ./build/update_kopia_image.sh -c $(KOPIA_COMMIT_ID) -r $(KOPIA_REPO) -b $(GOBORING)
 
 go-mod-download:
 	@$(MAKE) run CMD='-c "go mod download"'

build/update_kopia_image.sh

@@ -19,18 +19,39 @@ set -o nounset
 
 IMAGE_REGISTRY="ghcr.io/kanisterio"
 
-readonly COMMIT_ID=${1:?"Commit id to build kopia image not specified"}
-readonly KOPIA_REPO_ORG=${2-:"kopia"}
-readonly IMAGE_TYPE=alpine
+while getopts c:r:b: flag
+do
+    case "${flag}" in
+        c) commitID=${OPTARG};;
+        r) repo=${OPTARG};;
+        b) boring=${OPTARG};;
+    esac
+done
+
+readonly COMMIT_ID=${commitID:?"Commit id to build kopia image not specified"}
+readonly KOPIA_REPO_ORG=${repo:-"kopia"}
+readonly IMAGE_TYPE=debian
 readonly IMAGE_BUILD_VERSION="${COMMIT_ID}"
 readonly GH_PACKAGE_TARGET="${IMAGE_REGISTRY}/kopia"
-readonly TAG="${IMAGE_TYPE}-${IMAGE_BUILD_VERSION}"
+TAG="${IMAGE_TYPE}-${IMAGE_BUILD_VERSION}"
+CGO_ENABLED=""
+GOEXPERIMENT=""
+GO_EXTLINK_ENABLED=""
 
+if [ -n "${boring}" ]; then
+    CGO_ENABLED=1
+    GOEXPERIMENT=boringcrypto
+    GO_EXTLINK_ENABLED=0
+    TAG="${TAG}-boring"
+fi
 
 docker build \
     --tag "${GH_PACKAGE_TARGET}:${TAG}" \
     --build-arg "kopiaBuildCommit=${COMMIT_ID}" \
     --build-arg "kopiaRepoOrg=${KOPIA_REPO_ORG}" \
+    --build-arg "cgoFlag=${CGO_ENABLED}" \
+    --build-arg "goExpFlag=${GOEXPERIMENT}" \
+    --build-arg "goExtFlag=${GO_EXTLINK_ENABLED}" \
     --file ./docker/kopia-build/Dockerfile .
 
 docker push ${GH_PACKAGE_TARGET}:$TAG

docker/kopia-build/Dockerfile

@@ -1,9 +1,10 @@
-FROM golang:1.19.1-alpine3.16 AS builder
+FROM golang:1.19-buster AS builder
 
 ARG kopiaBuildCommit
 ARG kopiaRepoOrg
-
-RUN apk add git
+ARG cgoFlag goExpFlag goExtFlag
+ENV CGO_ENABLED=$cgoFlag GOEXPERIMENT=$goExpFlag GO_EXTLINK_ENABLED=$goExtFlag
+RUN apt-get install git
 
 WORKDIR /
 
@@ -15,24 +16,24 @@ WORKDIR /kopia
 
 # Build kopia binary from specific commit
 RUN git checkout ${kopiaBuildCommit}
-# Refers to goreleaser/goreleaser:v1.11.2
-COPY --from=docker.io/goreleaser/goreleaser@sha256:b13418f20019fffb29797aff3d03f5e9ca84cea93634f4169a7ed603a95ab198 \
-  /usr/bin/goreleaser /usr/bin/goreleaser
-RUN goreleaser build --output=. --rm-dist --single-target
+RUN GO111MODULE=on GOOS=linux GOARCH=amd64 go build -o kopia \
+  -ldflags="-X github.com/kopia/kopia/repo.BuildVersion=$(git show --no-patch --format='%cs-%h') \
+            -X github.com/kopia/kopia/repo.BuildInfo=$(git show --no-patch --format='%cI-%H')-${kopiaBuildCommit} \
+            -X github.com/kopia/kopia/repo.BuildGitHubRepo=${kopiaRepoOrg}" .
 
-RUN adduser -D kopia && addgroup kopia kopia
+RUN adduser kopia && addgroup kopia kopia
 USER kopia:kopia
 
 COPY --chown=kopia . /kopia
 
-FROM alpine:3.16
+FROM debian:buster
 
 WORKDIR /kopia
 
 # Add CA certs
-RUN apk add --no-cache --verbose ca-certificates && \
+RUN apt-get update && apt-get -y install ca-certificates && \
   rm -rf /var/cache/apk/* && \
-  adduser -D kopia && addgroup kopia kopia && \
+  adduser kopia && addgroup kopia kopia && \
   chown kopia /kopia
 
 USER kopia:kopia

docker/tools/Dockerfile

@@ -9,8 +9,8 @@ LABEL name="kanister-tools" \
     description="Kanister tools for application-specific data management"
 
 COPY --from=restic/restic:0.11.0 /usr/bin/restic /usr/local/bin/restic
-# ghcr.io/kanisterio/kopia:alpine-317cc36
-COPY --from=ghcr.io/kanisterio/kopia@sha256:87648ef24ce47f1d74ef5fa70bff96080f686b849dd0d787e1699d4c05807c4b \
+# ghcr.io/kanisterio/kopia:debian-317cc36-boring
+COPY --from=ghcr.io/kanisterio/kopia@sha256:85eea9020ec81bc9cb56e46533e5195074680ebc4c91eefaec3cc97a9ffd5482 \
   /kopia/kopia /usr/local/bin/kopia
 COPY LICENSE /licenses/LICENSE