Skip to content

Commit f1d8b5c

Browse files
AlexeyKuznetsov-DDAlexeyKuznetsov-DD
committed
Testing arm64 docker images
1 parent 77b748c commit f1d8b5c

File tree

3 files changed

+322
-0
lines changed

3 files changed

+322
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,22 @@ on:
99
schedule:
1010
- cron: '0 0 * * 0'
1111
workflow_dispatch:
12+
inputs:
13+
run_amd64:
14+
description: "Run the standard amd64 image build"
15+
required: false
16+
default: false
17+
type: boolean
18+
run_arm64:
19+
description: "Run the experimental arm64 image build"
20+
required: false
21+
default: false
22+
type: boolean
1223

1324
jobs:
1425
build_push_check:
1526
name: Build docker image, publish it and run vuln scanner against it
27+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_amd64 == true }}
1628
permissions:
1729
contents: read # for actions/checkout to fetch code
1830
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
@@ -62,3 +74,58 @@ jobs:
6274
uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
6375
with:
6476
sarif_file: 'trivy-results.sarif'
77+
78+
build_push_check_arm64:
79+
name: Build arm64 docker image, publish it and run vuln scanner against it
80+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_arm64 == true }}
81+
permissions:
82+
contents: read
83+
security-events: write
84+
packages: write
85+
runs-on: ubuntu-latest
86+
environment:
87+
name: ci-build
88+
steps:
89+
- name: Checkout repository
90+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
91+
- name: Set up QEMU
92+
uses: docker/setup-qemu-action@e20b58169f0f89e8fb4a5c8a5ad9b65cb7e7b98a # 3.6.0
93+
with:
94+
platforms: arm64
95+
- name: Set up Docker Buildx
96+
id: buildx-arm64
97+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # 4.0.0
98+
- name: Login to ghcr.io
99+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # 4.0.0
100+
with:
101+
registry: ghcr.io
102+
username: ${{ github.actor }}
103+
password: ${{ secrets.GITHUB_TOKEN }}
104+
- name: Free Disk Space (Ubuntu)
105+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
106+
with:
107+
docker-images: false
108+
- name: Build arm64 image
109+
id: build-arm64
110+
run: bash ./build-arm64
111+
- name: Test arm64 image
112+
run: bash ./build-arm64 --test
113+
- name: Describe arm64 image
114+
run: bash ./build-arm64 --describe >> $GITHUB_STEP_SUMMARY
115+
- name: Push arm64 image
116+
run: bash ./build-arm64 --push
117+
- name: Run Trivy vulnerability scanner on arm64 image
118+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
119+
with:
120+
image-ref: '${{ steps.build-arm64.outputs.LATEST_IMAGE_TAG }}'
121+
format: 'sarif'
122+
output: 'trivy-results-arm64.sarif'
123+
severity: 'CRITICAL,HIGH'
124+
limit-severities-for-sarif: true
125+
env:
126+
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
127+
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
128+
- name: Upload Trivy arm64 scan results to GitHub Security tab
129+
uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
130+
with:
131+
sarif_file: 'trivy-results-arm64.sarif'

‎Dockerfile.arm64‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# syntax=docker/dockerfile:1.6
2+
3+
ARG LATEST_VERSION
4+
FROM eclipse-temurin:${LATEST_VERSION}-jdk-noble AS temurin-latest
5+
6+
FROM ubuntu:24.04 AS default-jdk
7+
ARG LATEST_VERSION
8+
9+
COPY --from=eclipse-temurin:8-jdk-noble /opt/java/openjdk /usr/lib/jvm/8
10+
COPY --from=eclipse-temurin:11-jdk-noble /opt/java/openjdk /usr/lib/jvm/11
11+
COPY --from=eclipse-temurin:17-jdk-noble /opt/java/openjdk /usr/lib/jvm/17
12+
COPY --from=eclipse-temurin:21-jdk-noble /opt/java/openjdk /usr/lib/jvm/21
13+
COPY --from=eclipse-temurin:25-jdk-noble /opt/java/openjdk /usr/lib/jvm/25
14+
COPY --from=temurin-latest /opt/java/openjdk /usr/lib/jvm/${LATEST_VERSION}
15+
16+
RUN <<-EOT
17+
set -eux
18+
rm -rf \
19+
/usr/lib/jvm/*/lib/src.zip \
20+
/usr/lib/jvm/*/demo \
21+
/usr/lib/jvm/*/sample
22+
EOT
23+
24+
FROM ubuntu:24.04 AS base
25+
ARG LATEST_VERSION
26+
ENV LATEST_VERSION=${LATEST_VERSION}
27+
28+
LABEL org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build
29+
30+
RUN <<-EOT
31+
set -eux
32+
apt-get update
33+
apt-get install -y sudo
34+
groupadd --gid 1001 non-root-group
35+
useradd --uid 1001 --gid non-root-group -m non-root-user
36+
echo "non-root-user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/non-root-user
37+
chmod 0440 /etc/sudoers.d/non-root-user
38+
mkdir -p /home/non-root-user/.config
39+
chown -R non-root-user:non-root-group /home/non-root-user/.config
40+
apt-get clean
41+
rm -rf /var/lib/apt/lists/*
42+
EOT
43+
44+
USER non-root-user
45+
WORKDIR /home/non-root-user
46+
47+
RUN <<-EOT
48+
set -eux
49+
sudo apt-get update
50+
sudo apt-get install -y curl tar apt-transport-https ca-certificates gnupg socat less debian-goodies autossh ca-certificates-java python3-pip locales jq git gh yq lsb-release lsof unzip parallel xsltproc
51+
sudo locale-gen en_US.UTF-8
52+
sudo git config --system --add safe.directory "*"
53+
54+
sudo mkdir -p /tmp/docker-install
55+
DOCKER_LATEST_VERSION=$(curl -s https://download.docker.com/linux/static/stable/$(uname -m)/ | grep -oP 'docker-\K([0-9]+\.[0-9]+\.[0-9]+)(?=\.tgz)' | sort -V | tail -n 1)
56+
sudo curl -fsSL "https://download.docker.com/linux/static/stable/$(uname -m)/docker-${DOCKER_LATEST_VERSION}.tgz" | sudo tar -xz -C /tmp/docker-install
57+
sudo mv /tmp/docker-install/docker/docker /usr/local/bin/
58+
sudo rm -rf /tmp/docker-install
59+
sudo mkdir -p /usr/local/lib/docker/cli-plugins
60+
sudo curl -fsSL "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$(uname -m)" -o /usr/local/lib/docker/cli-plugins/docker-compose
61+
sudo chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
62+
63+
sudo apt-get clean
64+
sudo rm -rf /var/lib/apt/lists/*
65+
EOT
66+
67+
ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
68+
69+
COPY --from=default-jdk /usr/lib/jvm /usr/lib/jvm
70+
71+
RUN <<-EOT
72+
set -eux
73+
sudo apt-get update
74+
sudo pip3 install --break-system-packages awscli
75+
sudo pip3 cache purge
76+
77+
ARCH=$(dpkg --print-architecture)
78+
case "$ARCH" in
79+
arm64) DD_CI_ARCH="arm64"; VAULT_ARCH="arm64" ;;
80+
amd64) DD_CI_ARCH="x64"; VAULT_ARCH="amd64" ;;
81+
*) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
82+
esac
83+
84+
sudo curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-${DD_CI_ARCH}" --output "/usr/local/bin/datadog-ci"
85+
sudo chmod +x /usr/local/bin/datadog-ci
86+
87+
VAULT_VERSION=1.20.4
88+
curl -fsSL "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_${VAULT_ARCH}.zip" -o vault.zip
89+
unzip vault.zip
90+
sudo mv vault /usr/local/bin/vault
91+
chmod +x /usr/local/bin/vault
92+
rm vault.zip
93+
94+
sudo apt-get clean
95+
sudo rm -rf /var/lib/apt/lists/*
96+
EOT
97+
98+
ENV JAVA_DEBIAN_VERSION=unused
99+
ENV JAVA_VERSION=unused
100+
101+
ENV JAVA_8_HOME=/usr/lib/jvm/8
102+
ENV JAVA_11_HOME=/usr/lib/jvm/11
103+
ENV JAVA_17_HOME=/usr/lib/jvm/17
104+
ENV JAVA_21_HOME=/usr/lib/jvm/21
105+
ENV JAVA_25_HOME=/usr/lib/jvm/25
106+
ENV JAVA_${LATEST_VERSION}_HOME=/usr/lib/jvm/${LATEST_VERSION}
107+
108+
ENV JAVA_HOME=${JAVA_8_HOME}
109+
ENV PATH=${JAVA_HOME}/bin:${PATH}
110+

‎build-arm64‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
#!/usr/bin/env bash
2+
set -eu
3+
4+
readonly IMAGE_NAME="ghcr.io/datadog/dd-trace-java-docker-build"
5+
readonly BASE_VARIANTS=(8 11 17 21 25 tip)
6+
7+
function compute_metadata() {
8+
GIT_BRANCH="${GITHUB_REF_NAME:-$(git branch --show-current)}"
9+
readonly GIT_BRANCH="${GIT_BRANCH:-local}"
10+
if [[ ${GIT_BRANCH} = master ]]; then
11+
TAG_PREFIX=""
12+
else
13+
TAG_PREFIX="${GIT_BRANCH}-"
14+
TAG_PREFIX="${TAG_PREFIX,,}"
15+
TAG_PREFIX="${TAG_PREFIX//\//_}"
16+
fi
17+
18+
BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
19+
GIT_HEAD_REF="$(git show-ref --head --hash ^HEAD)"
20+
}
21+
22+
function compute_latest_version() {
23+
local base_year=2025
24+
local base_version=23
25+
26+
version="$((base_version + ($(date +%Y) - base_year) * 2))"
27+
if [ "$(date +%m)" -ge 4 ]; then
28+
version="$((version + 1))"
29+
fi
30+
if [ "$(date +%m)" -ge 10 ]; then
31+
version="$((version + 1))"
32+
fi
33+
34+
export LATEST_VERSION="$version"
35+
}
36+
37+
function docker_build() {
38+
local tag="$1"
39+
docker buildx build \
40+
--build-arg LATEST_VERSION=$LATEST_VERSION \
41+
--platform linux/arm64 \
42+
--label org.opencontainers.image.created="$BUILD_DATE" \
43+
--label org.opencontainers.image.source=https://github.com/DataDog/dd-trace-java-docker-build \
44+
--label org.opencontainers.image.revision="$GIT_HEAD_REF" \
45+
--file Dockerfile.arm64 \
46+
--target base \
47+
--tag "$tag" \
48+
--load \
49+
.
50+
}
51+
52+
function image_name() {
53+
local variant="${1}"
54+
echo -n "${IMAGE_NAME}:${TAG_PREFIX}arm64-${variant}"
55+
}
56+
57+
function do_build() {
58+
compute_metadata
59+
compute_latest_version
60+
docker_build "$(image_name base)"
61+
if [ -n "${GITHUB_OUTPUT+unset}" ]; then
62+
echo "LATEST_IMAGE_TAG=$(image_name base)" >>"$GITHUB_OUTPUT"
63+
fi
64+
for variant in "${BASE_VARIANTS[@]}"; do
65+
variant="${variant,,}"
66+
docker tag "$(image_name base)" "$(image_name "${variant}")"
67+
done
68+
}
69+
70+
function do_test() {
71+
local image
72+
compute_metadata
73+
image="$(image_name base)"
74+
docker run \
75+
--platform linux/arm64 \
76+
--rm \
77+
"$image" \
78+
bash -lc '
79+
set -eux
80+
"$JAVA_HOME/bin/java" -version
81+
"$JAVA_8_HOME/bin/java" -version
82+
"$JAVA_11_HOME/bin/java" -version
83+
"$JAVA_17_HOME/bin/java" -version
84+
"$JAVA_21_HOME/bin/java" -version
85+
"$JAVA_25_HOME/bin/java" -version
86+
'
87+
}
88+
89+
function do_describe() {
90+
local image
91+
compute_metadata
92+
compute_latest_version
93+
image="$(image_name base)"
94+
docker run \
95+
--platform linux/arm64 \
96+
--rm \
97+
"$image" \
98+
bash -lc '
99+
echo "# arm64 image"
100+
echo
101+
echo "## Operating System"
102+
echo
103+
echo "* $(lsb_release --description --short)"
104+
echo
105+
echo "## Tools"
106+
echo
107+
echo "* $(git --version)"
108+
echo "* $(docker --version)"
109+
echo "* $(docker compose version)"
110+
echo "* datadog-ci $(datadog-ci version)"
111+
echo "* vault $(vault --version)"
112+
echo
113+
echo "## JDKs"
114+
echo
115+
for env_name in JAVA_8_HOME JAVA_11_HOME JAVA_17_HOME JAVA_21_HOME JAVA_25_HOME; do
116+
echo "* ${env_name}"
117+
echo "```"
118+
"${!env_name}/bin/java" -version 2>&1
119+
echo "```"
120+
echo
121+
done
122+
'
123+
}
124+
125+
function do_push() {
126+
local tag
127+
compute_metadata
128+
for tag in base "${BASE_VARIANTS[@]}"; do
129+
tag="${tag,,}"
130+
docker push "$(image_name "${tag}")"
131+
done
132+
}
133+
134+
if [[ -z ${1:-} ]]; then
135+
do_build
136+
elif [[ ${1} = "--test" ]]; then
137+
do_test
138+
elif [[ ${1} = "--describe" ]]; then
139+
do_describe
140+
elif [[ ${1} = "--push" ]]; then
141+
do_push
142+
else
143+
echo "Unknown argument: ${1}" >&2
144+
exit 1
145+
fi

0 commit comments

Comments
 (0)