Dockerfile

# ------------------------------ tabstop = 4 ----------------------------------
#
# If not stated otherwise in this file or this component's LICENSE file the
# following copyright and licenses apply:
#
# Copyright 2024 Comcast Cable Communications Management, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
#
# ------------------------------ tabstop = 4 ----------------------------------

#
# Created by Kevin Funderburg on 09/11/2024
#

###############################################################################
# Example workflow for building the image and pushing it to the GitHub Container
# Registry
#
# 1. Build the image:
#    `docker build -t ghcr.io/rdkcentral/barton_builder:some-tag .`
#
# 2. Authenticate with the GitHub Container Registry:
#    `echo $GITHUB_PAT | docker login ghcr.io -u $GITHUB_ACTOR --password-stdin`
#
#    where $GITHUB_PAT is your GitHub Personal Access Token and $GITHUB_ACTOR is
#    your GitHub username
#
# 3. Push the image to the GitHub Container Registry:
#    `docker push ghcr.io/rdkcentral/barton_builder:some-tag`
###############################################################################

###############################################################################
# base stage which provides a base image which has packages to support basic
# download functionality
###############################################################################
FROM ubuntu:24.04 AS base

# Delete the default ubuntu docker user: it can cause issues with user id 1000 on the host.
RUN touch /var/mail/ubuntu && chown ubuntu /var/mail/ubuntu && userdel -r ubuntu

RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND='noninteractive' apt-get install -y \
    build-essential \
    libarchive-tools \
    unzip \
    wget \
    zip \
    clang-18 \
    lld-18 \
    llvm-18

# Set LLVM/Clang as the default compiler over GCC
RUN update-alternatives --install /usr/bin/cc cc /usr/bin/clang-18 50 && \
    update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-18 50 && \
    update-alternatives --install /usr/bin/cc cc /usr/bin/gcc 30 && \
    update-alternatives --install /usr/bin/c++ c++ /usr/bin/g++ 30 && \
    update-alternatives --install /usr/bin/clang clang /usr/bin/clang-18 50 && \
    update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-18 50 && \
    update-alternatives --install /usr/bin/lld lld /usr/bin/lld-18 50 && \
    update-alternatives --install /usr/bin/llvm-ar llvm-ar /usr/bin/llvm-ar-18 50 && \
    update-alternatives --install /usr/bin/llvm-ranlib llvm-ranlib /usr/bin/llvm-ranlib-18 50

###############################################################################
# expands the base stage to allow for building of packages with common tools
###############################################################################
FROM base AS base_builder
RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND='noninteractive' apt-get install -y \
    autoconf \
    autoconf-archive \
    git \
    libtool \
    pkg-config \
    libsystemd-dev

###############################################################################
# Add support for Python including GObject introspection
###############################################################################
RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND='noninteractive' apt-get install -y \
    python3-full \
    python3-dev \
    python3-mako \
    python3-markdown \
    python3-pip \
    python3-venv \
    python3-jsonschema \
    python3-yaml \
    flex \
    bison \
    libglib2.0-dev \
    libcairo2-dev \
    libffi-dev \
    gtk-doc-tools \
    libgirepository1.0-dev

# Fix setuptools on v73. v74+ removed some distutils modules that breaks gobject introspection (among a lot of other projects)
# Fix pygobject-stubs to 2.14.0. 2.15.0+ requires libgirepository2.0 which requires some migration.
RUN pip3 install --upgrade --break-system-packages \
    pygobject==3.50.0 \
    pygobject-stubs==2.14.0 \
    setuptools==73.0.0 \
    python_stdnum \
    pytest

# pygobject-stubs distributed the stub (pyi) files for standard distribution girs, but we also want its tools so we can make
# out own stubs. Those don't come with the pip package.
RUN cd /tmp && \
    git clone https://github.com/pygobject/pygobject-stubs.git && \
    cd pygobject-stubs/tools && \
    git checkout v2.14.0 && \
    mkdir -p /usr/bin/pygobject-stubs && \
    cp generate.py /usr/bin/pygobject-stubs && \
    cp parse.py /usr/bin/pygobject-stubs && \
    rm -rf /tmp/pygobject-stubs

# Create a symlink for the versioned dist-packages directory so the container can determine
# the correct PYTHONPATH at runtime
RUN bash -c "set -o pipefail && \
    PYTHON_VERSION=$(python3 --version | awk '{print $2}' | awk -F. '{print $1"."$2}') && \
    mkdir -p /usr/local/lib/python3.x && \
    ln -s /usr/local/lib/python${PYTHON_VERSION}/dist-packages /usr/local/lib/python3.x/dist-packages"

###############################################################################
# Third party build stage
#
# This stage is responsible for building specific third-party libraries that
# need to be versioned precisely for the Barton image build. Since apt cannot
# be relied upon to provide the correct versions, these libraries must be built
# from source.
###############################################################################
FROM base_builder AS third_party_builder

ARG LINENOISE_GIT_TAG="d895173d679be70bcd8b23041fff3e458e1a3506"
ARG OTBR_GIT_TAG="e851c2a80fb036e6987bedac399184a729f638d4"
ARG FFF_GIT_TAG="5111c61e1ef7848e3afd3550044a8cf4405f4199"
ARG MQUICKJS_GIT_TAG="203d5bb79789bc47b74855d9207415dab71661a0"

# Copy over the third party patches
ADD patches /tmp/patches
ARG APPLY_PATCHES_PATH="/tmp/patches/applyPatches.sh"
# Make the apply patches script executable
RUN chmod +x ${APPLY_PATCHES_PATH}

RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND='noninteractive' apt-get install -y \
    lsb-release \
    ninja-build \
    sudo \
    jq \
    cmake \
    meson \
    libcjson-dev \
    libcmocka-dev \
    libgtest-dev \
    libgmock-dev \
    libssl-dev \
    libcurl4-openssl-dev \
    uuid-dev \
    libxml2-dev \
    libmbedtls-dev \
    libdbus-1-dev \
    libavahi-client-dev \
    libreadline-dev \
    checkinstall \
    zlib1g-dev \
    socat \
    libyaml-cpp-dev \
    gstreamer1.0-plugins-base \
    gstreamer1.0-plugins-good \
    gstreamer1.0-plugins-bad \
    gstreamer1.0-plugins-ugly \
    gstreamer1.0-nice \
    libgstreamer1.0-dev \
    libgstreamer-plugins-base1.0-dev \
    libgstreamer-plugins-bad1.0-dev \
    gstreamer1.0-tools

# Fake Function Framework (FFF)
#
# NOTICE: Currently, FFF_GIT_TAG points to a specific commit SHA from master instead
# of the v1.1 tag (from 2019) as significant development has been made since the
# last official release.
# This SHA represents a stable point in the master branch with all needed features.
RUN cd /tmp && \
    git clone --depth 1 https://github.com/meekrosoft/fff.git && \
    cd fff && \
    git fetch --depth 1 origin ${FFF_GIT_TAG} && \
    git checkout ${FFF_GIT_TAG} && \
    mkdir -p /usr/local/include/fff && \
    cp /tmp/fff/fff.h /usr/local/include/fff/ && \
    rm -rf /tmp/fff

# 'gn' (generate ninja)
RUN cd /tmp && \
    wget -O gn.zip "https://chrome-infra-packages.appspot.com/dl/gn/gn/linux-amd64/+/latest" && \
    unzip gn.zip && \
    mv gn /usr/bin && \
    chmod 755 /usr/bin/gn && \
    rm gn.zip

# OTBR
RUN cd /tmp && \
    git clone --depth 1 https://github.com/openthread/ot-br-posix && \
    cd ot-br-posix && \
    git fetch --depth 1 origin ${OTBR_GIT_TAG} && \
    git checkout ${OTBR_GIT_TAG} && \
    ${APPLY_PATCHES_PATH} /tmp/patches/otbr . && \
    cd script && \
    OTBR_MDNS=avahi ./bootstrap && \
    ./cmake-build \
    -DOTBR_DUA_ROUTING=ON \
    -DOTBR_DNSSD_DISCOVERY_PROXY=ON \
    -DOTBR_SRP_ADVERTISING_PROXY=ON \
    -DOTBR_BORDER_ROUTING=ON \
    -DOTBR_TREL=ON \
    -DOTBR_NAT64=ON \
    -DOT_TREL=ON \
    -DOT_DNS_CLIENT=ON \
    -DOT_DNSSD_SERVER=ON \
    -DOT_SRP_CLIENT=ON \
    -DOT_SRP_SERVER=ON \
    -DOT_THREAD_VERSION=1.4 \
    -DCMAKE_BUILD_TYPE=Release  \
    -DOT_DHCP6_CLIENT=ON \
    -DOT_DHCP6_SERVER=ON \
    -DOTBR_DHCP6_PD=OFF \
    -DOTBR_DNS_UPSTREAM_QUERY=ON \
    -DBUILD_TESTING=OFF \
    -DOTBR_COVERAGE=OFF \
    -DOT_MLR=ON   \
    -DOTBR_DBUS=ON \
    -DOT_PLATFORM=posix \
    -DOT_ECDSA=ON   \
    -DOT_FIREWALL=OFF \
    -DOT_CHANNEL_MANAGER=OFF \
    -DOT_CHANNEL_MONITOR=OFF \
    -DOTBR_BACKBONE_ROUTER=ON \
    -DOT_BACKBONE_ROUTER_DUA_NDPROXYING=ON \
    -DOT_BACKBONE_ROUTER_MULTICAST_ROUTING=ON \
    -DOTBR_MDNS=avahi \
    -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
    -DOTBR_TELEMETRY_DATA_API=ON \
    && \
    cd ../build/otbr/ && \
    ninja install && \
    cp -a /tmp/ot-br-posix/third_party/openthread/repo/include/openthread /usr/local/include && \
    rm -rf /tmp/ot-br-posix
COPY otbr-agent.conf /etc/dbus-1/system.d/

# Simulated RCP for OpenThread
RUN cd /tmp && \
    git clone --depth 1 --recursive https://github.com/openthread/openthread.git && \
    cd openthread && \
    ./script/cmake-build simulation && \
    cp build/simulation/examples/apps/ncp/ot-rcp /usr/local/sbin && \
    rm -rf /tmp/openthread

# linenoise
# Dependencies: none
RUN cd /tmp && \
    git clone --depth 1 https://github.com/antirez/linenoise.git && \
    cd linenoise && \
    git fetch --depth 1 origin ${LINENOISE_GIT_TAG} && \
    git checkout ${LINENOISE_GIT_TAG} && \
    ${APPLY_PATCHES_PATH} /tmp/patches/linenoise . && \
    mkdir build && \
    cd build && \
    cmake .. && \
    make install && \
    rm -rf /tmp/linenoise

# Matter sample apps for use as test targets
# MATTER_REF is passed as a build arg, sourced from matter-version file
ARG MATTER_REF
SHELL ["/bin/bash", "-c"]
RUN test -n "${MATTER_REF}" || (echo "Error: MATTER_REF build arg is required" >&2 && exit 1) && \
    cd /tmp && \
    git clone --branch ${MATTER_REF} --depth 1 https://github.com/project-chip/connectedhomeip.git matter && \
    cd matter && \
    ./scripts/checkout_submodules.py --shallow --platform linux && \
    ${APPLY_PATCHES_PATH} /tmp/patches/matter . && \
    export PKG_CONFIG_PATH=/usr/local/openssl/lib/pkgconfig:$PKG_CONFIG_PATH && \
    . ./scripts/activate.sh && \
    ./scripts/build/build_examples.py \
    --target linux-x64-light-rpc \
    --target linux-x64-lock \
    --target linux-x64-thermostat \
    --target linux-x64-contact-sensor \
    --target linux-x64-chip-tool \
    --target linux-x64-camera \
    --target linux-x64-camera-controller \
    build && \
    cp out/linux-x64-light-rpc/chip-lighting-app /usr/local/bin && \
    cp out/linux-x64-lock/chip-lock-app /usr/local/bin && \
    cp out/linux-x64-thermostat/thermostat-app /usr/local/bin && \
    cp out/linux-x64-contact-sensor/contact-sensor-app /usr/local/bin && \
    cp out/linux-x64-chip-tool/chip-tool /usr/local/bin && \
    cp out/linux-x64-camera/chip-camera-app /usr/local/bin && \
    cp out/linux-x64-camera-controller/chip-camera-controller /usr/local/bin && \
    rm -rf out && \
    cd /tmp && \
    rm -rf /tmp/matter && \
    rm -rf /root/.cipd-cache-dir
SHELL ["/bin/sh", "-c"]

# Download, build, and install mquickjs, which needs our custom CMakeLists.txt
RUN cd /tmp && \
    git clone --depth 1 https://github.com/bellard/mquickjs.git && \
    cd mquickjs && \
    git fetch --depth 1 origin ${MQUICKJS_GIT_TAG} && \
    git checkout ${MQUICKJS_GIT_TAG} && \
    cp /tmp/patches/mquickjs/CMakeLists.txt . && \
    ${APPLY_PATCHES_PATH} /tmp/patches/mquickjs . && \
    mkdir build && \
    cd build && \
    cmake .. && \
    make && \
    make install && \
    rm -rf /tmp/mquickjs

# Clean up our patches
RUN rm -rf /tmp/patches

###############################################################################
# Node.js for virtual test devices (matter.js deps installed at runtime)
###############################################################################
RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND='noninteractive' apt-get install -y \
    ca-certificates \
    curl \
    gnupg && \
    mkdir -p /etc/apt/keyrings && \
    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" > /etc/apt/sources.list.d/nodesource.list && \
    apt-get update && \
    apt-get install -y nodejs

###############################################################################
# Development build stage
#
# This stage is responsible for installing packages and other tasks useful for
# development.
###############################################################################
FROM third_party_builder AS dev_builder

# Install packages useful for development
RUN apt-get update && apt-get -y upgrade && DEBIAN_FRONTEND='noninteractive' apt-get install -y \
    clangd \
    clang-format \
    silversearcher-ag \
    fd-find \
    gdb \
    rr \
    vim \
    pipx \
    gh \
    fish \
    strace \
    tcpdump \
    lcov \
    rsync \
    bash-completion

# Disable debuginfod for the container. LeakSanitizer runs at the exit of every
# (subprocess-isolated) integration test and symbolizes suppressed system-library
# leaks (python3, libcrypto, etc.) via llvm-symbolizer. gdb (installed above) pulls in
# libdebuginfod-common, whose /etc/profile.d/debuginfod.sh points DEBUGINFOD_URLS at
# https://debuginfod.ubuntu.com. When that server is unreachable from the container,
# every symbolizer lookup blocks on the TCP connect timeout, adding minutes of near-idle
# wall time to each test. Local debug info is sufficient to symbolize our own leaks, so
# turn the network fetches off. We must both set an explicit empty value AND remove the
# profile.d injector: its guard is `[ -z "$DEBUGINFOD_URLS" ]`, which treats an empty
# value the same as unset and would re-populate the URL in every login shell.
ENV DEBUGINFOD_URLS=""
RUN rm -f /etc/profile.d/debuginfod.sh /etc/profile.d/debuginfod.csh

RUN pip3 install --upgrade --break-system-packages \
    stack-pr

# Cocogitto (conventional commit tooling)
# NOTE: This version must match the cocogitto-action version used in
# .github/workflows/release.yaml and .github/workflows/check-pr-title.yaml.
# If you upgrade here, upgrade the action version there too (and vice versa).
ARG COCOGITTO_VERSION="6.3.0"
# Cocogitto does not publish checksums; this was computed from the release artifact.
# Update when changing COCOGITTO_VERSION.
ARG COCOGITTO_SHA256="046dbc0ea190528f5a028a64ed761d605f4be85de3a6e469174139331eb058bb"
RUN curl -fsSL "https://github.com/cocogitto/cocogitto/releases/download/${COCOGITTO_VERSION}/cocogitto-${COCOGITTO_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
    -o /tmp/cocogitto.tar.gz && \
    echo "${COCOGITTO_SHA256}  /tmp/cocogitto.tar.gz" | sha256sum --check && \
    tar xzf /tmp/cocogitto.tar.gz -C /usr/local/bin --strip-components=1 --wildcards '*/cog' && \
    rm /tmp/cocogitto.tar.gz

# Make some /usr/ stuff open permissions. These are individual containers,
# so this will let people install barton outputs.
RUN chmod -R +777 /usr/local && \
    chmod +777 /usr/lib && \
    chmod -R +777 /usr/share/gir-1.0

# Set up pcap permissions group with a GID that is unlikely to conflict with any existing groups
RUN groupadd -g 10000 pcap && \
    chgrp pcap /usr/bin/tcpdump && \
    chmod 750 /usr/bin/tcpdump && \
    setcap cap_net_raw,cap_net_admin=eip /usr/bin/tcpdump

# Add bashrc_term_mods. We're looking to inject this before user creation/customization
COPY bashrc_term_mods /tmp/bashrc_term_mods

# This script will set up the user specific environment. It is purposefully not run yet,
# in favor of user creation at run time in the entrypoint script on the CLI, or in the extended
# Dockerfile.devcontainer to bake the user into the image for the devcontainer.
COPY setupUser.sh /setupUser.sh
RUN chmod +x /setupUser.sh

# Setup our entrypoint
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD ["bash"]