mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-19 23:31:47 -09:00
682dac6c38
The $HOME folder of the br-user inside the container is currently
read-write for the br-user. However, practically speaking, it is only
read-write when the UID of the user running the container from the
host machine is 1000, equal to the UID of the br-user inside the
container. For any other UID on the host machine, the $HOME folder is
in fact already read-only.
Because we do not expect Buildroot to write into $HOME, and in order
to have a consistent behavior regardless of the UID of the user on the
host machine, we change our Docker image to make the $HOME folder of
the br-user entirely non-writable.
Suggested-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fac6d92a27)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
106 lines
3.0 KiB
Docker
106 lines
3.0 KiB
Docker
# This Dockerfile generates the docker image that gets used by Gitlab CI
|
|
# To build it for arm64 and amd64 (YYYYMMDD.HHMM is the current date and time in UTC):
|
|
# docker buildx create --use
|
|
# docker buildx build --platform linux/amd64,linux/arm64/v8 \
|
|
# -t registry.gitlab.com/buildroot.org/buildroot/base:YYYYMMDD.HHMM \
|
|
# --push support/docker
|
|
|
|
# We use a specific tag for the base image *and* the corresponding date
|
|
# for the repository., so do not forget to update the apt-sources.list
|
|
# file that is shipped next to this Dockerfile.
|
|
FROM debian:bookworm-20250203
|
|
|
|
LABEL maintainer="Buildroot mailing list <buildroot@buildroot.org>" \
|
|
vendor="Buildroot" \
|
|
description="Container with everything needed to run Buildroot"
|
|
|
|
# Architecture to build for
|
|
ARG TARGETPLATFORM
|
|
|
|
# We need tar >= 1.35
|
|
ARG TAR_VERSION="1.35"
|
|
|
|
# Setup environment
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# This repository can be a bit slow at times. Don't panic...
|
|
COPY debian.sources /etc/apt/sources.list.d/debian.sources
|
|
|
|
# Install 32bit variant on x86_64 image.
|
|
RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
|
|
dpkg --add-architecture i386; \
|
|
fi
|
|
|
|
# The container has no package lists, so need to update first
|
|
RUN apt-get -o APT::Retries=3 -o APT::Acquire::http::Timeout=60 \
|
|
update -y
|
|
|
|
RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
|
|
apt-get -o APT::Retries=3 -o APT::Acquire::http::Timeout=60 \
|
|
install -y --no-install-recommends \
|
|
g++-multilib \
|
|
libc6:i386; \
|
|
fi
|
|
|
|
RUN apt-get -o APT::Retries=3 -o APT::Acquire::http::Timeout=60 \
|
|
install -y --no-install-recommends \
|
|
bc \
|
|
build-essential \
|
|
bzr \
|
|
ca-certificates \
|
|
cmake \
|
|
cpio \
|
|
curl \
|
|
cvs \
|
|
file \
|
|
flake8 \
|
|
g++ \
|
|
git \
|
|
libncurses5-dev \
|
|
locales \
|
|
mercurial \
|
|
openssh-server \
|
|
python3 \
|
|
python3-flake8 \
|
|
python3-magic \
|
|
python3-nose2 \
|
|
python3-pexpect \
|
|
python3-pytest \
|
|
qemu-system-arm \
|
|
qemu-system-misc \
|
|
qemu-system-x86 \
|
|
rsync \
|
|
shellcheck \
|
|
subversion \
|
|
unzip \
|
|
wget \
|
|
&& \
|
|
apt-get -y autoremove && \
|
|
apt-get -y clean
|
|
|
|
# Build host-tar
|
|
RUN curl -sfL https://ftpmirror.gnu.org/tar/tar-${TAR_VERSION}.tar.xz | \
|
|
tar -Jx -C /tmp && \
|
|
cd /tmp/tar-${TAR_VERSION} && \
|
|
FORCE_UNSAFE_CONFIGURE=1 ./configure \
|
|
--disable-year2038 && \
|
|
make && \
|
|
make install && \
|
|
rm -rf /tmp/tar-${TAR_VERSION}
|
|
|
|
# To be able to generate a toolchain with locales, enable one UTF-8 locale
|
|
RUN sed -i 's/# \(en_US.UTF-8\)/\1/' /etc/locale.gen && \
|
|
/usr/sbin/locale-gen
|
|
|
|
RUN useradd -ms /bin/bash br-user && \
|
|
chown -R br-user:br-user /home/br-user
|
|
|
|
# Make the br-user home directory not writable, even for br-user
|
|
# itself, to catch builds writing into $HOME
|
|
RUN chmod 555 /home/br-user
|
|
|
|
USER br-user
|
|
WORKDIR /home/br-user
|
|
ENV HOME=/home/br-user
|
|
ENV LC_ALL=en_US.UTF-8
|