From 6fa4e15d2ec4d234458b9bd3e6f9bb4ce5b89638 Mon Sep 17 00:00:00 2001 From: husp Date: Mon, 3 Aug 2026 11:57:11 +0000 Subject: [PATCH] build: forward proxy settings into the container image builds The `--setup-only` layer downloads regctl, firecracker, the kernel, the overlaybd package and the tools image, which is the slowest part of a cold build behind a restricted network. Forward the caller's proxy environment into every build stage from both `make k8s-build` and docker compose, and enable reqwest's socks feature so socks5:// proxy variables are honoured rather than silently ignored. The proxy variables are passed as predefined BuildKit build args, so they reach every stage without an ARG declaration and stay out of the image environment, docker history and the layer cache key. Unset variables expand to nothing and leave the build commands unchanged. --- Cargo.toml | 4 +++- Makefile | 23 ++++++++++++++++++++--- deploy/docker-compose.yml | 6 ++++++ deploy/docker/Dockerfile.agentenv | 8 +++++++- 4 files changed, 36 insertions(+), 5 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index b833138d..8ca676b3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -42,7 +42,9 @@ firecracker_client = { version = "1.15.1", path = "thirdparty/firecracker-client envd = { version = "0.1.0", path = "thirdparty/envd" } custom_extension_client = { version = "0.1.0", path = "src/custom_extension_api/generated" } tokio = { version = "1", features = ["full"] } -reqwest = { version = "0.13", features = ["json", "stream"] } +# `socks` lets dependency downloads honour socks5:// values in the standard +# proxy environment variables; without it reqwest silently ignores them. +reqwest = { version = "0.13", features = ["json", "stream", "socks"] } opendal = { version = "0.55.0", features = ["services-s3"] } object-store-operator = { path = "crates/object-store-operator" } hyper = { version = "1", features = ["full"] } diff --git a/Makefile b/Makefile index 116b30c0..92ee8c34 100644 --- a/Makefile +++ b/Makefile @@ -15,6 +15,23 @@ K8S_GATEWAY_IMAGE ?= agentenv-gateway:latest K8S_SCHEDULER_IMAGE ?= agentenv-scheduler:latest K3S_CTR ?= sudo k3s ctr +# Optional build-time proxy for the image builds. The `--setup-only` layer of +# Dockerfile.agentenv downloads regctl, firecracker, the kernel, the overlaybd +# package and the ghcr.io tools image, which is the slowest part of a cold +# build behind a restricted network. Export HTTPS_PROXY (socks5:// is +# supported) before `make k8s-build` and it is forwarded to every stage. +HTTP_PROXY ?= $(http_proxy) +HTTPS_PROXY ?= $(https_proxy) +ALL_PROXY ?= $(all_proxy) +NO_PROXY ?= $(no_proxy) +# Both cases are passed because Go and Rust HTTP clients differ in which +# spelling they look up. +DOCKER_PROXY_ARGS := \ + $(if $(HTTP_PROXY),--build-arg HTTP_PROXY="$(HTTP_PROXY)" --build-arg http_proxy="$(HTTP_PROXY)",) \ + $(if $(HTTPS_PROXY),--build-arg HTTPS_PROXY="$(HTTPS_PROXY)" --build-arg https_proxy="$(HTTPS_PROXY)",) \ + $(if $(ALL_PROXY),--build-arg ALL_PROXY="$(ALL_PROXY)" --build-arg all_proxy="$(ALL_PROXY)",) \ + $(if $(NO_PROXY),--build-arg NO_PROXY="$(NO_PROXY)" --build-arg no_proxy="$(NO_PROXY)",) + # aenv home path. AENV_HOME_PATH ?= /var/lib/aenv export AENV_HOME_PATH @@ -234,9 +251,9 @@ deploy-ps: $(DOCKER_COMPOSE) -f $(DEPLOY_COMPOSE_FILE) ps k8s-build: - $(DOCKER) build $(if $(APT_MIRROR_BASE),--build-arg APT_MIRROR_BASE="$(APT_MIRROR_BASE)",) -f deploy/docker/Dockerfile.agentenv -t $(K8S_RUNTIME_IMAGE) . - $(DOCKER) build -f deploy/docker/Dockerfile.gateway -t $(K8S_GATEWAY_IMAGE) . - $(DOCKER) build -f deploy/docker/Dockerfile.scheduler -t $(K8S_SCHEDULER_IMAGE) . + $(DOCKER) build $(if $(APT_MIRROR_BASE),--build-arg APT_MIRROR_BASE="$(APT_MIRROR_BASE)",) $(DOCKER_PROXY_ARGS) -f deploy/docker/Dockerfile.agentenv -t $(K8S_RUNTIME_IMAGE) . + $(DOCKER) build $(DOCKER_PROXY_ARGS) -f deploy/docker/Dockerfile.gateway -t $(K8S_GATEWAY_IMAGE) . + $(DOCKER) build $(DOCKER_PROXY_ARGS) -f deploy/docker/Dockerfile.scheduler -t $(K8S_SCHEDULER_IMAGE) . k8s-redeploy: $(KUBECTL) rollout restart deploy/agentenv-gateway -n $(K8S_NAMESPACE) diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index f87621ef..a7e50702 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -84,6 +84,12 @@ services: dockerfile: deploy/docker/Dockerfile.agentenv args: APT_MIRROR_BASE: ${APT_MIRROR_BASE:-} + # Forwarded from the caller's shell so the `--setup-only` dependency + # downloads can use a proxy; empty values are ignored by BuildKit. + HTTP_PROXY: ${HTTP_PROXY:-${http_proxy:-}} + HTTPS_PROXY: ${HTTPS_PROXY:-${https_proxy:-}} + ALL_PROXY: ${ALL_PROXY:-${all_proxy:-}} + NO_PROXY: ${NO_PROXY:-${no_proxy:-}} container_name: agentenv-a environment: <<: *agentenv-environment diff --git a/deploy/docker/Dockerfile.agentenv b/deploy/docker/Dockerfile.agentenv index e6128cfa..f32d7092 100644 --- a/deploy/docker/Dockerfile.agentenv +++ b/deploy/docker/Dockerfile.agentenv @@ -1,7 +1,13 @@ # syntax=docker/dockerfile:1.7 FROM rust:1-bookworm AS chef - +# HTTP_PROXY/HTTPS_PROXY/ALL_PROXY/NO_PROXY are predefined BuildKit build args: +# passing them with `--build-arg` makes them available to every stage's `RUN` +# without an `ARG` declaration, and keeps them out of the image environment, +# `docker history`, and the layer cache key. `make k8s-build` forwards whatever +# is exported in the caller's shell. Declaring them here instead would scope +# them to this stage only, leaving the `--setup-only` dependency downloads in +# `deps-stage` on a direct connection. WORKDIR /build ENV CARGO_TARGET_DIR=/build/target ENV RUSTUP_TOOLCHAIN=${RUST_VERSION}