Merge branch 'upstream-cross-build' into 'master'

Update build system to match libnvidia-container

See merge request nvidia/container-toolkit/container-toolkit!6

.gitlab-ci.yml

@@ -1,45 +1,104 @@
-image: docker:latest
+# Build packages for all supported OS / ARCH combinations
-
-services:
-  - docker:dind
 
 stages:
-  - build
+  - build-one
+  - build-all
 
-.build_template: &build_definition
+.build-setup: &build-setup
-  stage: build
+  image: docker:19.03.8
-  script:
+
-    - OS="${CI_JOB_NAME#*:}"
+  services:
-    - apk add make
+    - name: docker:19.03.8-dind
+      command: ["--experimental"]
+
+  before_script:
+  - apk update
+  - apk upgrade
+  - apk add coreutils build-base sed git bash make
+  - docker run --rm --privileged multiarch/qemu-user-static --reset -p yes -c yes
+
+# build-one jobs build packages for a single OS / ARCH combination.
+#
+# They are run during the first stage of the pipeline as a smoke test to ensure
+# that we can successfully build packages on all of our architectures for a
+# single OS. They are triggered on any change to an MR. No artifacts are
+# produced as part of build-one jobs.
+.build-one-setup: &build-one-setup
+  <<: *build-setup
+  stage: build-one
+  only:
+    - merge_requests
+
+# build-all jobs build packages for every OS / ARCH combination we support.
+#
+# They are run under two conditions:
+# 1) Automatically whenever a new tag is pushed to the repo (e.g. v1.1.0)
+# 2) Manually by a reviewer just before merging a MR.
+#
+# Unlike build-one jobs, it takes a long time to build the full suite
+# OS / ARCH combinations, so this is optimized to only run once per MR
+# (assuming it all passes). A full set of artifacts including the packages
+# built for each OS / ARCH are produced as a result of these jobs.
+.build-all-setup: &build-all-setup
+  <<: *build-setup
+  stage: build-all
+  timeout: 2h 30m
+  rules:
+    - if: $CI_COMMIT_TAG
+      when: always
+    - if: $CI_MERGE_REQUEST_ID
+      when: manual
+
+  variables:
+    ARTIFACTS_NAME: "${CI_PROJECT_NAME}-${CI_COMMIT_REF_SLUG}-${CI_JOB_NAME}-artifacts-${CI_PIPELINE_ID}"
+    ARTIFACTS_DIR: "${CI_PROJECT_NAME}-${CI_COMMIT_REF_SLUG}-artifacts-${CI_PIPELINE_ID}"
+    DIST_DIR: "${CI_PROJECT_DIR}/${ARTIFACTS_DIR}"
 
-    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
-    - make REGISTRY=${CI_REGISTRY_IMAGE} ${OS} 
-    - make REGISTRY=${CI_REGISTRY_IMAGE} push${OS}
   artifacts:
-    expire_in: 1 week
+    name: ${ARTIFACTS_NAME}
     paths:
-      - dist/
+      - ${ARTIFACTS_DIR}
 
-amd64:amzn1:
+# The full set of build-one jobs organizes to build
-  <<: *build_definition
+# ubuntu18.04 in parallel on each of our supported ARCHs.
+build-one-amd64:
+  <<: *build-one-setup
+  script:
+    - make ubuntu18.04-amd64
 
-amd64:amzn2:
+build-one-ppc64le:
-  <<: *build_definition
+  <<: *build-one-setup
+  script:
+    - make ubuntu18.04-ppc64le
 
-amd64:centos7:
+build-one-arm64:
-  <<: *build_definition
+  <<: *build-one-setup
+  script:
+    - make ubuntu18.04-arm64
 
-amd64:opensuse-leap15.1:
+# The full set of build-all jobs organized to
-  <<: *build_definition
+# have builds for each ARCH run in parallel.
+build-all-amd64:
+  <<: *build-all-setup
+  script:
+    - make docker-amd64
 
-amd64:debian9:
+build-all-x86_64:
-  <<: *build_definition
+  <<: *build-all-setup
+  script:
+    - make docker-x86_64
 
-amd64:debian10:
+build-all-ppc64le:
-  <<: *build_definition
+  <<: *build-all-setup
+  script:
+    - make docker-ppc64le
 
-amd64:ubuntu16.04:
+build-all-arm64:
-  <<: *build_definition
+  <<: *build-all-setup
+  script:
+    - make docker-arm64
 
-amd64:ubuntu18.04:
+build-all-aarch64:
-  <<: *build_definition
+  <<: *build-all-setup
+  script:
+    - make docker-aarch64

Makefile

@@ -2,20 +2,17 @@
 
 DOCKER   ?= docker
 MKDIR    ?= mkdir
-REGISTRY ?= nvidia/container-toolkit
+DIST_DIR ?= $(CURDIR)/dist
+
+LIB_NAME := nvidia-container-toolkit
+LIB_VERSION := 1.0.5
 
 GOLANG_VERSION := 1.14.2
-VERSION        := 1.0.5
+GOLANG_PKG_PATH := github.com/NVIDIA/container-toolkit/pkg
-DIST_DIR       := $(CURDIR)/dist
-
-TOOLKIT=nvidia-container-toolkit
 
+# By default run all native docker-based targets
+docker-native:
 include $(CURDIR)/docker.mk
 
-.PHONY: all
-
-all: ubuntu18.04 ubuntu16.04 debian10 debian9 centos7 amzn2 amzn1 opensuse-leap15.1
-
 binary:
-	go build -ldflags "-s -w" -o "$(TOOLKIT)" github.com/NVIDIA/container-toolkit/pkg
+	go build -ldflags "-s -w" -o "$(LIB_NAME)" $(GOLANG_PKG_PATH)
-

docker.mk

@@ -1,74 +1,128 @@
 # Copyright (c) 2017-2020, NVIDIA CORPORATION. All rights reserved.
 
-push%:
+# Supported OSs by architecture
-	docker push "$(REGISTRY)/$*"
+AMD64_TARGETS := ubuntu20.04 ubuntu18.04 ubuntu16.04 debian10 debian9
+X86_64_TARGETS := centos7 centos8 rhel7 rhel8 amazonlinux1 amazonlinux2 opensuse-leap15.1
+PPC64LE_TARGETS := ubuntu18.04 ubuntu16.04 centos7 centos8 rhel7 rhel8
+ARM64_TARGETS := ubuntu20.04 ubuntu18.04
+AARCH64_TARGETS := centos8 rhel8
 
-ubuntu%: ARCH := amd64
+# Define top-level build targets
-ubuntu%:
+docker%: SHELL:=/bin/bash
-	$(DOCKER) build --pull \
-		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
-		--build-arg VERSION_ID="$*" \
-		--build-arg PKG_VERS="$(VERSION)" \
-		--build-arg PKG_REV="1" \
-		--tag "$(REGISTRY)/ubuntu$*" \
-		--file docker/Dockerfile.ubuntu .
-	$(MKDIR) -p $(DIST_DIR)/$@/$(ARCH)
-	$(DOCKER) run --cidfile $@.cid "$(REGISTRY)/ubuntu$*"
-	$(DOCKER) cp $$(cat $@.cid):/dist/. $(DIST_DIR)/$@/$(ARCH)/
-	$(DOCKER) rm $$(cat $@.cid) && rm $@.cid
 
-debian%: ARCH := amd64
+# Native targets
-debian%:
+PLATFORM ?= $(shell uname -m)
-	$(DOCKER) build --pull \
+ifeq ($(PLATFORM),x86_64)
-		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+NATIVE_TARGETS := $(AMD64_TARGETS) $(X86_64_TARGETS)
-		--build-arg VERSION_ID="$*" \
+$(AMD64_TARGETS): %: %-amd64
-		--build-arg PKG_VERS="$(VERSION)" \
+$(X86_64_TARGETS): %: %-x86_64
-		--build-arg PKG_REV="1" \
+else ifeq ($(PLATFORM),ppc64le)
-		--tag "$(REGISTRY)/debian$*" \
+NATIVE_TARGETS := $(PPC64LE_TARGETS)
-		--file docker/Dockerfile.debian .
+$(PPC64LE_TARGETS): %: %-ppc64le
-	$(MKDIR) -p $(DIST_DIR)/$@/$(ARCH)
+else ifeq ($(PLATFORM),aarch64)
-	$(DOCKER) run --cidfile $@.cid "$(REGISTRY)/debian$*"
+NATIVE_TARGETS := $(ARM64_TARGETS) $(AARCH64_TARGETS)
-	$(DOCKER) cp $$(cat $@.cid):/dist/. $(DIST_DIR)/$@/$(ARCH)/
+$(ARM64_TARGETS): %: %-arm64
-	$(DOCKER) rm $$(cat $@.cid) && rm $@.cid
+$(AARCH64_TARGETS): %: %-aarch64
+endif
+docker-native: $(NATIVE_TARGETS)
 
-centos%: ARCH := x86_64
+# amd64 targets
-centos%:
+AMD64_TARGETS := $(patsubst %, %-amd64, $(AMD64_TARGETS))
-	$(DOCKER) build --pull \
+$(AMD64_TARGETS): ARCH := amd64
-		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+$(AMD64_TARGETS): %: --%
-		--build-arg VERSION_ID="$*" \
+docker-amd64: $(AMD64_TARGETS)
-		--build-arg PKG_VERS="$(VERSION)" \
-		--build-arg PKG_REV="2" \
-		--tag "$(REGISTRY)/centos$*" \
-		--file docker/Dockerfile.centos .
-	$(MKDIR) -p $(DIST_DIR)/$@/$(ARCH)
-	$(DOCKER) run --cidfile $@.cid "$(REGISTRY)/centos$*"
-	$(DOCKER) cp $$(cat $@.cid):/dist/. $(DIST_DIR)/$@/$(ARCH)/
-	$(DOCKER) rm $$(cat $@.cid) && rm $@.cid
 
-amzn%: ARCH := x86_64
+# x86_64 targets
-amzn%:
+X86_64_TARGETS := $(patsubst %, %-x86_64, $(X86_64_TARGETS))
-	$(DOCKER) build --pull \
+$(X86_64_TARGETS): ARCH := x86_64
-		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+$(X86_64_TARGETS): %: --%
-		--build-arg VERSION_ID="$*" \
+docker-x86_64: $(X86_64_TARGETS)
-		--build-arg PKG_VERS="$(VERSION)" \
-		--build-arg PKG_REV="2.amzn$*" \
-		--tag "$(REGISTRY)/amzn$*" \
-		--file docker/Dockerfile.amzn .
-	$(MKDIR) -p $(DIST_DIR)/$@/$(ARCH)
-	$(DOCKER) run --cidfile $@.cid "$(REGISTRY)/amzn$*"
-	$(DOCKER) cp $$(cat $@.cid):/dist/. $(DIST_DIR)/$@/$(ARCH)/
-	$(DOCKER) rm $$(cat $@.cid) && rm $@.cid
 
-opensuse-leap%: ARCH := x86_64
+# arm64 targets
-opensuse-leap%:
+ARM64_TARGETS := $(patsubst %, %-arm64, $(ARM64_TARGETS))
-	$(DOCKER) build --pull \
+$(ARM64_TARGETS): ARCH := arm64
-		--build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+$(ARM64_TARGETS): %: --%
-		--build-arg VERSION_ID="$*" \
+docker-arm64: $(ARM64_TARGETS)
-		--build-arg PKG_VERS="$(VERSION)" \
+
-		--build-arg PKG_REV="1" \
+# aarch64 targets
-		--tag "$(REGISTRY)/opensuse-leap$*" \
+AARCH64_TARGETS := $(patsubst %, %-aarch64, $(AARCH64_TARGETS))
-		--file docker/Dockerfile.opensuse-leap .
+$(AARCH64_TARGETS): ARCH := aarch64
-	$(MKDIR) -p $(DIST_DIR)/$@/$(ARCH)
+$(AARCH64_TARGETS): %: --%
-	$(DOCKER) run --cidfile $@.cid "$(REGISTRY)/opensuse-leap$*"
+docker-aarch64: $(AARCH64_TARGETS)
-	$(DOCKER) cp $$(cat $@.cid):/dist/. $(DIST_DIR)/$@/$(ARCH)/
+
-	$(DOCKER) rm $$(cat $@.cid) && rm $@.cid
+# ppc64le targets
+PPC64LE_TARGETS := $(patsubst %, %-ppc64le, $(PPC64LE_TARGETS))
+$(PPC64LE_TARGETS): ARCH := ppc64le
+$(PPC64LE_TARGETS): WITH_LIBELF := yes
+$(PPC64LE_TARGETS): %: --%
+docker-ppc64le: $(PPC64LE_TARGETS)
+
+# docker target to build for all os/arch combinations
+docker-all: $(AMD64_TARGETS) $(X86_64_TARGETS) \
+            $(ARM64_TARGETS) $(AARCH64_TARGETS) \
+            $(PPC64LE_TARGETS)
+
+# Default variables for all private '--' targets below.
+# One private target is defined for each OS we support.
+--%: TARGET_PLATFORM = $(*)
+--%: VERSION = $(patsubst $(OS)%-$(ARCH),%,$(TARGET_PLATFORM))
+--%: BASEIMAGE = $(OS):$(VERSION)
+--%: BUILDIMAGE = nvidia/$(LIB_NAME)/$(OS)$(VERSION)-$(ARCH)
+--%: DOCKERFILE = $(CURDIR)/docker/Dockerfile.$(OS)
+--%: ARTIFACTS_DIR = $(DIST_DIR)/$(OS)$(VERSION)/$(ARCH)
+--%: docker-build-%
+	@
+
+# private ubuntu target
+--ubuntu%: OS := ubuntu
+--ubuntu%: PKG_REV := 1
+
+# private debian target
+--debian%: OS := debian
+--debian%: PKG_REV := 1
+
+# private centos target
+--centos%: OS := centos
+--centos%: PKG_REV := 2
+
+# private amazonlinux target
+--amazonlinux%: OS := amazonlinux
+--amazonlinux%: PKG_REV = 2.amzn$(VERSION)
+
+# private opensuse-leap target
+--opensuse-leap%: OS = opensuse-leap
+--opensuse-leap%: BASEIMAGE = opensuse/leap:$(VERSION)
+--opensuse-leap%: PKG_REV := 1
+
+# private rhel target (actually built on centos)
+--rhel%: OS := centos
+--rhel%: PKG_REV := 2
+--rhel%: VERSION = $(patsubst rhel%-$(ARCH),%,$(TARGET_PLATFORM))
+--rhel%: ARTIFACTS_DIR = $(DIST_DIR)/rhel$(VERSION)/$(ARCH)
+
+docker-build-%:
+	@echo "Building for $(TARGET_PLATFORM)"
+	docker pull --platform=linux/$(ARCH) $(BASEIMAGE)
+	DOCKER_BUILDKIT=1 \
+	$(DOCKER) build \
+	    --progress=plain \
+	    --build-arg BASEIMAGE=$(BASEIMAGE) \
+	    --build-arg GOLANG_VERSION="$(GOLANG_VERSION)" \
+	    --build-arg PKG_VERS="$(LIB_VERSION)" \
+	    --build-arg PKG_REV="$(PKG_REV)" \
+	    --tag $(BUILDIMAGE) \
+	    --file $(DOCKERFILE) .
+	$(DOCKER) run \
+	    -e DISTRIB \
+	    -e SECTION \
+	    -v $(ARTIFACTS_DIR):/dist \
+	    $(BUILDIMAGE)
+
+docker-clean:
+	IMAGES=$$(docker images "nvidia/$(LIB_NAME)/*" --format="{{.ID}}"); \
+	if [ "$${IMAGES}" != "" ]; then \
+	    docker rmi -f $${IMAGES}; \
+	fi
+
+distclean:
+	rm -rf $(DIST_DIR)

docker/Dockerfile.amazonlinux

@@ -1,5 +1,5 @@
-ARG VERSION_ID
+ARG BASEIMAGE
-FROM amazonlinux:${VERSION_ID}
+FROM ${BASEIMAGE}
 
 RUN yum install -y \
         ca-certificates \

docker/Dockerfile.centos

@@ -1,5 +1,5 @@
-ARG VERSION_ID
+ARG BASEIMAGE
-FROM centos:${VERSION_ID}
+FROM ${BASEIMAGE}
 
 RUN yum install -y \
         ca-certificates \

docker/Dockerfile.debian

@@ -1,6 +1,7 @@
-ARG VERSION_ID
+ARG BASEIMAGE
-FROM debian:${VERSION_ID}
+FROM ${BASEIMAGE}
 
+ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         wget \
         ca-certificates \

docker/Dockerfile.opensuse-leap

@@ -1,5 +1,5 @@
-ARG VERSION_ID
+ARG BASEIMAGE
-FROM opensuse/leap:${VERSION_ID}
+FROM ${BASEIMAGE}
 
 RUN zypper install -y \
     ca-certificates \

docker/Dockerfile.ubuntu

@@ -1,6 +1,7 @@
-ARG VERSION_ID
+ARG BASEIMAGE
-FROM ubuntu:${VERSION_ID}
+FROM ${BASEIMAGE}
 
+ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         wget \
         ca-certificates \