Implement Docker best practices

integrations/docker/images/chip-build-android/Dockerfile

@@ -6,10 +6,10 @@ FROM connectedhomeip/chip-build:${VERSION}
 # doesn't work with JDK 11.
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-    openjdk-8-jdk \
-    rsync \
-    swig \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+    openjdk-8-jdk=8u292-b10-0ubuntu1~20.04 \
+    rsync=3.1.3-8 \
+    swig=4.0.1-5build1 \
     && rm -rf /var/lib/apt/lists/ \
     && : # last line
 

integrations/docker/images/chip-build-cirque/Dockerfile

@@ -1,44 +1,47 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # Bazel
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-       curl gnupg \
-    && curl -fsSL https://bazel.build/bazel-release.pub.gpg | gpg --dearmor > bazel.gpg \
-    && mv bazel.gpg /etc/apt/trusted.gpg.d/ \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+       curl=7.68.0-1ubuntu2.5 gnupg=2.2.19-3ubuntu2.1 \
+    && curl -fsSL https://bazel.build/bazel-release.pub.gpg | gpg --dearmor > /etc/apt/trusted.gpg.d/bazel.gpg \
     && echo "deb [arch=amd64] https://storage.googleapis.com/bazel-apt stable jdk1.8" | tee /etc/apt/sources.list.d/bazel.list \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-       bazel \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+       bazel=4.0.0 \
+    && rm -rf /var/lib/apt/lists/ \
     && : # aids diffs
 
 # Docker
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-       curl gnupg-agent apt-transport-https ca-certificates \
-       software-properties-common \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+       curl=7.68.0-1ubuntu2.5 gnupg-agent=2.2.19-3ubuntu2.1 apt-transport-https=2.0.5 ca-certificates=20210119~20.04.1 \
+       software-properties-common=0.98.9.4 \
     && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
     && add-apt-repository \
        "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-       docker-ce docker-ce-cli containerd.io \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+       docker-ce=5:20.10.6~3-0~ubuntu-focal docker-ce-cli=5:20.10.6~3-0~ubuntu-focal containerd.io=1.4.4-1 \
+    && rm -rf /var/lib/apt/lists/ \
     && : # aids diffs
 
 # Other Cirque prereqs
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-       sudo socat psmisc tigervnc-standalone-server tigervnc-viewer \
-       python3-pip python3-venv python3-setuptools libdbus-glib-1-dev \
-       uuid-runtime libgirepository1.0-dev \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+       sudo=1.8.31-1ubuntu1.2 socat=1.7.3.3-2 psmisc=23.3-1 tigervnc-standalone-server=1.10.1+dfsg-3 tigervnc-viewer=1.10.1+dfsg-3 \
+       python3-pip=20.0.2-5ubuntu1.3 python3-venv=3.8.2-0ubuntu2 python3-setuptools=45.2.0-1 libdbus-glib-1-dev=0.110-5fakssync1 \
+       uuid-runtime=2.34-0.1ubuntu9.1 libgirepository1.0-dev=1.64.1-1~ubuntu20.04.1 \
+    && rm -rf /var/lib/apt/lists/ \
     && : # aids diffs
 
 COPY requirements_nogrpc.txt /requirements.txt
 
 RUN set -x \
-    && pip3 install -r requirements.txt \
+    && pip3 install --no-cache-dir -r requirements.txt \
     && : # aids diffs

integrations/docker/images/chip-build-efr32/Dockerfile

@@ -1,13 +1,12 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
-
-
-
 # GNU ARM Embedded toolchain, cross compiler for various platform builds
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -fy \
-    gcc-arm-none-eabi \
-    binutils-arm-none-eabi \
-    ccache
+    && DEBIAN_FRONTEND=noninteractive apt-get install -fy --no-install-recommends \
+    gcc-arm-none-eabi=15:9-2019-q4-0ubuntu1 \
+    binutils-arm-none-eabi=2.34-4ubuntu1+13ubuntu1 \
+    ccache=3.7.7-1 \
+    && rm -rf /var/lib/apt/lists/ \
+    && : # last line

integrations/docker/images/chip-build-esp32-qemu/Dockerfile

@@ -1,14 +1,13 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build-esp32:${VERSION}
 
+WORKDIR /opt/espressif/qemu
+
 # Setup QEMU emulator for ESP32 platform
 RUN set -x \
-    && mkdir -p /opt/espressif \
-    && git clone --progress --depth 1 --branch esp-develop-20210220 https://github.com/espressif/qemu.git /opt/espressif/qemu-src \
-    && mkdir -p /opt/espressif/qemu \
-    && (cd /opt/espressif/qemu \
+    && git clone --depth 1 --branch esp-develop-20210220 https://github.com/espressif/qemu.git /opt/espressif/qemu-src \
     && ../qemu-src/configure --target-list=xtensa-softmmu --enable-debug --enable-sanitizers --disable-strip --disable-user --disable-capstone --disable-vnc --disable-sdl --disable-gtk \
-    && make -j8) \
+    && make -j8 \
     && : # last line
 
 ENV QEMU_ESP32_DIR=/opt/espressif/qemu

integrations/docker/images/chip-build-esp32/Dockerfile

@@ -1,16 +1,17 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
+WORKDIR /opt/espressif/esp-idf
+
 # Setup the ESP-IDF
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y python libgcrypt20-dev \
-    && mkdir -p /opt/espressif \
-    && cd /opt/espressif \
-    && git clone --progress -b release/v4.2 https://github.com/espressif/esp-idf.git \
-    && cd esp-idf \
-    && git submodule update --init --progress \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    python-is-python2=2.7.17-4 libgcrypt20-dev=1.8.5-5ubuntu1 \
+    && git clone --depth=1 -b release/v4.2 https://github.com/espressif/esp-idf.git /opt/espressif/esp-idf \
+    && git submodule update --init \
     && IDF_TOOLS_PATH=/opt/espressif/tools ./install.sh \
+    && rm -rf /var/lib/apt/lists/ \
     && : # last line
 
 ENV IDF_PATH=/opt/espressif/esp-idf/

integrations/docker/images/chip-build-k32w/Dockerfile

@@ -1,19 +1,19 @@
 ARG VERSION=latest
 FROM connectedhomeip/chip-build:${VERSION}
 
+WORKDIR /opt/sdk
+
 # Setup the K32W SDK
 RUN set -x \
     && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y wget unzip \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    wget=1.20.3-1ubuntu1 unzip=6.0-25ubuntu1 \
     && rm -rf /var/lib/apt/lists/ \
-    && mkdir -p /opt/sdk \
-    && cd /opt/sdk \
     && wget https://mcuxpresso.nxp.com/eclipse/sdk/2.6.3/plugins/com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
     && unzip com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
-    && rm -rf com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
-    && cd sdks \
-    && unzip 5faab205f2663647c5c7ce05c382d2a8.zip \
-    && rm -rf 5faab205f2663647c5c7ce05c382d2a8.zip \
+    && unzip sdks/5faab205f2663647c5c7ce05c382d2a8.zip -d sdks/ \
+    && rm -f com.nxp.mcuxpresso.sdk.sdk_2.x_k32w061dk6_2.6.3.201911251446.jar \
+    && rm -f sdk/5faab205f2663647c5c7ce05c382d2a8.zip \
     && : # last line
 
 ENV K32W061_SDK_ROOT=/opt/sdk/sdks

integrations/docker/images/chip-build-nrf-platform/Dockerfile

@@ -8,44 +8,48 @@ ARG NCS_REVISION=v1.5.0
 # nRF Connect SDK dependencies
 # ==================================================
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+WORKDIR /opt/NordicSemiconductor/nRF5_tools/install
+
 # Tools for building, flashing and accessing device logs
 RUN set -x \
     && apt-get update \
-    && apt-get install --no-install-recommends -fy device-tree-compiler \
-    && (mkdir -p /opt/NordicSemiconductor/nRF5_tools/install && cd /opt/NordicSemiconductor/nRF5_tools/install \
+    && apt-get install --no-install-recommends -fy device-tree-compiler=1.5.1-1 \
     && curl https://www.nordicsemi.com/-/media/Software-and-other-downloads/Desktop-software/nRF-command-line-tools/sw/Versions-10-x-x/10-12-1/nRFCommandLineTools10121Linuxamd64.tar.gz \
     | tar zxvf - \
-    && cd .. \
-    && tar xvf install/JLink_Linux_V688a_x86_64.tgz \
-    && tar xvf install/nRF-Command-Line-Tools_10_12_1.tar \
-    && rm -rf ./install /var/lib/apt/lists/) \
+    && tar xvf JLink_Linux_V688a_x86_64.tgz -C /opt/NordicSemiconductor/nRF5_tools/ \
+    && tar xvf nRF-Command-Line-Tools_10_12_1.tar -C /opt/NordicSemiconductor/nRF5_tools/ \
+    && rm -rf ./install /var/lib/apt/lists/ \
     && : # last line
 
 ENV NRF5_TOOLS_ROOT=/opt/NordicSemiconductor/nRF5_tools
 ENV PATH=${NRF5_TOOLS_ROOT}/JLink_Linux_V688a_x86_64:${PATH}
 ENV PATH=${NRF5_TOOLS_ROOT}/mergehex:${NRF5_TOOLS_ROOT}/nrfjprog:${PATH}
 ENV LD_LIBRARY_PATH=${NRF5_TOOLS_ROOT}/JLink_Linux_V688a_x86_64:${LD_LIBRARY_PATH}
 
+WORKDIR /opt/ARM-software
+
 # GNU ARM Embedded toolchain, cross compiler for various platform builds
 RUN set -x \
-    && (mkdir -p /opt/ARM-software && cd /opt/ARM-software \
     && curl https://armkeil.blob.core.windows.net/developer/Files/downloads/gnu-rm/9-2019q4/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2 \
-    | tar jxvf -) \
+    | tar jxvf - \
     && : # last line
 
 ENV ARM_GCC_INSTALL_ROOT=/opt/ARM-software/gcc-arm-none-eabi-9-2019-q4-major/bin/
 
+WORKDIR /opt/NordicSemiconductor/nrfconnect
+
 # ==================================================
 # nRF Connect SDK
 # ==================================================
 RUN set -x \
-    && (mkdir -p /opt/NordicSemiconductor/nrfconnect && cd /opt/NordicSemiconductor/nrfconnect \
-    && python3 -m pip install -U --no-cache-dir pip setuptools wheel cmake west \
+    && python3 -m pip install -U --no-cache-dir pip==21.1 setuptools==56.0.0 wheel==0.36.2 cmake==3.18.4.post1 west==0.10.1 \
     && west init -m https://github.com/nrfconnect/sdk-nrf --mr $NCS_REVISION \
     && west update \
     && python3 -m pip install --no-cache-dir -r zephyr/scripts/requirements.txt \
     && python3 -m pip install --no-cache-dir -r nrf/scripts/requirements.txt \
-    && python3 -m pip install --no-cache-dir -r bootloader/mcuboot/scripts/requirements.txt) \
+    && python3 -m pip install --no-cache-dir -r bootloader/mcuboot/scripts/requirements.txt \
     && echo "source /opt/NordicSemiconductor/nrfconnect/zephyr/zephyr-env.sh" >> ~/.bashrc \
     && : # last line