Repository: scionproto/scion
Pull request #3438 (2019-11-29 07:35:54)

Build tester and sig_acceptance docker images with bazel
This makes running acceptance tests locally much easier since we can reuse stuff that is already build in bazel.
We no longer depend on the scion_base image for tester and sig_acceptance images, therefore we can get rid of the base image in the future, which will make CI faster.

<!-- Reviewable:start -->
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/scionproto/scion/3438)
<!-- Reviewable:end -->



Patch:
diff --git a/.buildkite/steps/build_all.yml b/.buildkite/steps/build_all.yml
index 9ba721711..c302430ca 100644
--- a/.buildkite/steps/build_all.yml
+++ b/.buildkite/steps/build_all.yml
@@ -6,9 +6,9 @@
   # docker.sh tester depends on scion:latest (needs to be tagged)
   - docker tag $SCION_IMG scion:latest
   - echo "$(date -u +"%F %T.%6N%z") Build perapp images"
-  - ./docker.sh run -c "mkdir docker/_build && touch docker/_build/scion.stamp && make -C docker/perapp app_builder apps"
+  - ./docker.sh run -c "mkdir docker/_build && touch docker/_build/scion.stamp && make -C docker/perapp apps"
   - echo "$(date -u +"%F %T.%6N%z") Build tester image"
-  - ./docker.sh tester
+  - ./docker.sh run -c "./docker.sh tester"
   - $BASE/scripts/all_images push
   - echo "$(date -u +"%F %T.%6N%z") All images pushed"
   artifact_paths:
diff --git a/WORKSPACE b/WORKSPACE
index 19eecfcfd..bb24bf5d5 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -104,6 +104,15 @@ dpkg_list(
         "netbase",
         "openssl",
         "tzdata",
+        # Needed by sig acceptance
+        # ping and its dependencies
+        "iputils-ping",
+        "libidn11",
+        "libnettle6",
+        # iproute2 and its dependencies
+        "iproute2",
+        "libelf1",
+        "libmnl0",
     ],
     sources = [
         "@debian_stretch_security//file:Packages.json",
@@ -150,6 +159,15 @@ dpkg_list(
     ],
 )
 
+load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
+
+container_pull(
+    name = "ubuntu16",
+    registry = "index.docker.io",
+    repository = "library/ubuntu",
+    tag = "16.04",
+)
+
 # su-exec (used in app docker images)
 git_repository(
     name = "com_github_anapaya_su_exec",
diff --git a/acceptance/lib.sh b/acceptance/lib.sh
index e9c6de670..400262a00 100644
--- a/acceptance/lib.sh
+++ b/acceptance/lib.sh
@@ -26,20 +26,12 @@ stop_infra() {
     ./scion.sh stop
 }
 
-build_docker_base() {
-    ./docker.sh base
-}
-
-build_docker_scion() {
-    ./docker.sh build
-}
-
 build_docker_tester() {
     ./docker.sh tester
 }
 
 build_docker_perapp() {
-    make -C docker/perapp
+    make -C docker/perapp bazel
 }
 
 artifacts_dir() {
@@ -58,13 +50,9 @@ global_setup() {
     find logs -mindepth 1 -maxdepth 1 -not -path '*/\.*' -exec rm -r {} +
     print_green "[-->-------]" "Building local code"
     run_command make ${out_dir:+$out_dir/global_setup_make.out}
-    print_green "[--->------]" "Building scion_base docker image"
-    run_command build_docker_base ${out_dir:+$out_dir/global_setup_docker_base.out}
-    print_green "[---->-----]" "Building scion docker image"
-    run_command build_docker_scion ${out_dir:+$out_dir/global_setup_docker_scion.out}
-    print_green "[----->----]" "Building per-app docker images"
+    print_green "[--->------]" "Building per-app docker images"
     run_command build_docker_perapp ${out_dir:+$out_dir/global_setup_docker_perapp.out}
-    print_green "[------>---]" "Building tester docker images"
+    print_green "[---->-----]" "Building tester docker images"
     run_command build_docker_tester ${out_dir:+$out_dir/global_setup_docker_scion.out}
     print_green "[>>>>>>>>>>]" "Global test environment set-up finished"
     set +e
diff --git a/docker.sh b/docker.sh
index 068ed9af5..1786a16dd 100755
--- a/docker.sh
+++ b/docker.sh
@@ -34,8 +34,8 @@ cmd_build() {
 
 cmd_tester() {
     set -eo pipefail
-    docker build -t "scion_tester:latest" - < docker/Dockerfile.tester
-    docker build -f docker/acceptance/sig/Dockerfile -t "scion_sig_acceptance:latest" docker/acceptance/sig
+    bazel run //docker/testimages:scion_testing_bundle
+    docker build -f "docker/testimages/Dockerfile.sig_accept" -t "scion_sig_acceptance" docker/testimages
 }
 
 copy_tree() {
diff --git a/docker/acceptance/sig/Dockerfile b/docker/acceptance/sig/Dockerfile
deleted file mode 100644
index 964ded7dd..000000000
--- a/docker/acceptance/sig/Dockerfile
+++ /dev/null
@@ -1,12 +0,0 @@
-FROM ubuntu:16.04
-
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y libcap2-bin iputils-ping iproute2 && apt-get clean
-
-WORKDIR /share
-COPY sig.sh .
-RUN chmod +x sig.sh
-COPY --from=scion_app_builder:latest /sbin/su-exec /sbin/su-exec
-COPY --from=scion_app_builder:latest /home/scion/go/src/github.com/scionproto/scion/bin/sig /app/
-RUN ["setcap", "cap_net_admin+ei", "/app/sig"]
-# Note: this process needs explicit CAP_NET_ADMIN from docker. e.g. with `cap_add: NET_ADMIN` from docker-compose
-ENTRYPOINT ["./sig.sh"]
diff --git a/docker/acceptance/sig/sig.sh b/docker/testimages/sig.sh
similarity index 88%
rename from docker/acceptance/sig/sig.sh
rename to docker/testimages/sig.sh
index a405ba59f..9a3e4d320 100644
--- a/docker/acceptance/sig/sig.sh
+++ b/docker/testimages/sig.sh
@@ -13,4 +13,4 @@ for net in $(echo $1 | tr , ' '); do
 done
 
 shift
-/sbin/su-exec /app/sig -config conf/sig.toml
+exec /sbin/su-exec /app/sig -config conf/sig.toml
diff --git a/docker/tester.sh b/docker/testimages/tester.sh
similarity index 100%
rename from docker/tester.sh
rename to docker/testimages/tester.sh
diff --git a/integration/BUILD.bazel b/integration/BUILD.bazel
new file mode 100644
index 000000000..2d5c046e2
--- /dev/null
+++ b/integration/BUILD.bazel
@@ -0,0 +1,5 @@
+filegroup(
+    name = "bin_wrapper_script",
+    srcs = ["bin_wrapper.sh"],
+    visibility = ["//visibility:public"],
+)
diff --git a/python/topology/docker_utils.py b/python/topology/docker_utils.py
index 25213a0a6..889c43921 100644
--- a/python/topology/docker_utils.py
+++ b/python/topology/docker_utils.py
@@ -1,4 +1,5 @@
 # Copyright 2018 ETH Zurich
+# Copyright 2019 ETH Zurich, Anapaya Systems
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -73,7 +74,7 @@ class DockerUtilsGenerator(object):
 
     def _test_conf(self, topo_id):
         docker = 'docker_' if self.args.in_docker else ''
-        cntr_base = '/home/scion/go/src/github.com/scionproto/scion'
+        cntr_base = '/share'
         name = 'tester_%s' % topo_id.file_fmt()
         entry = {
             'image': docker_image(self.args, 'tester'),
diff --git a/tools/dc b/tools/dc
index c41df7f18..4343d9824 100755
--- a/tools/dc
+++ b/tools/dc
@@ -103,7 +103,7 @@ exec_tester() {
     local service="tester_$1"
     shift
     service_running "$service" || cmd_start "$service" &>/dev/null
-    cmd_scion exec -T -u scion "$service" bash -l -c "$*"
+    cmd_scion exec -T "$service" bash -l -c "$*"
 }
 
 glob_docker() {


Test patch:
diff --git a/docker/Dockerfile.tester b/docker/Dockerfile.tester
deleted file mode 100644
index e8e5d78e6..000000000
--- a/docker/Dockerfile.tester
+++ /dev/null
@@ -1,9 +0,0 @@
-FROM scion:latest
-
-USER root
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y libcap2-bin net-tools iputils-ping iproute2 && apt-get clean
-
-COPY --from=scion_app_builder:latest $BASE/bin/* $BASE/bin/
-RUN cp $BASE/docker/tester.sh $BASE
-RUN chmod +x tester.sh
-CMD tail -f /dev/null
diff --git a/docker/testimages/BUILD.bazel b/docker/testimages/BUILD.bazel
new file mode 100644
index 000000000..f7409b562
--- /dev/null
+++ b/docker/testimages/BUILD.bazel
@@ -0,0 +1,132 @@
+load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
+load("@io_bazel_rules_docker//container:container.bzl", "container_image", "container_bundle")
+load("@package_bundle//file:packages.bzl", "packages")
+
+pkg_tar(
+    name = "app_base_files",
+    srcs = [
+        "@com_github_anapaya_su_exec//:su-exec",
+    ],
+    remap_paths = {
+        "": "sbin",
+    },
+    mode = "0755",
+)
+
+pkg_tar(
+    name = "sig_docker_files",
+    srcs = ["//go/sig:sig"],
+    package_dir = "/app",
+)
+
+filegroup(
+    name = "sig_entrypoint_files",
+    srcs = ["sig.sh"],
+)
+
+pkg_tar(
+    name = "sig_entrypoint",
+    srcs = [":sig_entrypoint_files"],
+    package_dir = "/share",
+)
+
+container_image(
+    name = "scion_sig_acceptance_nocap",
+    base = "@ubuntu16//image",
+    env = {"TZ": "UTC"},
+    debs = [
+        packages["libc6"],
+        # needed by su-exec
+        packages["libgcc1"],
+        packages["libstdc++6"],
+        # needed for sig.sh
+        # ping and its dependencies
+        packages["iputils-ping"],
+        packages["libidn11"],
+        packages["libnettle6"],
+        # iproute2 and its dependencies
+        packages["iproute2"],
+        packages["libelf1"],
+        packages["libmnl0"],
+    ],
+    tars = [
+        ":app_base_files",
+        ":sig_docker_files",
+        ":sig_entrypoint",
+
+    ],
+    stamp = True,
+    workdir = "/share",
+    entrypoint = ["./sig.sh"],
+)
+
+filegroup(
+    name = "tester_setup_script",
+    srcs = ["tester.sh"],
+)
+
+pkg_tar(
+    name = "tester_shared_scripts",
+    srcs = [
+        ":tester_setup_script",
+    ],
+    package_dir = "/share",
+)
+
+pkg_tar(
+    name = "tester_integration_scripts",
+    srcs = [
+        "//integration:bin_wrapper_script",
+    ],
+    package_dir = "/share/integration",
+)
+
+pkg_tar(
+    name = "tester_binaries",
+    srcs = [
+        "//go/integration/cert_req:cert_req",
+        "//go/integration/end2end:end2end",
+        "//go/examples/pingpong:pingpong",
+        "//go/tools/scmp:scmp",
+        "//go/tools/showpaths:showpaths",
+    ],
+    package_dir="/share/bin",
+)
+
+container_image(
+    name = "scion_tester",
+    base = "@ubuntu16//image",
+    env = {"TZ": "UTC"},
+    debs = [
+        packages["libc6"],
+        # needed by su-exec
+        packages["libgcc1"],
+        packages["libstdc++6"],
+        # needed for tester.sh
+        # ping and its dependencies
+        packages["iputils-ping"],
+        packages["libidn11"],
+        packages["libnettle6"],
+        # iproute2 and its dependencies
+        packages["iproute2"],
+        packages["libelf1"],
+        packages["libmnl0"],
+    ],
+    tars = [
+        ":app_base_files",
+        ":tester_shared_scripts",
+        ":tester_integration_scripts",
+        ":tester_binaries",
+    ],
+    stamp = True,
+    workdir = "/share",
+    cmd = "tail -f /dev/null"
+)
+
+container_bundle(
+    name = "scion_testing_bundle",
+    images = {
+        "scion_sig_acceptance_nocap:latest": ":scion_sig_acceptance_nocap",
+        "scion_tester:latest": ":scion_tester",
+    },
+)
diff --git a/docker/testimages/Dockerfile.sig_accept b/docker/testimages/Dockerfile.sig_accept
new file mode 100644
index 000000000..5c7157727
--- /dev/null
+++ b/docker/testimages/Dockerfile.sig_accept
@@ -0,0 +1,11 @@
+# Bazel doesn't have support for adding capabilities to binaries.
+# Instead, we create a layer on top of bazel-generated image that
+# adds the capabilities as needed.
+# For alternative ideas on how to solve this see:
+# https://github.com/bazelbuild/rules_docker/issues/752
+# NOTE: this process needs explicit CAP_NET_ADMIN from docker.
+# E.g. with `cap_add: NET_ADMIN` from docker-compose.
+FROM scionproto/docker-caps as caps
+FROM scion_sig_acceptance_nocap:latest
+COPY --from=caps /bin/setcap /bin
+RUN setcap cap_net_admin+ei /app/sig && rm /bin/setcap