gaudi-base-operator/Dockerfile at main · HabanaAI/gaudi-base-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Copyright (c) 2024 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

FROM golang:1.25.8 AS golang
FROM gcr.io/distroless/static:nonroot AS distroless

FROM golang AS workspace
ARG HTTP_PROXY=""
ARG HTTPS_PROXY=""
ARG NO_PROXY=""
ENV http_proxy=${HTTP_PROXY}
ENV https_proxy=${HTTPS_PROXY}
ENV no_proxy=${NO_PROXY}
ENV HTTP_PROXY=${HTTP_PROXY}
ENV HTTPS_PROXY=${HTTPS_PROXY}
ENV NO_PROXY=${NO_PROXY}
ARG REMOTE_USER=user-name-goes-here
ARG REMOTE_UID=1000
ARG REMOTE_GID=$REMOTE_UID
RUN getent group ${REMOTE_GID} > /dev/null 2>&1 || groupadd --gid ${REMOTE_GID} ${REMOTE_USER}
RUN useradd --uid $REMOTE_UID --gid $REMOTE_GID -m $REMOTE_USER

FROM golang AS builder
ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace
COPY go.mod go.mod
COPY go.sum go.sum
# cache deps before building and copying source so that we don't need to re-download as much
# and so that source changes don't invalidate our downloaded layer
RUN go mod download

# Copy the go source
COPY cmd/main.go cmd/main.go
COPY api/ api/
COPY internal/ internal/

# Build
# the GOARCH has not a default value to allow the binary be built according to the host where the command
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
ENV GCFLAGS="all=-spectre=all -N -l"
ENV ASMFLAGS="all=-spectre=all"
ENV LDFLAGS="all=-s -w"
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build ${GOFLAGS} -trimpath -mod=readonly -gcflags="${GCFLAGS}" -asmflags="${ASMFLAGS}" -ldflags="${LDFLAGS}" -a -o manager cmd/main.go
RUN go get github.com/google/go-licenses && \
    go run github.com/google/go-licenses save ./... --save_path=licenses || true

# Verify binary build specs with checksec
ENV CHECKSEC_REF="No RELRO,No Canary found,NX enabled,No PIE,N/A,N/A,No Symbols,N/A,0,0"
RUN apt-get update -y && apt-get --no-install-recommends -y install file && \
    wget -q https://raw.githubusercontent.com/slimm609/checksec/refs/heads/main/checksec.bash -O checksec && \
    chmod +x checksec && \
    ./checksec --file=/workspace/manager --output=csv | grep -q "${CHECKSEC_REF}"

# Use distroless as minimal base image to package the manager binary
# Refer to https://github.com/GoogleContainerTools/distroless for more details
FROM distroless AS production
ARG VERSION=""
ARG BUILD_DATE=""

WORKDIR /
COPY --from=builder /workspace/manager .
COPY --from=builder /workspace/licenses /licenses
COPY LICENSE /licenses/intel-gaudi-base-operator/LICENSE
USER 65532:65532

ENTRYPOINT ["/manager"]

LABEL org.opencontainers.image.vendor="Intel Corp."
LABEL org.opencontainers.image.title="Intel Gaudi Base Operator for Kubernetes"
LABEL org.opencontainers.image.description="Intel Gaudi Base Operator automates the management of all necessary Intel Gaudi software components on a Kubernetes cluster."
LABEL org.opencontainers.image.version="${VERSION}"
LABEL org.opencontainers.image.created="${BUILD_DATE}"
LABEL org.opencontainers.image.source=https://github.com/HabanaAI/gaudi-base-operator
LABEL org.opencontainers.image.licenses="Apache-2.0"