Skip to content

Commit 5098743

Browse files
committed
fix(build): pass the shared buildx flags from every image target
Three package Makefiles spelled out their docker buildx flags instead of using $(BUILDX_ARGS) from hack/common-envs.mk: flux-plunger, kubeovn-plunger and both dashboard images. kubeovn-plunger landed just before the change that moved the other Makefiles onto BUILDX_ARGS, flux-plunger was modelled on it, and dashboard kept its own flags when that change touched it. Those targets ignored PLATFORM, SBOM and BUILDX_EXTRA_ARGS. On an arm64 workstation the plungers came out as arm64 images, which fail on amd64 nodes with "exec format error"; CI builds on amd64 and never saw it. Dashboard and metallb hardcoded --platform=linux/amd64 instead; for metallb that sat next to $(BUILDX_ARGS), so setting PLATFORM gave buildx two platforms and a multi-platform build. All of them now build through $(BUILDX_ARGS) alone. CI sets only BUILDER, which these targets already honoured, and runs on amd64, so its builds are unchanged. Local builds of dashboard and metallb now follow the host architecture like every other package: on an arm64 machine build them for an amd64 cluster with PLATFORM=linux/amd64. A bats test dry-runs every package image target with a probe platform and a marker in BUILDX_EXTRA_ARGS, and requires each buildx call to carry the marker, so $(BUILDX_ARGS) is really passed, and that platform and no other. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent e883f6f commit 5098743

6 files changed

Lines changed: 60 additions & 26 deletions

File tree

‎hack/common-envs.mk‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,7 @@ COZYSTACK_VERSION = $(patsubst v%,%,$(shell git describe --tags --match 'v*'))
6161
# SBOM=1 attaches a CycloneDX SBOM as a buildx build attestation (--sbom=true).
6262
# Requires the docker-container buildx driver and registry referrers/attestation
6363
# support. Kept OFF by default until an OCIR referrers/attestation probe confirms
64-
# support — otherwise the attestation push fails the build. (NB: the dashboard
65-
# package's bespoke buildx calls don't read BUILDX_ARGS, so they are not yet
66-
# SBOM-covered — follow-up.) See #2937.
64+
# support — otherwise the attestation push fails the build. See #2937.
6765
SBOM ?= 0
6866

6967
BUILDX_ARGS := --provenance=false --push=$(PUSH) --load=$(LOAD) \
Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/usr/bin/env bats
2+
# Every package image target builds through $(BUILDX_ARGS) from
3+
# hack/common-envs.mk, so PLATFORM, BUILDER, SBOM and BUILDX_EXTRA_ARGS reach
4+
# each `docker buildx build`. A target that spells its flags out instead builds
5+
# for the host architecture when PLATFORM is set: on an arm64 workstation that
6+
# is an arm64 image, which fails on amd64 nodes with "exec format error" while
7+
# CI, running on amd64, never shows it.
8+
#
9+
# The check is a dry run of `make image` with a platform no target hardcodes
10+
# and a marker passed through BUILDX_EXTRA_ARGS. Every buildx invocation it
11+
# prints must carry the marker, which only $(BUILDX_ARGS) forwards, and that
12+
# platform and no other, since a second hardcoded --platform turns the build
13+
# into a multi-platform one.
14+
#
15+
# Requires: make.
16+
17+
REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
18+
PROBE_PLATFORM="linux/riscv64"
19+
PROBE_MARKER="--build-arg=BUILDX_ARGS_PROBE=1"
20+
21+
@test "every package image target passes BUILDX_ARGS and PLATFORM to docker buildx" {
22+
command -v make >/dev/null || { echo "make is required" >&2; exit 1; }
23+
24+
failed=""
25+
checked=0
26+
errlog="$(mktemp)"
27+
for makefile in "$REPO_ROOT"/packages/*/*/Makefile; do
28+
grep -q 'docker buildx build' "$makefile" || continue
29+
dir="$(dirname "$makefile")"
30+
# COZYSTACK_VERSION is set so common-envs.mk does not shell out to git.
31+
commands="$(make --no-print-directory -s -n -C "$dir" image \
32+
PLATFORM="$PROBE_PLATFORM" BUILDX_EXTRA_ARGS="$PROBE_MARKER" COZYSTACK_VERSION=0.0.0 2>"$errlog" \
33+
| sed -e ':a' -e '/\\$/N; s/\\\n//; ta' | grep 'docker buildx build')" || true
34+
if [ -z "$commands" ]; then
35+
failed="$failed ${dir#"$REPO_ROOT"/} (no buildx command: $(tr '\n' ' ' <"$errlog"))"
36+
continue
37+
fi
38+
while IFS= read -r cmd; do
39+
checked=$((checked + 1))
40+
case "$cmd" in
41+
*"$PROBE_MARKER"*) ;;
42+
*) failed="$failed ${dir#"$REPO_ROOT"/} (no \$(BUILDX_ARGS))"; continue ;;
43+
esac
44+
platforms="$(grep -oE -- '--platform[= ][^ ]+' <<<"$cmd" | tr '\n' ' ')"
45+
[ "$platforms" = "--platform=$PROBE_PLATFORM " ] || failed="$failed ${dir#"$REPO_ROOT"/} ($platforms)"
46+
done <<<"$commands"
47+
done
48+
rm -f "$errlog"
49+
50+
[ "$checked" -gt 0 ] # the glob must find image targets at all
51+
if [ -n "$failed" ]; then
52+
echo "image targets not building through BUILDX_ARGS for exactly PLATFORM:$failed" >&2
53+
exit 1
54+
fi
55+
}

‎packages/system/dashboard/Makefile‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,11 @@ image-console: build-console update-values-console
2525
build-console:
2626
docker buildx build images/console \
2727
--file images/console/Containerfile \
28-
--provenance false \
29-
--builder=$(BUILDER) \
30-
--platform=linux/amd64 \
3128
$(call image-tags,cozystack-ui,v$(COZYSTACK_VERSION)) \
3229
$(call cache-args,cozystack-ui) \
3330
--metadata-file images/console.json \
3431
--build-arg APP_VERSION=$(if $(COZYSTACK_VERSION),v$(COZYSTACK_VERSION),) \
35-
--push=$(PUSH) \
36-
--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
37-
--load=$(LOAD)
32+
$(BUILDX_ARGS)
3833

3934
update-values-console:
4035
IMAGE="$(REGISTRY)/cozystack-ui:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/console.json -r)" \
@@ -43,15 +38,10 @@ update-values-console:
4338

4439
image-token-proxy:
4540
docker buildx build images/token-proxy \
46-
--provenance false \
47-
--builder=$(BUILDER) \
48-
--platform=linux/amd64 \
4941
$(call image-tags,token-proxy,v$(COZYSTACK_VERSION)) \
5042
$(call cache-args,token-proxy) \
5143
--metadata-file images/token-proxy.json \
52-
--push=$(PUSH) \
53-
--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
54-
--load=$(LOAD)
44+
$(BUILDX_ARGS)
5545
IMAGE="$(REGISTRY)/token-proxy:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/token-proxy.json -r)" \
5646
yq -i '.tokenProxy.image = strenv(IMAGE)' values.yaml
5747
rm -f images/token-proxy.json

‎packages/system/flux-plunger/Makefile‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,10 @@ include ../../../hack/package.mk
66

77
image:
88
docker buildx build -f images/flux-plunger/Dockerfile ../../../ \
9-
--provenance false \
10-
$(if $(strip $(BUILDER)),--builder=$(BUILDER)) \
119
$(call image-tags,flux-plunger,v$(COZYSTACK_VERSION)) \
1210
$(call cache-args,flux-plunger) \
1311
--metadata-file images/flux-plunger.json \
14-
--push=$(PUSH) \
15-
--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
16-
--load=$(LOAD)
12+
$(BUILDX_ARGS)
1713
IMAGE="$(REGISTRY)/flux-plunger:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/flux-plunger.json -o json -r)" \
1814
yq -i '.image = strenv(IMAGE)' values.yaml
1915
rm -f images/flux-plunger.json

‎packages/system/kubeovn-plunger/Makefile‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,10 @@ include ../../../hack/package.mk
66

77
image:
88
docker buildx build -f images/kubeovn-plunger/Dockerfile ../../../ \
9-
--provenance false \
10-
$(if $(strip $(BUILDER)),--builder=$(BUILDER)) \
119
$(call image-tags,kubeovn-plunger,v$(COZYSTACK_VERSION)) \
1210
$(call cache-args,kubeovn-plunger) \
1311
--metadata-file images/kubeovn-plunger.json \
14-
--push=$(PUSH) \
15-
--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
16-
--load=$(LOAD)
12+
$(BUILDX_ARGS)
1713
IMAGE="$(REGISTRY)/kubeovn-plunger:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/kubeovn-plunger.json -o json -r)" \
1814
yq -i '.image = strenv(IMAGE)' values.yaml
1915
rm -f images/kubeovn-plunger.json

‎packages/system/metallb/Makefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ image-controller image-speaker:
1717
$(eval TARGET := $(subst image-,,$@))
1818
$(eval VERSION := $(shell yq '.appVersion' charts/metallb/Chart.yaml))
1919
docker buildx build images/metallb \
20-
--platform=linux/amd64 \
2120
--target $(TARGET) \
2221
--build-arg VERSION=$(VERSION) \
2322
$(call image-tags,metallb-$(TARGET),$(VERSION)) \

0 commit comments

Comments
 (0)