talos

1
# syntax = docker/dockerfile-upstream:1.8.1-labs
2

3
# Meta args applied to stage base names.
4

5
ARG TOOLS
6
ARG PKGS
7
ARG EXTRAS
8
ARG INSTALLER_ARCH
9

10
ARG PKGS_PREFIX
11
ARG PKG_FHS
12
ARG PKG_CA_CERTIFICATES
13
ARG PKG_CRYPTSETUP
14
ARG PKG_CONTAINERD
15
ARG PKG_DOSFSTOOLS
16
ARG PKG_EUDEV
17
ARG PKG_GRUB
18
ARG PKG_SD_BOOT
19
ARG PKG_IPTABLES
20
ARG PKG_IPXE
21
ARG PKG_LIBINIH
22
ARG PKG_LIBJSON_C
23
ARG PKG_LIBPOPT
24
ARG PKG_LIBURCU
25
ARG PKG_OPENSSL
26
ARG PKG_LIBSECCOMP
27
ARG PKG_LINUX_FIRMWARE
28
ARG PKG_LVM2
29
ARG PKG_LIBAIO
30
ARG PKG_MUSL
31
ARG PKG_RUNC
32
ARG PKG_XFSPROGS
33
ARG PKG_APPARMOR
34
ARG PKG_UTIL_LINUX
35
ARG PKG_KMOD
36
ARG PKG_KERNEL
37
ARG PKG_TALOSCTL_CNI_BUNDLE_INSTALL
38

39
# Resolve package images using ${PKGS} to be used later in COPY --from=.
40

41
FROM ${PKG_FHS} AS pkg-fhs
42
FROM ${PKG_CA_CERTIFICATES} AS pkg-ca-certificates
43

44
FROM --platform=amd64 ${PKG_APPARMOR} AS pkg-apparmor-amd64
45
FROM --platform=arm64 ${PKG_APPARMOR} AS pkg-apparmor-arm64
46

47
FROM --platform=amd64 ${PKG_CRYPTSETUP} AS pkg-cryptsetup-amd64
48
FROM --platform=arm64 ${PKG_CRYPTSETUP} AS pkg-cryptsetup-arm64
49

50
FROM --platform=amd64 ${PKG_CONTAINERD} AS pkg-containerd-amd64
51
FROM --platform=arm64 ${PKG_CONTAINERD} AS pkg-containerd-arm64
52

53
FROM --platform=amd64 ${PKG_DOSFSTOOLS} AS pkg-dosfstools-amd64
54
FROM --platform=arm64 ${PKG_DOSFSTOOLS} AS pkg-dosfstools-arm64
55

56
FROM --platform=amd64 ${PKG_EUDEV} AS pkg-eudev-amd64
57
FROM --platform=arm64 ${PKG_EUDEV} AS pkg-eudev-arm64
58

59
FROM ${PKG_GRUB} AS pkg-grub
60
FROM --platform=amd64 ${PKG_GRUB} AS pkg-grub-amd64
61
FROM --platform=arm64 ${PKG_GRUB} AS pkg-grub-arm64
62

63
FROM ${PKG_SD_BOOT} AS pkg-sd-boot
64
FROM --platform=amd64 ${PKG_SD_BOOT} AS pkg-sd-boot-amd64
65
FROM --platform=arm64 ${PKG_SD_BOOT} AS pkg-sd-boot-arm64
66

67
FROM --platform=amd64 ${PKG_IPTABLES} AS pkg-iptables-amd64
68
FROM --platform=arm64 ${PKG_IPTABLES} AS pkg-iptables-arm64
69

70
FROM --platform=amd64 ${PKG_IPXE} AS pkg-ipxe-amd64
71
FROM --platform=arm64 ${PKG_IPXE} AS pkg-ipxe-arm64
72

73
FROM --platform=amd64 ${PKG_LIBINIH} AS pkg-libinih-amd64
74
FROM --platform=arm64 ${PKG_LIBINIH} AS pkg-libinih-arm64
75

76
FROM --platform=amd64 ${PKG_LIBJSON_C} AS pkg-libjson-c-amd64
77
FROM --platform=arm64 ${PKG_LIBJSON_C} AS pkg-libjson-c-arm64
78

79
FROM --platform=amd64 ${PKG_LIBPOPT} AS pkg-libpopt-amd64
80
FROM --platform=arm64 ${PKG_LIBPOPT} AS pkg-libpopt-arm64
81

82
FROM --platform=amd64 ${PKG_LIBURCU} AS pkg-liburcu-amd64
83
FROM --platform=arm64 ${PKG_LIBURCU} AS pkg-liburcu-arm64
84

85
FROM --platform=amd64 ${PKG_OPENSSL} AS pkg-openssl-amd64
86
FROM --platform=arm64 ${PKG_OPENSSL} AS pkg-openssl-arm64
87

88
FROM --platform=amd64 ${PKG_LIBSECCOMP} AS pkg-libseccomp-amd64
89
FROM --platform=arm64 ${PKG_LIBSECCOMP} AS pkg-libseccomp-arm64
90

91
# linux-firmware is not arch-specific
92
FROM --platform=amd64 ${PKG_LINUX_FIRMWARE} AS pkg-linux-firmware
93

94
FROM --platform=amd64 ${PKG_LVM2} AS pkg-lvm2-amd64
95
FROM --platform=arm64 ${PKG_LVM2} AS pkg-lvm2-arm64
96

97
FROM --platform=amd64 ${PKG_LIBAIO} AS pkg-libaio-amd64
98
FROM --platform=arm64 ${PKG_LIBAIO} AS pkg-libaio-arm64
99

100
FROM --platform=amd64 ${PKG_MUSL} AS pkg-musl-amd64
101
FROM --platform=arm64 ${PKG_MUSL} AS pkg-musl-arm64
102

103
FROM --platform=amd64 ${PKG_RUNC} AS pkg-runc-amd64
104
FROM --platform=arm64 ${PKG_RUNC} AS pkg-runc-arm64
105

106
FROM --platform=amd64 ${PKG_XFSPROGS} AS pkg-xfsprogs-amd64
107
FROM --platform=arm64 ${PKG_XFSPROGS} AS pkg-xfsprogs-arm64
108

109
FROM --platform=amd64 ${PKG_UTIL_LINUX} AS pkg-util-linux-amd64
110
FROM --platform=arm64 ${PKG_UTIL_LINUX} AS pkg-util-linux-arm64
111

112
FROM --platform=amd64 ${PKG_KMOD} AS pkg-kmod-amd64
113
FROM --platform=arm64 ${PKG_KMOD} AS pkg-kmod-arm64
114

115
FROM ${PKG_KERNEL} AS pkg-kernel
116
FROM --platform=amd64 ${PKG_KERNEL} AS pkg-kernel-amd64
117
FROM --platform=arm64 ${PKG_KERNEL} AS pkg-kernel-arm64
118

119
# Resolve package images using ${EXTRAS} to be used later in COPY --from=.
120

121
FROM ${PKG_TALOSCTL_CNI_BUNDLE_INSTALL} AS extras-talosctl-cni-bundle-install
122

123
# The tools target provides base toolchain for the build.
124

125
FROM --platform=${BUILDPLATFORM} $TOOLS AS tools
126
ENV PATH=/toolchain/bin:/toolchain/go/bin
127
ENV LD_LIBRARY_PATH=/toolchain/lib
128
ENV GOTOOLCHAIN=local
129
RUN ["/toolchain/bin/mkdir", "/bin", "/tmp"]
130
RUN ["/toolchain/bin/ln", "-svf", "/toolchain/bin/bash", "/bin/sh"]
131
RUN ["/toolchain/bin/ln", "-svf", "/toolchain/etc/ssl", "/etc/ssl"]
132
ARG GOLANGCILINT_VERSION
133
RUN --mount=type=cache,target=/.cache go install github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLANGCILINT_VERSION} \
134
	&& mv /go/bin/golangci-lint /toolchain/go/bin/golangci-lint
135
ARG GOIMPORTS_VERSION
136
RUN --mount=type=cache,target=/.cache go install golang.org/x/tools/cmd/goimports@${GOIMPORTS_VERSION} \
137
    && mv /go/bin/goimports /toolchain/go/bin/goimports
138
ARG GOFUMPT_VERSION
139
RUN --mount=type=cache,target=/.cache go install mvdan.cc/gofumpt@${GOFUMPT_VERSION} \
140
    && mv /go/bin/gofumpt /toolchain/go/bin/gofumpt
141
ARG DEEPCOPY_VERSION
142
RUN --mount=type=cache,target=/.cache go install github.com/siderolabs/deep-copy@${DEEPCOPY_VERSION} \
143
    && mv /go/bin/deep-copy /toolchain/go/bin/deep-copy
144
ARG STRINGER_VERSION
145
RUN --mount=type=cache,target=/.cache go install golang.org/x/tools/cmd/stringer@${STRINGER_VERSION} \
146
    && mv /go/bin/stringer /toolchain/go/bin/stringer
147
ARG ENUMER_VERSION
148
RUN --mount=type=cache,target=/.cache go install github.com/dmarkham/enumer@${ENUMER_VERSION} \
149
    && mv /go/bin/enumer /toolchain/go/bin/enumer
150
ARG DEEPCOPY_GEN_VERSION
151
RUN --mount=type=cache,target=/.cache go install k8s.io/code-generator/cmd/deepcopy-gen@${DEEPCOPY_GEN_VERSION} \
152
    && mv /go/bin/deepcopy-gen /toolchain/go/bin/deepcopy-gen
153
ARG VTPROTOBUF_VERSION
154
RUN --mount=type=cache,target=/.cache go install github.com/planetscale/vtprotobuf/cmd/protoc-gen-go-vtproto@${VTPROTOBUF_VERSION} \
155
    && mv /go/bin/protoc-gen-go-vtproto /toolchain/go/bin/protoc-gen-go-vtproto
156
ARG IMPORTVET_VERSION
157
RUN --mount=type=cache,target=/.cache go install github.com/siderolabs/importvet/cmd/importvet@${IMPORTVET_VERSION} \
158
    && mv /go/bin/importvet /toolchain/go/bin/importvet
159
RUN --mount=type=cache,target=/.cache go install golang.org/x/vuln/cmd/govulncheck@latest \
160
    && mv /go/bin/govulncheck /toolchain/go/bin/govulncheck
161
RUN --mount=type=cache,target=/.cache go install github.com/uber/prototool/cmd/prototool@v1.10.0 \
162
    && mv /go/bin/prototool /toolchain/go/bin/prototool
163
COPY ./hack/docgen /go/src/github.com/siderolabs/talos-hack-docgen
164
RUN --mount=type=cache,target=/.cache cd /go/src/github.com/siderolabs/talos-hack-docgen \
165
    && go build -o docgen . \
166
    && mv docgen /toolchain/go/bin/
167
COPY ./hack/gotagsrewrite /go/src/github.com/siderolabs/gotagsrewrite
168
RUN --mount=type=cache,target=/.cache cd /go/src/github.com/siderolabs/gotagsrewrite \
169
    && go build -o gotagsrewrite . \
170
    && mv gotagsrewrite /toolchain/go/bin/
171
COPY ./hack/structprotogen /go/src/github.com/siderolabs/structprotogen
172
RUN --mount=type=cache,target=/.cache cd /go/src/github.com/siderolabs/structprotogen \
173
    && go build -o structprotogen . \
174
    && mv structprotogen /toolchain/go/bin/
175

176
# The build target creates a container that will be used to build Talos source
177
# code.
178

179
FROM --platform=${BUILDPLATFORM} tools AS build
180
SHELL ["/toolchain/bin/bash", "-c"]
181
ENV PATH=/toolchain/bin:/toolchain/go/bin
182
ENV GO111MODULE=on
183
ENV GOPROXY=https://proxy.golang.org
184
ARG CGO_ENABLED
185
ENV CGO_ENABLED=${CGO_ENABLED}
186
ENV GOCACHE=/.cache/go-build
187
ENV GOMODCACHE=/.cache/mod
188
ENV PROTOTOOL_CACHE_PATH=/.cache/prototool
189
ARG SOURCE_DATE_EPOCH
190
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
191
WORKDIR /src
192

193
# The build-go target creates a container to build Go code with Go modules downloaded and verified.
194

195
FROM build AS build-go
196
COPY ./go.mod ./go.sum ./
197
COPY ./pkg/machinery/go.mod ./pkg/machinery/go.sum ./pkg/machinery/
198
WORKDIR /src/pkg/machinery
199
RUN --mount=type=cache,target=/.cache go mod download
200
WORKDIR /src
201
RUN --mount=type=cache,target=/.cache go mod download
202
RUN --mount=type=cache,target=/.cache go mod verify
203

204
# The generate target generates code from protobuf service definitions and machinery config.
205

206
# generate API descriptors
207
FROM build AS api-descriptors-build
208
WORKDIR /src/api
209
COPY api .
210
RUN --mount=type=cache,target=/.cache prototool format --overwrite --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
211
RUN --mount=type=cache,target=/.cache prototool break descriptor-set --output-path=api.descriptors --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
212

213
FROM --platform=${BUILDPLATFORM} scratch AS api-descriptors
214
COPY --from=api-descriptors-build /src/api/api.descriptors /api/api.descriptors
215

216
# format protobuf service definitions
217
FROM build AS proto-format-build
218
WORKDIR /src/api
219
COPY api .
220
RUN --mount=type=cache,target=/.cache prototool format --overwrite --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
221

222
FROM --platform=${BUILDPLATFORM} scratch AS fmt-protobuf
223
COPY --from=proto-format-build /src/api/ /api/
224

225
# run docgen for machinery config
226
FROM build-go AS go-generate
227
COPY ./pkg ./pkg
228
COPY ./hack/boilerplate.txt ./hack/boilerplate.txt
229
RUN --mount=type=cache,target=/.cache go generate ./pkg/...
230
RUN goimports -w -local github.com/siderolabs/talos ./pkg/
231
RUN gofumpt -w ./pkg/
232
WORKDIR /src/pkg/machinery
233
RUN --mount=type=cache,target=/.cache go generate ./...
234
RUN gotagsrewrite .
235
RUN goimports -w -local github.com/siderolabs/talos ./
236
RUN gofumpt -w ./
237

238
FROM go-generate AS gen-proto-go
239
WORKDIR /src/
240
RUN --mount=type=cache,target=/.cache structprotogen github.com/siderolabs/talos/pkg/machinery/... /api/resource/definitions/
241

242
# compile protobuf service definitions
243
FROM build AS generate-build
244
COPY --from=proto-format-build /src/api /api/
245
# Common needs to be at or near the top to satisfy the subsequent imports
246
COPY ./api/vendor/ /api/vendor/
247
COPY ./api/common/common.proto /api/common/common.proto
248
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size common/common.proto
249
COPY ./api/security/security.proto /api/security/security.proto
250
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size security/security.proto
251
COPY ./api/storage/storage.proto /api/storage/storage.proto
252
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size storage/storage.proto
253
COPY ./api/machine/machine.proto /api/machine/machine.proto
254
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size machine/machine.proto
255
COPY ./api/time/time.proto /api/time/time.proto
256
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size time/time.proto
257
COPY ./api/cluster/cluster.proto /api/cluster/cluster.proto
258
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size cluster/cluster.proto
259
COPY ./api/resource/config/config.proto /api/resource/config/config.proto
260
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size resource/config/config.proto
261
COPY ./api/resource/network/device_config.proto /api/resource/network/device_config.proto
262
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size resource/network/device_config.proto
263
COPY ./api/inspect/inspect.proto /api/inspect/inspect.proto
264
RUN protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size inspect/inspect.proto
265
COPY --from=gen-proto-go /api/resource/definitions/ /api/resource/definitions/
266
RUN find /api/resource/definitions/ -type f -name "*.proto" | xargs -I {} /bin/sh -c 'protoc -I/api -I/api/vendor/ --go_out=paths=source_relative:/api --go-grpc_out=paths=source_relative:/api --go-vtproto_out=paths=source_relative:/api --go-vtproto_opt=features=marshal+unmarshal+size {} && mkdir -p /api/resource/definitions_go/$(basename {} .proto) && mv /api/resource/definitions/$(basename {} .proto)/*.go /api/resource/definitions_go/$(basename {} .proto)'
267
# Goimports and gofumpt generated files to adjust import order
268
RUN goimports -w -local github.com/siderolabs/talos /api/
269
RUN gofumpt -w /api/
270

271
FROM build AS embed-generate
272
ARG NAME
273
ARG SHA
274
ARG USERNAME
275
ARG REGISTRY
276
ARG TAG
277
ARG ARTIFACTS
278
ARG PKGS
279
ARG EXTRAS
280
RUN mkdir -p pkg/machinery/gendata/data && \
281
    echo -n ${NAME} > pkg/machinery/gendata/data/name && \
282
    echo -n ${SHA} > pkg/machinery/gendata/data/sha && \
283
    echo -n ${USERNAME} > pkg/machinery/gendata/data/username && \
284
    echo -n ${REGISTRY} > pkg/machinery/gendata/data/registry && \
285
    echo -n ${EXTRAS} > pkg/machinery/gendata/data/extras && \
286
    echo -n ${PKGS} > pkg/machinery/gendata/data/pkgs && \
287
    echo -n ${TAG} > pkg/machinery/gendata/data/tag && \
288
    echo -n ${ARTIFACTS} > pkg/machinery/gendata/data/artifacts
289

290
FROM scratch AS embed
291
COPY --from=embed-generate /src/pkg/machinery/gendata/data /pkg/machinery/gendata/data
292

293
FROM embed-generate AS embed-abbrev-generate
294
ARG ABBREV_TAG
295
RUN echo -n "undefined" > pkg/machinery/gendata/data/sha && \
296
    echo -n ${ABBREV_TAG} > pkg/machinery/gendata/data/tag
297
RUN mkdir -p _out && \
298
    echo PKGS=${PKGS} >> _out/talos-metadata && \
299
    echo TAG=${TAG} >> _out/talos-metadata && \
300
    echo EXTRAS=${EXTRAS} >> _out/talos-metadata
301
COPY --from=pkg-kernel /certs/signing_key.x509 _out/signing_key.x509
302

303
FROM scratch AS embed-abbrev
304
COPY --from=embed-abbrev-generate /src/pkg/machinery/gendata/data /pkg/machinery/gendata/data
305
COPY --from=embed-abbrev-generate /src/_out/talos-metadata /_out/talos-metadata
306
COPY --from=embed-abbrev-generate /src/_out/signing_key.x509 /_out/signing_key.x509
307

308
FROM scratch AS ipxe-generate
309
COPY --from=pkg-ipxe-amd64 /usr/libexec/snp.efi /amd64/snp.efi
310
COPY --from=pkg-ipxe-arm64 /usr/libexec/snp.efi /arm64/snp.efi
311

312
FROM --platform=${BUILDPLATFORM} scratch AS generate
313
COPY --from=proto-format-build /src/api /api/
314
COPY --from=generate-build /api/common/*.pb.go /pkg/machinery/api/common/
315
COPY --from=generate-build /api/resource/definitions/ /api/resource/definitions/
316
COPY --from=generate-build /api/resource/definitions_go/ /pkg/machinery/api/resource/definitions/
317
COPY --from=generate-build /api/security/*.pb.go /pkg/machinery/api/security/
318
COPY --from=generate-build /api/machine/*.pb.go /pkg/machinery/api/machine/
319
COPY --from=generate-build /api/time/*.pb.go /pkg/machinery/api/time/
320
COPY --from=generate-build /api/cluster/*.pb.go /pkg/machinery/api/cluster/
321
COPY --from=generate-build /api/storage/*.pb.go /pkg/machinery/api/storage/
322
COPY --from=generate-build /api/resource/*.pb.go /pkg/machinery/api/resource/
323
COPY --from=generate-build /api/resource/config/*.pb.go /pkg/machinery/api/resource/config/
324
COPY --from=generate-build /api/resource/network/*.pb.go /pkg/machinery/api/resource/network/
325
COPY --from=generate-build /api/inspect/*.pb.go /pkg/machinery/api/inspect/
326
COPY --from=go-generate /src/pkg/flannel/ /pkg/flannel/
327
COPY --from=go-generate /src/pkg/imager/profile/ /pkg/imager/profile/
328
COPY --from=go-generate /src/pkg/machinery/resources/ /pkg/machinery/resources/
329
COPY --from=go-generate /src/pkg/machinery/config/schemas/ /pkg/machinery/config/schemas/
330
COPY --from=go-generate /src/pkg/machinery/config/types/ /pkg/machinery/config/types/
331
COPY --from=go-generate /src/pkg/machinery/nethelpers/ /pkg/machinery/nethelpers/
332
COPY --from=go-generate /src/pkg/machinery/extensions/ /pkg/machinery/extensions/
333
COPY --from=ipxe-generate / /pkg/provision/providers/vm/internal/ipxe/data/ipxe/
334
COPY --from=embed-abbrev / /
335

336
# The base target provides a container that can be used to build all Talos
337
# assets.
338

339
FROM build-go AS base
340
COPY ./cmd ./cmd
341
COPY ./pkg ./pkg
342
COPY ./internal ./internal
343
COPY --from=generate /pkg/flannel/ ./pkg/flannel/
344
COPY --from=generate /pkg/imager/ ./pkg/imager/
345
COPY --from=generate /pkg/machinery/ ./pkg/machinery/
346
COPY --from=embed / ./
347
RUN --mount=type=cache,target=/.cache go list all >/dev/null
348
WORKDIR /src/pkg/machinery
349
RUN --mount=type=cache,target=/.cache go list all >/dev/null
350
WORKDIR /src
351

352
# The vulncheck target runs the vulnerability check tool.
353

354
FROM base AS lint-vulncheck
355
RUN --mount=type=cache,target=/.cache govulncheck ./...
356

357
# The init target builds the init binary.
358

359
FROM base AS init-build-amd64
360
WORKDIR /src/internal/app/init
361
ARG GO_BUILDFLAGS
362
ARG GO_LDFLAGS
363
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=amd64 GOAMD64=v1 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /init
364
RUN chmod +x /init
365

366
FROM base AS init-build-arm64
367
WORKDIR /src/internal/app/init
368
ARG GO_BUILDFLAGS
369
ARG GO_LDFLAGS
370
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=arm64 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /init
371
RUN chmod +x /init
372

373
FROM init-build-${TARGETARCH} AS init-build
374

375
FROM scratch AS init
376
COPY --from=init-build /init /init
377

378
# The machined target builds the machined binary.
379

380
FROM base AS machined-build-amd64
381
WORKDIR /src/internal/app/machined
382
ARG GO_BUILDFLAGS
383
ARG GO_LDFLAGS
384
ARG GOAMD64
385
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=amd64 GOAMD64=${GOAMD64} go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /machined
386
RUN chmod +x /machined
387

388
FROM base AS machined-build-arm64
389
WORKDIR /src/internal/app/machined
390
ARG GO_BUILDFLAGS
391
ARG GO_LDFLAGS
392
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=arm64 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /machined
393
RUN chmod +x /machined
394

395
FROM machined-build-${TARGETARCH} AS machined-build
396

397
FROM scratch AS machined
398
COPY --from=machined-build /machined /machined
399

400
# The talosctl targets build the talosctl binaries.
401

402
FROM base AS talosctl-linux-amd64-build
403
WORKDIR /src/cmd/talosctl
404
ARG GO_BUILDFLAGS
405
ARG GO_LDFLAGS
406
ARG GOAMD64
407
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=amd64 GOAMD64=${GOAMD64} go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-linux-amd64
408
RUN chmod +x /talosctl-linux-amd64
409
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-linux-amd64
410

411
FROM base AS talosctl-linux-arm64-build
412
WORKDIR /src/cmd/talosctl
413
ARG GO_BUILDFLAGS
414
ARG GO_LDFLAGS
415
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=arm64 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-linux-arm64
416
RUN chmod +x /talosctl-linux-arm64
417
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-linux-arm64
418

419
FROM base AS talosctl-linux-armv7-build
420
WORKDIR /src/cmd/talosctl
421
ARG GO_BUILDFLAGS
422
ARG GO_LDFLAGS
423
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=arm GOARM=7 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-linux-armv7
424
RUN chmod +x /talosctl-linux-armv7
425
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-linux-armv7
426

427
FROM base AS talosctl-darwin-amd64-build
428
WORKDIR /src/cmd/talosctl
429
ARG GO_BUILDFLAGS
430
ARG GO_LDFLAGS
431
ARG GOAMD64
432
RUN --mount=type=cache,target=/.cache GOOS=darwin GOARCH=amd64 GOAMD64=${GOAMD64} go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-darwin-amd64
433
RUN chmod +x /talosctl-darwin-amd64
434
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-darwin-amd64
435

436
FROM base AS talosctl-darwin-arm64-build
437
WORKDIR /src/cmd/talosctl
438
ARG GO_BUILDFLAGS
439
ARG GO_LDFLAGS
440
RUN --mount=type=cache,target=/.cache GOOS=darwin GOARCH=arm64 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-darwin-arm64
441
RUN chmod +x /talosctl-darwin-arm64
442
RUN touch --date="@${SOURCE_DATE_EPOCH}" talosctl-darwin-arm64
443

444
FROM base AS talosctl-windows-amd64-build
445
WORKDIR /src/cmd/talosctl
446
ARG GO_BUILDFLAGS
447
ARG GO_LDFLAGS
448
ARG GOAMD64
449
RUN --mount=type=cache,target=/.cache GOOS=windows GOARCH=amd64 GOAMD64=${GOAMD64} go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-windows-amd64.exe
450
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-windows-amd64.exe
451

452
FROM base AS talosctl-freebsd-amd64-build
453
WORKDIR /src/cmd/talosctl
454
ARG GO_BUILDFLAGS
455
ARG GO_LDFLAGS
456
ARG GOAMD64
457
RUN --mount=type=cache,target=/.cache GOOS=freebsd GOARCH=amd64 GOAMD64=${GOAMD64} go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-freebsd-amd64
458
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-freebsd-amd64
459

460
FROM base AS talosctl-freebsd-arm64-build
461
WORKDIR /src/cmd/talosctl
462
ARG GO_BUILDFLAGS
463
ARG GO_LDFLAGS
464
RUN --mount=type=cache,target=/.cache GOOS=freebsd GOARCH=arm64 go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /talosctl-freebsd-arm64
465
RUN touch --date="@${SOURCE_DATE_EPOCH}" /talosctl-freebsd-arm64
466

467
FROM scratch AS talosctl-linux-amd64
468
COPY --from=talosctl-linux-amd64-build /talosctl-linux-amd64 /talosctl-linux-amd64
469

470
FROM scratch AS talosctl-linux-arm64
471
COPY --from=talosctl-linux-arm64-build /talosctl-linux-arm64 /talosctl-linux-arm64
472

473
FROM scratch AS talosctl-linux-armv7
474
COPY --from=talosctl-linux-armv7-build /talosctl-linux-armv7 /talosctl-linux-armv7
475

476
FROM scratch AS talosctl-darwin-amd64
477
COPY --from=talosctl-darwin-amd64-build /talosctl-darwin-amd64 /talosctl-darwin-amd64
478

479
FROM scratch AS talosctl-darwin-arm64
480
COPY --from=talosctl-darwin-arm64-build /talosctl-darwin-arm64 /talosctl-darwin-arm64
481

482
FROM scratch AS talosctl-freebsd-amd64
483
COPY --from=talosctl-freebsd-amd64-build /talosctl-freebsd-amd64 /talosctl-freebsd-amd64
484

485
FROM scratch AS talosctl-freebsd-arm64
486
COPY --from=talosctl-freebsd-arm64-build /talosctl-freebsd-arm64 /talosctl-freebsd-arm64
487

488
FROM scratch AS talosctl-windows-amd64
489
COPY --from=talosctl-windows-amd64-build /talosctl-windows-amd64.exe /talosctl-windows-amd64.exe
490

491
FROM --platform=${BUILDPLATFORM} talosctl-${TARGETOS}-${TARGETARCH} AS talosctl-targetarch
492

493
FROM scratch AS talosctl-all
494
COPY --from=talosctl-linux-amd64 / /
495
COPY --from=talosctl-linux-arm64 / /
496
COPY --from=talosctl-linux-armv7 / /
497
COPY --from=talosctl-darwin-amd64 / /
498
COPY --from=talosctl-darwin-arm64 / /
499
COPY --from=talosctl-freebsd-amd64 / /
500
COPY --from=talosctl-freebsd-arm64 / /
501
COPY --from=talosctl-windows-amd64 / /
502

503
FROM scratch AS talosctl
504
ARG TARGETARCH
505
COPY --from=talosctl-all /talosctl-linux-${TARGETARCH} /talosctl
506
ARG TAG
507
ENV VERSION ${TAG}
508
LABEL "alpha.talos.dev/version"="${VERSION}"
509
LABEL org.opencontainers.image.source https://github.com/siderolabs/talos
510
ENTRYPOINT ["/talosctl"]
511

512
# The kernel target is the linux kernel.
513
FROM scratch AS kernel
514
ARG TARGETARCH
515
COPY --from=pkg-kernel /boot/vmlinuz /vmlinuz-${TARGETARCH}
516

517
# The sd-boot target is the systemd-boot asset.
518
FROM scratch AS sd-boot
519
ARG TARGETARCH
520
COPY --from=pkg-sd-boot /*.efi /sd-boot-${TARGETARCH}.efi
521

522
# The sd-stub target is the systemd-stub asset.
523
FROM scratch AS sd-stub
524
ARG TARGETARCH
525
COPY --from=pkg-sd-boot /*.efi.stub /sd-stub-${TARGETARCH}.efi
526

527
FROM tools AS depmod-amd64
528
WORKDIR /staging
529
COPY hack/modules-amd64.txt .
530
COPY --from=pkg-kernel-amd64 /lib/modules lib/modules
531
RUN <<EOF
532
set -euo pipefail
533

534
KERNEL_VERSION=$(ls lib/modules)
535

536
xargs -a modules-amd64.txt -I {} install -D lib/modules/${KERNEL_VERSION}/{} /build/lib/modules/${KERNEL_VERSION}/{}
537

538
depmod -b /build ${KERNEL_VERSION}
539
EOF
540

541
FROM scratch AS modules-amd64
542
COPY --from=depmod-amd64 /build/lib/modules /lib/modules
543

544
FROM tools AS depmod-arm64
545
WORKDIR /staging
546
COPY hack/modules-arm64.txt .
547
COPY --from=pkg-kernel-arm64 /lib/modules lib/modules
548
RUN <<EOF
549
set -euo pipefail
550

551
KERNEL_VERSION=$(ls lib/modules)
552

553
xargs -a modules-arm64.txt -I {} install -D lib/modules/${KERNEL_VERSION}/{} /build/lib/modules/${KERNEL_VERSION}/{}
554

555
depmod -b /build ${KERNEL_VERSION}
556
EOF
557

558
FROM scratch AS modules-arm64
559
COPY --from=depmod-arm64 /build/lib/modules /lib/modules
560

561
# The rootfs target provides the Talos rootfs.
562
FROM build AS rootfs-base-amd64
563
COPY --link --from=pkg-fhs / /rootfs
564
COPY --link --from=pkg-ca-certificates / /rootfs
565
COPY --link --from=pkg-apparmor-amd64 / /rootfs
566
COPY --link --from=pkg-cryptsetup-amd64 / /rootfs
567
COPY --link --from=pkg-containerd-amd64 / /rootfs
568
COPY --link --from=pkg-dosfstools-amd64 / /rootfs
569
COPY --link --from=pkg-eudev-amd64 / /rootfs
570
COPY --link --from=pkg-iptables-amd64 / /rootfs
571
COPY --link --from=pkg-libinih-amd64 / /rootfs
572
COPY --link --from=pkg-libjson-c-amd64 / /rootfs
573
COPY --link --from=pkg-libpopt-amd64 / /rootfs
574
COPY --link --from=pkg-liburcu-amd64 / /rootfs
575
COPY --link --from=pkg-openssl-amd64 / /rootfs
576
COPY --link --from=pkg-libseccomp-amd64 / /rootfs
577
COPY --link --from=pkg-lvm2-amd64 / /rootfs
578
COPY --link --from=pkg-libaio-amd64 / /rootfs
579
COPY --link --from=pkg-musl-amd64 / /rootfs
580
COPY --link --from=pkg-runc-amd64 / /rootfs
581
COPY --link --from=pkg-xfsprogs-amd64 / /rootfs
582
COPY --link --from=pkg-util-linux-amd64 /lib/libblkid.* /rootfs/lib/
583
COPY --link --from=pkg-util-linux-amd64 /lib/libuuid.* /rootfs/lib/
584
COPY --link --from=pkg-util-linux-amd64 /lib/libmount.* /rootfs/lib/
585
COPY --link --from=pkg-kmod-amd64 /usr/lib/libkmod.* /rootfs/lib/
586
COPY --link --from=pkg-kmod-amd64 /usr/bin/kmod /rootfs/sbin/modprobe
587
COPY --link --from=modules-amd64 /lib/modules /rootfs/lib/modules
588
COPY --link --from=machined-build-amd64 /machined /rootfs/sbin/init
589
RUN <<END
590
    # the orderly_poweroff call by the kernel will call '/sbin/poweroff'
591
    ln /rootfs/sbin/init /rootfs/sbin/poweroff
592
    chmod +x /rootfs/sbin/poweroff
593
    # some extensions like qemu-guest agent will call '/sbin/shutdown'
594
    ln /rootfs/sbin/init /rootfs/sbin/shutdown
595
    chmod +x /rootfs/sbin/shutdown
596
    ln /rootfs/sbin/init /rootfs/sbin/wrapperd
597
    chmod +x /rootfs/sbin/wrapperd
598
    ln /rootfs/sbin/init /rootfs/sbin/dashboard
599
    chmod +x /rootfs/sbin/dashboard
600
END
601
# NB: We run the cleanup step before creating extra directories, files, and
602
# symlinks to avoid accidentally cleaning them up.
603
COPY ./hack/cleanup.sh /toolchain/bin/cleanup.sh
604
RUN <<END
605
    cleanup.sh /rootfs
606
    mkdir -pv /rootfs/{boot/EFI,etc/cri/conf.d/hosts,lib/firmware,usr/local/share,usr/share/zoneinfo/Etc,mnt,system,opt,.extra}
607
    mkdir -pv /rootfs/{etc/kubernetes/manifests,etc/cni/net.d,usr/libexec/kubernetes,/usr/local/lib/kubelet/credentialproviders}
608
    mkdir -pv /rootfs/opt/{containerd/bin,containerd/lib}
609
END
610
COPY --chmod=0644 hack/zoneinfo/Etc/UTC /rootfs/usr/share/zoneinfo/Etc/UTC
611
COPY --chmod=0644 hack/nfsmount.conf /rootfs/etc/nfsmount.conf
612
COPY --chmod=0644 hack/containerd.toml /rootfs/etc/containerd/config.toml
613
COPY --chmod=0644 hack/cri-containerd.toml /rootfs/etc/cri/containerd.toml
614
COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
615
COPY --chmod=0644 hack/udevd/80-net-name-slot.rules /rootfs/usr/lib/udev/rules.d/
616
COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
617
RUN <<END
618
    ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
619
    touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,os-release,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part}
620
    ln -s ca-certificates /rootfs/etc/ssl/certs/ca-certificates.crt
621
    ln -s /etc/ssl /rootfs/etc/pki
622
    ln -s /etc/ssl /rootfs/usr/share/ca-certificates
623
    ln -s /etc/ssl /rootfs/usr/local/share/ca-certificates
624
    ln -s /etc/ssl /rootfs/etc/ca-certificates
625
END
626

627
FROM build AS rootfs-base-arm64
628
COPY --link --from=pkg-fhs / /rootfs
629
COPY --link --from=pkg-ca-certificates / /rootfs
630
COPY --link --from=pkg-apparmor-arm64 / /rootfs
631
COPY --link --from=pkg-cryptsetup-arm64 / /rootfs
632
COPY --link --from=pkg-containerd-arm64 / /rootfs
633
COPY --link --from=pkg-dosfstools-arm64 / /rootfs
634
COPY --link --from=pkg-eudev-arm64 / /rootfs
635
COPY --link --from=pkg-iptables-arm64 / /rootfs
636
COPY --link --from=pkg-libinih-arm64 / /rootfs
637
COPY --link --from=pkg-libjson-c-arm64 / /rootfs
638
COPY --link --from=pkg-libpopt-arm64 / /rootfs
639
COPY --link --from=pkg-liburcu-arm64 / /rootfs
640
COPY --link --from=pkg-openssl-arm64 / /rootfs
641
COPY --link --from=pkg-libseccomp-arm64 / /rootfs
642
COPY --link --from=pkg-lvm2-arm64 / /rootfs
643
COPY --link --from=pkg-libaio-arm64 / /rootfs
644
COPY --link --from=pkg-musl-arm64 / /rootfs
645
COPY --link --from=pkg-runc-arm64 / /rootfs
646
COPY --link --from=pkg-xfsprogs-arm64 / /rootfs
647
COPY --link --from=pkg-util-linux-arm64 /lib/libblkid.* /rootfs/lib/
648
COPY --link --from=pkg-util-linux-arm64 /lib/libuuid.* /rootfs/lib/
649
COPY --link --from=pkg-util-linux-arm64 /lib/libmount.* /rootfs/lib/
650
COPY --link --from=pkg-kmod-arm64 /usr/lib/libkmod.* /rootfs/lib/
651
COPY --link --from=pkg-kmod-arm64 /usr/bin/kmod /rootfs/sbin/modprobe
652
COPY --link --from=modules-arm64 /lib/modules /rootfs/lib/modules
653
COPY --link --from=machined-build-arm64 /machined /rootfs/sbin/init
654
RUN <<END
655
    # the orderly_poweroff call by the kernel will call '/sbin/poweroff'
656
    ln /rootfs/sbin/init /rootfs/sbin/poweroff
657
    chmod +x /rootfs/sbin/poweroff
658
    # some extensions like qemu-guest agent will call '/sbin/shutdown'
659
    ln /rootfs/sbin/init /rootfs/sbin/shutdown
660
    chmod +x /rootfs/sbin/shutdown
661
    ln /rootfs/sbin/init /rootfs/sbin/wrapperd
662
    chmod +x /rootfs/sbin/wrapperd
663
    ln /rootfs/sbin/init /rootfs/sbin/dashboard
664
    chmod +x /rootfs/sbin/dashboard
665
END
666
# NB: We run the cleanup step before creating extra directories, files, and
667
# symlinks to avoid accidentally cleaning them up.
668
COPY ./hack/cleanup.sh /toolchain/bin/cleanup.sh
669
RUN <<END
670
    cleanup.sh /rootfs
671
    mkdir -pv /rootfs/{boot/EFI,etc/cri/conf.d/hosts,lib/firmware,usr/local/share,usr/share/zoneinfo/Etc,mnt,system,opt,.extra}
672
    mkdir -pv /rootfs/{etc/kubernetes/manifests,etc/cni/net.d,usr/libexec/kubernetes,/usr/local/lib/kubelet/credentialproviders}
673
    mkdir -pv /rootfs/opt/{containerd/bin,containerd/lib}
674
END
675
COPY --chmod=0644 hack/zoneinfo/Etc/UTC /rootfs/usr/share/zoneinfo/Etc/UTC
676
COPY --chmod=0644 hack/nfsmount.conf /rootfs/etc/nfsmount.conf
677
COPY --chmod=0644 hack/containerd.toml /rootfs/etc/containerd/config.toml
678
COPY --chmod=0644 hack/cri-containerd.toml /rootfs/etc/cri/containerd.toml
679
COPY --chmod=0644 hack/cri-plugin.part /rootfs/etc/cri/conf.d/00-base.part
680
COPY --chmod=0644 hack/udevd/80-net-name-slot.rules /rootfs/usr/lib/udev/rules.d/
681
COPY --chmod=0644 hack/lvm.conf /rootfs/etc/lvm/lvm.conf
682
RUN <<END
683
    ln -s /usr/share/zoneinfo/Etc/UTC /rootfs/etc/localtime
684
    touch /rootfs/etc/{extensions.yaml,resolv.conf,hosts,os-release,machine-id,cri/conf.d/cri.toml,cri/conf.d/01-registries.part,cri/conf.d/20-customization.part}
685
    ln -s /etc/ssl /rootfs/etc/pki
686
    ln -s ca-certificates /rootfs/etc/ssl/certs/ca-certificates.crt
687
    ln -s /etc/ssl /rootfs/usr/share/ca-certificates
688
    ln -s /etc/ssl /rootfs/usr/local/share/ca-certificates
689
    ln -s /etc/ssl /rootfs/etc/ca-certificates
690
END
691

692
FROM rootfs-base-${TARGETARCH} AS rootfs-base
693
RUN find /rootfs -print0 \
694
    | xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
695

696
FROM rootfs-base-arm64 AS rootfs-squashfs-arm64
697
ARG ZSTD_COMPRESSION_LEVEL
698
RUN find /rootfs -print0 \
699
    | xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
700
RUN mksquashfs /rootfs /rootfs.sqsh -all-root -noappend -comp zstd -Xcompression-level ${ZSTD_COMPRESSION_LEVEL} -no-progress
701

702
FROM rootfs-base-amd64 AS rootfs-squashfs-amd64
703
ARG ZSTD_COMPRESSION_LEVEL
704
RUN find /rootfs -print0 \
705
    | xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
706
RUN mksquashfs /rootfs /rootfs.sqsh -all-root -noappend -comp zstd -Xcompression-level ${ZSTD_COMPRESSION_LEVEL} -no-progress
707

708
FROM scratch AS squashfs-arm64
709
COPY --from=rootfs-squashfs-arm64 /rootfs.sqsh /
710

711
FROM scratch AS squashfs-amd64
712
COPY --from=rootfs-squashfs-amd64 /rootfs.sqsh /
713

714
FROM scratch AS rootfs
715
COPY --from=rootfs-base /rootfs /
716

717
# The initramfs target provides the Talos initramfs image.
718

719
FROM build AS initramfs-archive-arm64
720
WORKDIR /initramfs
721
ARG ZSTD_COMPRESSION_LEVEL
722
COPY --from=squashfs-arm64 /rootfs.sqsh .
723
COPY --from=init-build-arm64 /init .
724
RUN find . -print0 \
725
    | xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
726
RUN set -o pipefail \
727
    && find . 2>/dev/null \
728
    | LC_ALL=c sort \
729
    | cpio --reproducible -H newc -o \
730
    | zstd -c -T0 -${ZSTD_COMPRESSION_LEVEL} \
731
    > /initramfs.xz
732

733
FROM build AS initramfs-archive-amd64
734
WORKDIR /initramfs
735
ARG ZSTD_COMPRESSION_LEVEL
736
COPY --from=squashfs-amd64 /rootfs.sqsh .
737
COPY --from=init-build-amd64 /init .
738
RUN find . -print0 \
739
    | xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
740
RUN set -o pipefail \
741
    && find . 2>/dev/null \
742
    | LC_ALL=c sort \
743
    | cpio --reproducible -H newc -o \
744
    | zstd -c -T0 -${ZSTD_COMPRESSION_LEVEL} \
745
    > /initramfs.xz
746

747
FROM initramfs-archive-${TARGETARCH} AS initramfs-archive
748

749
FROM scratch AS initramfs
750
ARG TARGETARCH
751
COPY --from=initramfs-archive /initramfs.xz /initramfs-${TARGETARCH}.xz
752

753
# The talos target generates a docker image that can be used to run Talos
754
# in containers.
755

756
FROM scratch AS talos
757
COPY --from=rootfs / /
758
LABEL org.opencontainers.image.source https://github.com/siderolabs/talos
759
ENTRYPOINT ["/sbin/init"]
760

761
# The installer target generates an image that can be used to install Talos to
762
# various environments.
763
FROM base AS installer-build
764
ARG GO_BUILDFLAGS
765
ARG GO_LDFLAGS
766
WORKDIR /src/cmd/installer
767
ARG TARGETARCH
768
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=${TARGETARCH} go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS}" -o /installer
769
RUN chmod +x /installer
770

771
FROM alpine:3.18.4 AS unicode-pf2
772
RUN apk add --no-cache --update --no-scripts grub
773

774
FROM scratch AS install-artifacts-amd64
775
COPY --from=pkg-kernel-amd64 /boot/vmlinuz /usr/install/amd64/vmlinuz
776
COPY --from=initramfs-archive-amd64 /initramfs.xz /usr/install/amd64/initramfs.xz
777
COPY --from=pkg-sd-boot-amd64 /linuxx64.efi.stub /usr/install/amd64/systemd-stub.efi
778
COPY --from=pkg-sd-boot-amd64 /systemd-bootx64.efi /usr/install/amd64/systemd-boot.efi
779

780
FROM scratch AS install-artifacts-arm64
781
COPY --from=pkg-kernel-arm64 /boot/vmlinuz /usr/install/arm64/vmlinuz
782
COPY --from=initramfs-archive-arm64 /initramfs.xz /usr/install/arm64/initramfs.xz
783
COPY --from=pkg-sd-boot-arm64 /linuxaa64.efi.stub /usr/install/arm64/systemd-stub.efi
784
COPY --from=pkg-sd-boot-arm64 /systemd-bootaa64.efi /usr/install/arm64/systemd-boot.efi
785

786
FROM scratch AS install-artifacts-all
787
COPY --from=install-artifacts-amd64 / /
788
COPY --from=install-artifacts-arm64 / /
789

790
FROM install-artifacts-${TARGETARCH} AS install-artifacts-targetarch
791

792
FROM install-artifacts-${INSTALLER_ARCH} AS install-artifacts
793

794
FROM alpine:3.18.4 AS installer-image
795
ARG SOURCE_DATE_EPOCH
796
ENV SOURCE_DATE_EPOCH ${SOURCE_DATE_EPOCH}
797
RUN apk add --no-cache --update --no-scripts \
798
    bash \
799
    binutils-aarch64 \
800
    binutils-x86_64 \
801
    cpio \
802
    dosfstools \
803
    efibootmgr \
804
    kmod \
805
    mtools \
806
    pigz \
807
    qemu-img \
808
    squashfs-tools \
809
    tar \
810
    util-linux \
811
    xfsprogs \
812
    xorriso \
813
    xz \
814
    zstd
815
ARG TARGETARCH
816
ENV TARGETARCH ${TARGETARCH}
817
COPY --from=installer-build /installer /bin/installer
818
COPY --chmod=0644 hack/extra-modules.conf /etc/modules.d/10-extra-modules.conf
819
COPY --from=pkg-grub / /
820
COPY --from=pkg-grub-arm64 /usr/lib/grub /usr/lib/grub
821
COPY --from=pkg-grub-amd64 /usr/lib/grub /usr/lib/grub
822
COPY --from=unicode-pf2 /usr/share/grub/unicode.pf2 /usr/share/grub/unicode.pf2
823
RUN ln /bin/installer /bin/imager
824
RUN find /bin /etc /lib /usr /sbin | grep -Ev '/etc/hosts|/etc/resolv.conf' \
825
    | xargs -r touch --date="@${SOURCE_DATE_EPOCH}" --no-dereference
826

827
FROM scratch AS installer-image-squashed
828
COPY --from=installer-image / /
829
ARG TAG
830
ENV VERSION ${TAG}
831
LABEL "alpha.talos.dev/version"="${VERSION}"
832
LABEL org.opencontainers.image.source https://github.com/siderolabs/talos
833
ENTRYPOINT ["/bin/installer"]
834

835
FROM installer-image-squashed AS installer
836
COPY --from=install-artifacts / /
837

838
FROM installer-image-squashed AS imager
839
COPY --from=install-artifacts / /
840
ENTRYPOINT ["/bin/imager"]
841

842
FROM imager AS iso-amd64-build
843
ARG SOURCE_DATE_EPOCH
844
ENV SOURCE_DATE_EPOCH ${SOURCE_DATE_EPOCH}
845
RUN /bin/installer \
846
    iso \
847
    --arch amd64 \
848
    --output /out
849

850
FROM imager AS iso-arm64-build
851
ARG SOURCE_DATE_EPOCH
852
ENV SOURCE_DATE_EPOCH ${SOURCE_DATE_EPOCH}
853
RUN /bin/installer \
854
    iso \
855
    --arch arm64 \
856
    --output /out
857

858
FROM scratch AS iso-amd64
859
COPY --from=iso-amd64-build /out /
860

861
FROM scratch AS iso-arm64
862
COPY --from=iso-arm64-build /out /
863

864
FROM --platform=${BUILDPLATFORM} iso-${TARGETARCH} AS iso
865

866
# The test target performs tests on the source code.
867
FROM base AS unit-tests-runner
868
RUN unlink /etc/ssl
869
COPY --from=rootfs / /
870
ARG TESTPKGS
871
ENV PLATFORM container
872
ARG GO_LDFLAGS
873
RUN --security=insecure --mount=type=cache,id=testspace,target=/tmp --mount=type=cache,target=/.cache go test -failfast -v \
874
    -ldflags "${GO_LDFLAGS}" \
875
    -covermode=atomic -coverprofile=coverage.txt -coverpkg=${TESTPKGS} -count 1 -p 4 ${TESTPKGS}
876
FROM scratch AS unit-tests
877
COPY --from=unit-tests-runner /src/coverage.txt /coverage.txt
878

879
# The unit-tests-race target performs tests with race detector.
880

881
FROM base AS unit-tests-race
882
RUN unlink /etc/ssl
883
COPY --from=rootfs / /
884
ARG TESTPKGS
885
ENV PLATFORM container
886
ENV CGO_ENABLED 1
887
ARG GO_LDFLAGS
888
RUN --security=insecure --mount=type=cache,id=testspace,target=/tmp --mount=type=cache,target=/.cache go test -v \
889
    -ldflags "${GO_LDFLAGS}" \
890
    -race -count 1 -p 4 ${TESTPKGS}
891

892
# The integration-test targets builds integration test binary.
893

894
FROM base AS integration-test-linux-build
895
ARG GO_BUILDFLAGS
896
ARG GO_LDFLAGS
897
ARG GOAMD64
898
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=amd64 GOAMD64=${GOAMD64} go test -v -c ${GO_BUILDFLAGS} \
899
    -ldflags "${GO_LDFLAGS}" \
900
    -tags integration,integration_api,integration_cli,integration_k8s \
901
    ./internal/integration
902

903
FROM scratch AS integration-test-linux
904
COPY --from=integration-test-linux-build /src/integration.test /integration-test-linux-amd64
905

906
FROM base AS integration-test-darwin-build
907
ARG GO_BUILDFLAGS
908
ARG GO_LDFLAGS
909
ARG GOAMD64
910
RUN --mount=type=cache,target=/.cache GOOS=darwin GOARCH=amd64 GOAMD64=${GOAMD64} go test -v -c ${GO_BUILDFLAGS} \
911
    -ldflags "${GO_LDFLAGS}" \
912
    -tags integration,integration_api,integration_cli,integration_k8s \
913
    ./internal/integration
914

915
FROM scratch AS integration-test-darwin
916
COPY --from=integration-test-darwin-build /src/integration.test /integration-test-darwin-amd64
917

918
# The integration-test-provision target builds integration test binary with provisioning tests.
919

920
FROM base AS integration-test-provision-linux-build
921
ARG GO_BUILDFLAGS
922
ARG GO_LDFLAGS
923
ARG GOAMD64
924
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=amd64 GOAMD64=${GOAMD64} go test -v -c ${GO_BUILDFLAGS} \
925
    -ldflags "${GO_LDFLAGS}" \
926
    -tags integration,integration_provision \
927
    ./internal/integration
928

929
FROM scratch AS integration-test-provision-linux
930
COPY --from=integration-test-provision-linux-build /src/integration.test /integration-test-provision-linux-amd64
931

932
# The module-sig-verify targets builds module-sig-verify binary.
933
FROM build-go AS module-sig-verify-linux-build
934
ARG GO_BUILDFLAGS
935
ARG GO_LDFLAGS
936
ARG GOAMD64
937
WORKDIR /src/module-sig-verify
938
COPY ./hack/module-sig-verify/go.mod ./hack/module-sig-verify/go.sum ./
939
RUN --mount=type=cache,target=/.cache go mod download
940
COPY ./hack/module-sig-verify/main.go .
941
RUN --mount=type=cache,target=/.cache GOOS=linux GOARCH=amd64 GOAMD64=${GOAMD64} go build -o module-sig-verify .
942

943
FROM scratch AS module-sig-verify-linux
944
COPY --from=module-sig-verify-linux-build /src/module-sig-verify/module-sig-verify /module-sig-verify-linux-amd64
945

946
# The lint target performs linting on the source code.
947
FROM base AS lint-go
948
COPY .golangci.yml .
949
ENV GOGC=50
950
ENV GOLANGCI_LINT_CACHE=/.cache/lint
951
RUN golangci-lint config verify --config .golangci.yml
952
RUN --mount=type=cache,target=/.cache golangci-lint run --config .golangci.yml
953
WORKDIR /src/pkg/machinery
954
RUN --mount=type=cache,target=/.cache golangci-lint run --config ../../.golangci.yml
955
COPY ./hack/cloud-image-uploader /src/hack/cloud-image-uploader
956
WORKDIR /src/hack/cloud-image-uploader
957
RUN --mount=type=cache,target=/.cache golangci-lint run --config ../../.golangci.yml
958
WORKDIR /src
959
RUN --mount=type=cache,target=/.cache importvet github.com/siderolabs/talos/...
960

961
# The protolint target performs linting on protobuf files.
962

963
FROM base AS lint-protobuf
964
WORKDIR /src/api
965
COPY api .
966
RUN --mount=type=cache,target=/.cache prototool lint --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
967
RUN --mount=type=cache,target=/.cache prototool break check --descriptor-set-path=api.descriptors --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
968

969
# The markdownlint target performs linting on Markdown files.
970

971
FROM oven/bun:1-alpine AS lint-markdown
972
ARG MARKDOWNLINTCLI_VERSION
973
ARG TEXTLINT_VERSION
974
ARG TEXTLINT_FILTER_RULE_COMMENTS_VERSION
975
ARG TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION
976
RUN apk add --no-cache findutils
977
RUN bun i -g markdownlint-cli@${MARKDOWNLINTCLI_VERSION} textlint@${TEXTLINT_VERSION} textlint-filter-rule-comments@${TEXTLINT_FILTER_RULE_COMMENTS_VERSION} textlint-rule-one-sentence-per-line@${TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION}
978
WORKDIR /src
979
COPY . .
980
RUN bun run --bun markdownlint \
981
    --ignore '**/LICENCE.md' \
982
    --ignore '**/CHANGELOG.md' \
983
    --ignore '**/CODE_OF_CONDUCT.md' \
984
    --ignore '**/node_modules/**' \
985
    --ignore '**/hack/chglog/**' \
986
    --ignore 'website/content/*/reference/*' \
987
    --ignore 'website/themes/**' \
988
    --disable MD045 MD056 -- \
989
    .
990
RUN find . \
991
    -name '*.md' \
992
    -not -path './LICENCE.md' \
993
    -not -path './CHANGELOG.md' \
994
    -not -path './CODE_OF_CONDUCT.md' \
995
    -not -path '*/node_modules/*' \
996
    -not -path './hack/chglog/**' \
997
    -not -path './website/content/*/reference/*' \
998
    -not -path './website/themes/**' \
999
    -print0 \
1000
    | xargs -0 bun run --bun textlint
1001

1002
# The docs target generates documentation.
1003

1004
FROM base AS docs-build
1005
ARG TARGETOS
1006
ARG TARGETARCH
1007
WORKDIR /src
1008
COPY --from=talosctl-targetarch /talosctl-${TARGETOS}-${TARGETARCH} /bin/talosctl
1009
RUN env HOME=/home/user TAG=latest /bin/talosctl docs --config /tmp/configuration \
1010
    && env HOME=/home/user TAG=latest /bin/talosctl docs --cli /tmp
1011
COPY ./pkg/machinery/config/schemas/*.schema.json /tmp/schemas/
1012

1013
FROM pseudomuto/protoc-gen-doc AS proto-docs-build
1014
COPY --from=generate-build /api /protos
1015
COPY ./hack/protoc-gen-doc/markdown.tmpl /tmp/markdown.tmpl
1016
RUN protoc \
1017
    -I/protos \
1018
    -I/protos/common \
1019
    -I/protos/resource/definitions \
1020
    -I/protos/inspect \
1021
    -I/protos/machine \
1022
    -I/protos/resource \
1023
    -I/protos/security \
1024
    -I/protos/storage \
1025
    -I/protos/time \
1026
    -I/protos/vendor \
1027
    --doc_opt=/tmp/markdown.tmpl,api.md \
1028
    --doc_out=/tmp \
1029
    /protos/common/*.proto \
1030
    /protos/resource/definitions/**/*.proto \
1031
    /protos/inspect/*.proto \
1032
    /protos/machine/*.proto \
1033
    /protos/security/*.proto \
1034
    /protos/storage/*.proto \
1035
    /protos/time/*.proto
1036

1037
FROM scratch AS docs
1038
COPY --from=docs-build /tmp/configuration/ /website/content/v1.8/reference/configuration/
1039
COPY --from=docs-build /tmp/cli.md /website/content/v1.8/reference/
1040
COPY --from=docs-build /tmp/schemas /website/content/v1.8/schemas/
1041
COPY --from=proto-docs-build /tmp/api.md /website/content/v1.8/reference/
1042

1043
# The talosctl-cni-bundle builds the CNI bundle for talosctl.
1044

1045
FROM scratch AS talosctl-cni-bundle
1046
ARG TARGETARCH
1047
COPY --from=extras-talosctl-cni-bundle-install /opt/cni/bin/ /talosctl-cni-bundle-${TARGETARCH}/
1048

1049
# The go-mod-outdated target lists all outdated modules.
1050

1051
FROM base AS go-mod-outdated
1052
RUN --mount=type=cache,target=/.cache go install github.com/psampaz/go-mod-outdated@latest \
1053
    && mv /go/bin/go-mod-outdated /toolchain/go/bin/go-mod-outdated
1054
COPY ./hack/cloud-image-uploader ./hack/cloud-image-uploader
1055
COPY ./hack/docgen ./hack/docgen
1056
COPY ./hack/gotagsrewrite ./hack/gotagsrewrite
1057
COPY ./hack/module-sig-verify ./hack/module-sig-verify
1058
COPY ./hack/structprotogen ./hack/structprotogen
1059
# fail always to get the output back
1060
RUN --mount=type=cache,target=/.cache <<EOF
1061
    for project in pkg/machinery . hack/cloud-image-uploader hack/docgen hack/gotagsrewrite hack/module-sig-verify hack/structprotogen; do
1062
        echo -e "\n>>>> ${project}:" && \
1063
        (cd "${project}" && go list -u -m -json all | go-mod-outdated -update -direct)
1064
    done
1065

1066
    exit 1
1067
EOF
1068