Skip to content

build: forward proxy settings into the container image builds #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cleverhu wants to merge 1 commit into
base: main
Choose a base branch
from
+36 −5
Open

build: forward proxy settings into the container image builds #113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@ firecracker_client = { version = "1.15.1", path = "thirdparty/firecracker-client
envd = { version = "0.1.0", path = "thirdparty/envd" }
custom_extension_client = { version = "0.1.0", path = "src/custom_extension_api/generated" }
tokio = { version = "1", features = ["full"] }
reqwest = { version = "0.13", features = ["json", "stream"] }
# `socks` lets dependency downloads honour socks5:// values in the standard
# proxy environment variables; without it reqwest silently ignores them.
reqwest = { version = "0.13", features = ["json", "stream", "socks"] }

@github-actions github-actions Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[bug · high]
The committed Cargo.lock was not regenerated for this feature change: its reqwest 0.13.3 entry has no SOCKS dependency (such as tokio-socks). Consequently, reproducible/locked builds will reject the stale lockfile, while unlocked builds produce an uncommitted lockfile update. Run cargo update -p reqwest@0.13.3 (or cargo check) and stage the resulting Cargo.lock changes.

opendal = { version = "0.55.0", features = ["services-s3"] }
object-store-operator = { path = "crates/object-store-operator" }
hyper = { version = "1", features = ["full"] }
Expand Down
23 changes: 20 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,23 @@ K8S_GATEWAY_IMAGE ?= agentenv-gateway:latest
K8S_SCHEDULER_IMAGE ?= agentenv-scheduler:latest
K3S_CTR ?= sudo k3s ctr

# Optional build-time proxy for the image builds. The `--setup-only` layer of
# Dockerfile.agentenv downloads regctl, firecracker, the kernel, the overlaybd
# package and the ghcr.io tools image, which is the slowest part of a cold
# build behind a restricted network. Export HTTPS_PROXY (socks5:// is
# supported) before `make k8s-build` and it is forwarded to every stage.
HTTP_PROXY ?= $(http_proxy)
HTTPS_PROXY ?= $(https_proxy)
ALL_PROXY ?= $(all_proxy)
NO_PROXY ?= $(no_proxy)
# Both cases are passed because Go and Rust HTTP clients differ in which
# spelling they look up.
DOCKER_PROXY_ARGS := \
$(if $(HTTP_PROXY),--build-arg HTTP_PROXY="$(HTTP_PROXY)" --build-arg http_proxy="$(HTTP_PROXY)",) \
$(if $(HTTPS_PROXY),--build-arg HTTPS_PROXY="$(HTTPS_PROXY)" --build-arg https_proxy="$(HTTPS_PROXY)",) \
$(if $(ALL_PROXY),--build-arg ALL_PROXY="$(ALL_PROXY)" --build-arg all_proxy="$(ALL_PROXY)",) \
$(if $(NO_PROXY),--build-arg NO_PROXY="$(NO_PROXY)" --build-arg no_proxy="$(NO_PROXY)",)
Comment on lines +29 to +33

@github-actions github-actions Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[security · medium]
Proxy URLs commonly contain credentials. Expanding their values directly into the recipe causes make to echo those credentials into terminal/CI logs, and also exposes them in the docker build process arguments. Export the upper/lower-case proxy variables and use valueless options such as --build-arg HTTPS_PROXY --build-arg https_proxy; Docker will read their values from the client environment without placing them in the displayed command line. Merely prefixing the recipe with @ would address logs but not process-argument exposure.


# aenv home path.
AENV_HOME_PATH ?= /var/lib/aenv
export AENV_HOME_PATH
Expand Down Expand Up @@ -234,9 +251,9 @@ deploy-ps:
$(DOCKER_COMPOSE) -f $(DEPLOY_COMPOSE_FILE) ps

k8s-build:
$(DOCKER) build $(if $(APT_MIRROR_BASE),--build-arg APT_MIRROR_BASE="$(APT_MIRROR_BASE)",) -f deploy/docker/Dockerfile.agentenv -t $(K8S_RUNTIME_IMAGE) .
$(DOCKER) build -f deploy/docker/Dockerfile.gateway -t $(K8S_GATEWAY_IMAGE) .
$(DOCKER) build -f deploy/docker/Dockerfile.scheduler -t $(K8S_SCHEDULER_IMAGE) .
$(DOCKER) build $(if $(APT_MIRROR_BASE),--build-arg APT_MIRROR_BASE="$(APT_MIRROR_BASE)",) $(DOCKER_PROXY_ARGS) -f deploy/docker/Dockerfile.agentenv -t $(K8S_RUNTIME_IMAGE) .
$(DOCKER) build $(DOCKER_PROXY_ARGS) -f deploy/docker/Dockerfile.gateway -t $(K8S_GATEWAY_IMAGE) .
$(DOCKER) build $(DOCKER_PROXY_ARGS) -f deploy/docker/Dockerfile.scheduler -t $(K8S_SCHEDULER_IMAGE) .

k8s-redeploy:
$(KUBECTL) rollout restart deploy/agentenv-gateway -n $(K8S_NAMESPACE)
Expand Down
6 changes: 6 additions & 0 deletions deploy/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,12 @@ services:
dockerfile: deploy/docker/Dockerfile.agentenv
args:
APT_MIRROR_BASE: ${APT_MIRROR_BASE:-}
# Forwarded from the caller's shell so the `--setup-only` dependency
# downloads can use a proxy; empty values are ignored by BuildKit.
HTTP_PROXY: ${HTTP_PROXY:-${http_proxy:-}}
HTTPS_PROXY: ${HTTPS_PROXY:-${https_proxy:-}}
ALL_PROXY: ${ALL_PROXY:-${all_proxy:-}}
NO_PROXY: ${NO_PROXY:-${no_proxy:-}}
container_name: agentenv-a
environment:
<<: *agentenv-environment
Expand Down
8 changes: 7 additions & 1 deletion deploy/docker/Dockerfile.agentenv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,13 @@
# syntax=docker/dockerfile:1.7

FROM rust:1-bookworm AS chef

# HTTP_PROXY/HTTPS_PROXY/ALL_PROXY/NO_PROXY are predefined BuildKit build args:
# passing them with `--build-arg` makes them available to every stage's `RUN`
# without an `ARG` declaration, and keeps them out of the image environment,
# `docker history`, and the layer cache key. `make k8s-build` forwards whatever
# is exported in the caller's shell. Declaring them here instead would scope
# them to this stage only, leaving the `--setup-only` dependency downloads in
# `deps-stage` on a direct connection.
WORKDIR /build
ENV CARGO_TARGET_DIR=/build/target
ENV RUSTUP_TOOLCHAIN=${RUST_VERSION}
Expand Down
Loading