Skip to content

Commit e7b047a

Browse files
lexfreilexfrei
committed
feat(vpn): build shadowbox for amd64 and arm64
Upstream publishes quay.io/outline/shadowbox for amd64 only, so the VPN app crash-loops with an exec format error on arm64 nodes. The upstream build already targets arm64 (node base, outline-ss-server, prometheus), it is just never published for it. Rebuild the pinned release (v1.12.3) as a multi-arch image following upstream's own Taskfile layout: the webpack bundle is built once on the build platform, the Go server and prometheus per target. The runtime base is the node:18.18.0-alpine3.18 index whose per-arch manifests are exactly the ones upstream pins, so amd64 keeps the same base layers. The chart reads the image from images/shadowbox.tag like the other first-party images, pinned by digest instead of the floating :stable tag. Until the first build stamps it, the file holds upstream v1.12.3 by digest, which is what :stable resolves to today. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 101d1d9 commit e7b047a

6 files changed

Lines changed: 81 additions & 5 deletions

File tree

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ build: build-deps
1313
make -C packages/apps/mariadb image
1414
make -C packages/apps/clickhouse image
1515
make -C packages/apps/kubernetes image
16+
make -C packages/apps/vpn image
1617
make -C packages/system/cozystack-api image
1718
make -C packages/system/cozystack-controller image
1819
make -C packages/system/backup-controller image

‎packages/apps/vpn/Makefile‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,22 @@
1+
SHADOWBOX_VERSION = $(shell awk -F= '$$1 == "ARG VERSION" {print $$2; exit}' images/shadowbox/Dockerfile)
2+
3+
include ../../../hack/common-envs.mk
14
include ../../../hack/package.mk
25

3-
.PHONY: test
6+
.PHONY: test image
47
test:
58
helm unittest .
69

710
generate:
811
cozyvalues-gen -m 'vpn' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vpn/types.go
912
../../../hack/update-crd.sh
13+
14+
image:
15+
docker buildx build images/shadowbox \
16+
$(call image-tags,shadowbox,$(SHADOWBOX_VERSION)) \
17+
$(call cache-args,shadowbox) \
18+
--metadata-file images/shadowbox.json \
19+
$(BUILDX_ARGS)
20+
echo "$(REGISTRY)/shadowbox:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/shadowbox.json -o json -r)" \
21+
> images/shadowbox.tag
22+
rm -f images/shadowbox.json

‎packages/apps/vpn/images/shadowbox.tag‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
quay.io/outline/shadowbox:v1.12.3@sha256:545c6f7c7261bb30ae1dffe24a6fca5f8512f5d17c72cfb9e410e7e655444e62

‎packages/apps/vpn/images/shadowbox/Dockerfile‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Upstream publishes quay.io/outline/shadowbox for amd64 only, although its
2+
# own Taskfile already knows how to target arm64. This rebuilds the same
3+
# release as a multi-arch image; the layout follows upstream's
4+
# src/shadowbox/Taskfile.yml `docker:build`.
5+
ARG VERSION=v1.12.3
6+
ARG COMMIT=067d0d47aedac94a3888a127fa6c65f2f53b9987
7+
8+
FROM --platform=$BUILDPLATFORM node:18.18.0-alpine3.18@sha256:a315556d82ef54561e54fca7d8ee333382de183d4e56841dcefcd05b55310f46 AS source
9+
ARG VERSION
10+
ARG COMMIT
11+
RUN apk add --no-cache git
12+
RUN git clone --branch server-${VERSION} --depth 1 https://github.com/OutlineFoundation/outline-server /src \
13+
&& test "$(git -C /src rev-parse HEAD)" = "${COMMIT}"
14+
15+
# main.js is a single webpack bundle with no native addons, so it is built
16+
# once on the build platform and shared by every target.
17+
FROM source AS app
18+
ARG VERSION
19+
WORKDIR /src
20+
RUN npm ci --ignore-scripts
21+
RUN SB_VERSION=${VERSION} npx webpack --config=src/shadowbox/webpack.config.js \
22+
--output-path=/out/opt/outline-server/app --mode=production \
23+
&& cp src/shadowbox/package.json /out/opt/outline-server/
24+
25+
FROM --platform=$BUILDPLATFORM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS ss-server
26+
ARG TARGETOS
27+
ARG TARGETARCH
28+
COPY --from=source /src /src
29+
WORKDIR /src
30+
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 go build -trimpath \
31+
-ldflags='-s -w -X main.version=embedded' \
32+
-o /out/opt/outline-server/bin/ github.com/Jigsaw-Code/outline-ss-server/cmd/outline-ss-server
33+
34+
# Version and checksums are upstream's, from third_party/Taskfile.yml.
35+
FROM --platform=$BUILDPLATFORM node:18.18.0-alpine3.18@sha256:a315556d82ef54561e54fca7d8ee333382de183d4e56841dcefcd05b55310f46 AS prometheus
36+
ARG TARGETARCH
37+
ARG PROMETHEUS_VERSION=2.37.1
38+
RUN case "${TARGETARCH}" in \
39+
amd64) sum=753f66437597cf52ada98c2f459aa8c03745475c249c9f2b40ac7b3919131ba6 ;; \
40+
arm64) sum=b59a66fb5c7ec5acf6bf426793528a5789a1478a0dad8c64edc2843caf31b1b8 ;; \
41+
*) echo "unsupported TARGETARCH ${TARGETARCH}" >&2; exit 1 ;; \
42+
esac \
43+
&& name=prometheus-${PROMETHEUS_VERSION}.linux-${TARGETARCH} \
44+
&& wget -q -O /tmp/p.tgz https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}/${name}.tar.gz \
45+
&& echo "${sum} /tmp/p.tgz" | sha256sum -c - \
46+
&& mkdir -p /out/opt/outline-server/bin \
47+
&& tar -xzf /tmp/p.tgz -C /out/opt/outline-server/bin --strip-components=1 ${name}/prometheus
48+
49+
FROM node:18.18.0-alpine3.18@sha256:a315556d82ef54561e54fca7d8ee333382de183d4e56841dcefcd05b55310f46
50+
ARG VERSION
51+
LABEL shadowbox.github.release=${VERSION}
52+
# The user management service doesn't quit with SIGTERM.
53+
STOPSIGNAL SIGKILL
54+
# curl detects the public IP; coreutils gives update_mmdb.sh a `date --date`.
55+
RUN apk add --no-cache --upgrade coreutils curl
56+
COPY --from=app /out /
57+
COPY --from=ss-server /out /
58+
COPY --from=prometheus /out /
59+
COPY --from=source /src/src/shadowbox/scripts /scripts
60+
COPY --from=source /src/src/shadowbox/scripts/update_mmdb.sh /etc/periodic/weekly/update_mmdb.sh
61+
COPY --from=source /src/src/shadowbox/docker/cmd.sh /cmd.sh
62+
RUN mkdir -p /root/shadowbox/persisted-state && /etc/periodic/weekly/update_mmdb.sh
63+
WORKDIR /opt/outline-server
64+
CMD ["/cmd.sh"]

‎packages/apps/vpn/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ spec:
4242
path: shadowbox_server_config.json
4343
containers:
4444
- name: outline-vpn
45-
image: quay.io/outline/shadowbox:stable
45+
image: {{ .Files.Get "images/shadowbox.tag" | trim | quote }}
4646
resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 12 }}
4747
ports:
4848
- containerPort: 40000

‎packages/apps/vpn/tests/vpn_test.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,6 @@ tests:
2929
- equal:
3030
path: spec.replicas
3131
value: 2
32-
- equal:
33-
path: spec.template.spec.containers[0].image
34-
value: "quay.io/outline/shadowbox:stable"
3532
- equal:
3633
path: spec.template.spec.containers[0].ports[0].containerPort
3734
value: 40000

0 commit comments

Comments
 (0)