497e703e70Keep credentials and network access behind authenticated, audited brokers while binding launch adapters, immutable closures, recovery identities, receipts, and cleanup to the approved plan. Add Apple Container and Linux release lanes without weakening the outer sandbox.
64 lines
2.9 KiB
Text
64 lines
2.9 KiB
Text
# Linux build + test image for glove.
|
|
#
|
|
# Used to validate Linux compilation and the portable test surface from a
|
|
# macOS host (Docker Desktop / colima / Apple's `container` CLI). The image
|
|
# installs libseccomp and a recent clang + libc++, builds glove with the `asan`
|
|
# preset, and runs the test suite inside the container.
|
|
#
|
|
# Run from the repo root:
|
|
# docker build -f dockerfiles/Dockerfile.linux -t glove-linux .
|
|
# docker run --rm --privileged --security-opt seccomp=unconfined glove-linux
|
|
#
|
|
# `seccomp=unconfined` is needed because Docker's default seccomp profile
|
|
# blocks the `clone3(2)` syscall, which the Phase 5.4 spawner uses to create
|
|
# its user/mount/pid/net/ipc/uts namespaces. `--privileged` (or at minimum
|
|
# `--cap-add=SYS_ADMIN`) is needed because Phase 5.5 calls `pivot_root` and
|
|
# bind-mounts a minimal rootfs into a fresh tmpfs. Production deployments
|
|
# can run glove directly on the Linux host (no nested containerisation) and
|
|
# need only the host kernel's standard rootless-userns surface.
|
|
#
|
|
# Apple's runtime places this image in a lightweight VM. Its default kernel
|
|
# currently rejects procfs mounts from Glove's nested child user namespace, so
|
|
# use scripts/apple-container-parity.sh there. That harness separates portable
|
|
# Linux evidence from outer-VM perimeter evidence and does not claim the nested
|
|
# Linux-production backend passed.
|
|
|
|
FROM ubuntu:24.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
clang-18 clang-format-18 clang-tidy-18 lld-18 llvm-18 \
|
|
libclang-rt-18-dev \
|
|
cmake ninja-build pkg-config \
|
|
libc++-18-dev libc++abi-18-dev \
|
|
libseccomp-dev \
|
|
git curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Make clang-18 the default compiler. Symlinks keep `clang` and friends on
|
|
# PATH so CMake's auto-detection works without per-step CC/CXX overrides.
|
|
RUN ln -sf /usr/bin/clang-18 /usr/local/bin/clang \
|
|
&& ln -sf /usr/bin/clang++-18 /usr/local/bin/clang++ \
|
|
&& ln -sf /usr/bin/clang-format-18 /usr/local/bin/clang-format \
|
|
&& ln -sf /usr/bin/clang-tidy-18 /usr/local/bin/clang-tidy \
|
|
&& ln -sf /usr/bin/llvm-ar-18 /usr/local/bin/llvm-ar \
|
|
&& ln -sf /usr/bin/llvm-ranlib-18 /usr/local/bin/llvm-ranlib
|
|
|
|
ENV CC=clang
|
|
ENV CXX=clang++
|
|
ENV CXXFLAGS="-stdlib=libc++"
|
|
ENV LDFLAGS="-stdlib=libc++ -fuse-ld=lld"
|
|
|
|
WORKDIR /glove
|
|
COPY . .
|
|
|
|
# Configure + build under the asan preset. Tests under TSan are gated by a
|
|
# follow-up step in CI — keeps the local Docker iteration fast.
|
|
RUN cmake --preset asan && cmake --build --preset asan
|
|
|
|
# CTest runs with a parent process in the container cgroup, so the cgroup test
|
|
# correctly reports "not delegated" there. After the suite, `exec` replaces
|
|
# the shell as PID 1 and gives the enforcement test an exclusive delegated
|
|
# cgroup, matching the production service topology.
|
|
CMD ["bash", "-lc", "ctest --preset asan --output-on-failure && exec /glove/build/asan/tests/container_linux_cgroup_v2_test"]
|