-
Notifications
You must be signed in to change notification settings - Fork 104
/
Dockerfile.build-image
55 lines (47 loc) · 2.09 KB
/
Dockerfile.build-image
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# Copyright 2021 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# hash below relates to tag: bookworm-v1.0.3
FROM registry.k8s.io/build-image/debian-base@sha256:b30608f5a81f8ba99b287322d0bfb77ec506adcce396147aa4a59699d69be3e0
WORKDIR /work
RUN apt-get update && \
apt-get install -y wget xz-utils libapparmor-dev && \
apt-get autoremove -y && \
apt-get purge -y --auto-remove && \
rm -rf /var/lib/apt/lists/*
ENV USER=root
ARG NIX_VERSION=2.18.1
RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
tar xf nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
groupadd -r -g 30000 nixbld && \
for i in $(seq 1 30); do useradd -rM -u $((30000 + i)) -G nixbld nixbld$i ; done && \
mkdir -m 0755 /etc/nix /nix && \
printf "sandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
nix-${NIX_VERSION}-x86_64-linux/install && \
ln -s /nix/var/nix/profiles/default/etc/profile.d/nix.sh /etc/profile.d && \
rm -rf nix-*
ENV ENV=/etc/profile \
PATH=/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin \
GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt \
NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
NIX_PATH=/nix/var/nix/profiles/per-user/root/channels
RUN nix-env -iA cachix -f https://cachix.org/api/v1/install && \
cachix use security-profiles-operator && \
nix-collect-garbage --delete-old -d && \
nix-store --optimise && \
nix-store --verify --check-contents
# Cache build dependencies
COPY . /build
RUN nix-build /build/nix
RUN rm -rf /build
# vim: ft=dockerfile