Dockerfile: fix for seccomp

Commit f30244ee1b broke the scenario of using Dockefile for
anything but making a release. This happened because it installed
native libseccomp build to a temporary directory, and so linking against
libseccomp required setting a few environment variables.

Let's fix this, and simplify libseccomp installation. Instead of using
temporary directories, let's install native libseccomp to a specified
directory, all the cross-builds to its subdirectories, and set
PKG_CONFIG_PATH and LD_LIBRARY_PATH in Dockerfile so that the built
library will found by pkg-config and the dynamic linker (without setting
LD_LIBRARY_PATH, ld picks up distro-provided libseccomp.so).

While at it, fix some bugs introduced by the abovementioned commit.

This fixes building runc in  make targets like shell, dbuild,
integration, unittest -- i.e. those that depend on runcimage.

Fixes: f30244ee1b
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

Dockerfile

@@ -53,7 +53,10 @@ RUN cd /tmp \
 # install libseccomp
 ARG LIBSECCOMP_VERSION
 COPY script/* /tmp/script/
-RUN mkdir -p /usr/local/src/libseccomp \
-    && /tmp/script/seccomp.sh "$LIBSECCOMP_VERSION" /usr/local/src/libseccomp /usr/local/src/libseccomp/.env-file arm64 armel armhf ppc64le
+RUN mkdir -p /opt/libseccomp \
+    && /tmp/script/seccomp.sh "$LIBSECCOMP_VERSION" /opt/libseccomp arm64 armel armhf ppc64le
+ENV LIBSECCOMP_VERSION=$LIBSECCOMP_VERSION
+ENV LD_LIBRARY_PATH=/opt/libseccomp/lib
+ENV PKG_CONFIG_PATH=/opt/libseccomp/lib/pkgconfig
 
 WORKDIR /go/src/github.com/opencontainers/runc

script/release.sh

@@ -18,6 +18,7 @@ set -e
 ## --->
 # Project-specific options and functions. In *theory* you shouldn't need to
 # touch anything else in this script in order to use this elsewhere.
+: "${LIBSECCOMP_VERSION:=2.5.2}"
 project="runc"
 root="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")/..")"
 
@@ -31,7 +32,6 @@ source "$root/script/lib.sh"
 #   $2 -- native architecture (a .suffix for a native binary file name).
 #   $@ -- additional architectures to cross-build for.
 function build_project() {
-	local libseccomp_version=2.5.2
 	local builddir
 	builddir="$(dirname "$1")"
 	shift
@@ -39,17 +39,14 @@ function build_project() {
 	shift
 	local arches=("$@")
 
-	# Assume that if /usr/local/src/libseccomp/.env-file exists, then
-	# we are run via Dockerfile, and seccomp is already built.
-	if [ -r /usr/local/src/libseccomp/.env-file ]; then
-		# shellcheck disable=SC1091
-		source /usr/local/src/libseccomp/.env-file
-		# Copy the source tarball.
-		cp /usr/local/src/libseccomp/* "$builddir"
-	else
-		"$root/script/seccomp.sh" "$libseccomp_version" "$builddir" "./env-file" "${arches[@]}"
-		# shellcheck disable=SC1091
-		source ./env-file
+	# Assume that if /opt/libseccomp exists, then we are run
+	# via Dockerfile, and seccomp is already built.
+	local seccompdir=/opt/libseccomp temp_dir
+	if [ ! -d "$seccompdir" ]; then
+		temp_dir="$(mktemp -d)"
+		seccompdir="$temp_dir"
+		# Download and build libseccomp.
+		"$root/script/seccomp.sh" "$LIBSECCOMP_VERSION" "$seccompdir" "${arches[@]}"
 	fi
 
 	# For reproducible builds, add these to EXTRA_LDFLAGS:
@@ -64,28 +61,37 @@ function build_project() {
 
 	# Build natively.
 	make -C "$root" \
-		PKG_CONFIG_PATH="${LIBSECCOMP_PREFIX}/lib/pkgconfig" \
-		LD_LIBRARY_PATH="${LIBSECCOMP_PREFIX}/lib" \
+		PKG_CONFIG_PATH="$seccompdir/lib/pkgconfig" \
 		"${make_args[@]}"
 	strip "$root/$project"
+	# Sanity check: make sure libseccomp version is as expected.
+	local ver
+	ver=$("$root/$project" --version | awk '$1 == "libseccomp:" {print $2}')
+	if [ "$ver" != "$LIBSECCOMP_VERSION" ]; then
+		echo >&2 "libseccomp version mismatch: want $LIBSECCOMP_VERSION, got $ver"
+		exit 1
+	fi
+
 	mv "$root/$project" "$builddir/$project.$native_arch"
-	rm -rf "${LIBSECCOMP_PREFIX}"
 
 	# Cross-build for for other architectures.
-	local prefix arch
+	local arch
 	for arch in "${arches[@]}"; do
-		eval prefix=\$"LIBSECCOMP_PREFIX_$arch"
-		if [ -z "$prefix" ]; then
-			echo "LIBSECCOMP_PREFIX_$arch is empty (unsupported arch?)" >&2
-			exit 1
-		fi
 		set_cross_vars "$arch"
 		make -C "$root" \
-			PKG_CONFIG_PATH="${prefix}/lib/pkgconfig" "${make_args[@]}"
+			PKG_CONFIG_PATH="$seccompdir/$arch/lib/pkgconfig" \
+			"${make_args[@]}"
 		"$STRIP" "$root/$project"
 		mv "$root/$project" "$builddir/$project.$arch"
-		rm -rf "$prefix"
 	done
+
+	# Copy libseccomp source tarball.
+	cp "$seccompdir"/src/* "$builddir"
+
+	# Clean up.
+	if [ -n "$tempdir" ]; then
+		rm -rf "$tempdir"
+	fi
 }
 
 # End of the easy-to-configure portion.

script/seccomp.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -e -u -o pipefail
+
 # shellcheck source=./script/lib.sh
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
@@ -7,17 +9,13 @@ source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 # so download, install and build against it.
 # Parameters:
 #  $1 -- libseccomp version to download and build.
-#  $2 -- destination directory to put the source tarball in.
-#  $3 -- file to append LIBSECCOMP_PREFIX*= environment variables to
-#        (can be sourced to get install paths).
+#  $2 -- destination directory.
 #  $@ -- additional architectures to cross-compile for.
 function build_libseccomp() {
 	local ver="$1"
 	shift
 	local dest="$1"
 	shift
-	local varfile="$1"
-	shift
 	local arches=("$@")
 	local tar="libseccomp-${ver}.tar.gz"
 
@@ -28,36 +26,32 @@ function build_libseccomp() {
 	tar xf "$tar" -C "$srcdir"
 	pushd "$srcdir/libseccomp-$ver" || return
 
-	# Build and install natively.
-	local prefix
-	prefix="$(mktemp -d)"
+	# Build natively and install to /usr/local.
 	./configure \
-		--prefix="$prefix" --libdir="$prefix/lib" \
-		--enable-static --disable-shared
-	echo LIBSECCOMP_PREFIX="$prefix" >>"$varfile"
+		--prefix="$dest" --libdir="$dest/lib" \
+		--enable-static --enable-shared
 	make install
 	make clean
 
 	# Build and install for additional architectures.
 	local arch
 	for arch in "${arches[@]}"; do
-		prefix="$(mktemp -d)"
 		set_cross_vars "$arch"
 		./configure --host "$HOST" \
-			--prefix="$prefix" --libdir="$prefix/lib" \
+			--prefix="$dest/$arch" --libdir="$dest/$arch/lib" \
 			--enable-static --enable-shared
 		make install
 		make clean
-		echo "LIBSECCOMP_PREFIX_${arch}=$prefix" >>"$varfile"
 	done
 
-	# Place the source tarball to $dest.
+	# Place the source tarball to $dest/src.
 	popd || return
-	mv "$tar"{,.asc} "$dest"
+	mkdir "$dest"/src
+	mv "$tar"{,.asc} "$dest"/src
 }
 
-if $# -lt 4; then
-	echo "Usage: seccomp.sh <version> <dest-dir> <var-file> [<extra-arch> ...]" >&2
+if [ $# -lt 4 ]; then
+	echo "Usage: seccomp.sh <version> <dest-dir> [<extra-arch> ...]" >&2
 	exit 1
 fi