Dockerfile.build-image

# Copyright 2021 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# hash below relates to tag: bookworm-v1.0.4
FROM registry.k8s.io/build-image/debian-base@sha256:0a17678966f63e82e9c5e246d9e654836a33e13650a698adefede61bb5ca099e
WORKDIR /work

RUN apt-get update && \
  apt-get install -y wget xz-utils libapparmor-dev && \
  apt-get autoremove  -y && \
  apt-get purge -y --auto-remove && \
  rm -rf /var/lib/apt/lists/*

ENV USER=root

ARG NIX_VERSION=2.25.0

RUN \
  export ARCH=x86_64 && \
  wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-${ARCH}-linux.tar.xz && \
  tar xf nix-${NIX_VERSION}-${ARCH}-linux.tar.xz && \
  groupadd -r -g 30000 nixbld && \
  for i in $(seq 1 30); do useradd -rM -u $((30000 + i)) -G nixbld nixbld$i ; done && \
  mkdir -m 0755 /etc/nix /nix && \
  printf "sandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
  nix-${NIX_VERSION}-${ARCH}-linux/install && \
  ln -s /nix/var/nix/profiles/default/etc/profile.d/nix.sh /etc/profile.d && \
  rm -rf nix-*

ENV ENV=/etc/profile \
  PATH=/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin \
  GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt \
  NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
  NIX_PATH=/nix/var/nix/profiles/per-user/root/channels

RUN nix-env -iA cachix -f https://cachix.org/api/v1/install && \
  cachix use security-profiles-operator && \
  nix-collect-garbage --delete-old -d && \
  nix-store --optimise && \
  nix-store --verify --check-contents

# Cache build dependencies
COPY . /build
RUN nix-build /build/nix
RUN rm -rf /build

# vim: ft=dockerfile