shadow/Containerfile at main · getoptimum/shadow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Shadow v3.3.0 for the optimum simulation harnesses (mump2p .shadow/, optimum-bench).
#
#   podman build -t getoptimum/shadow:v3.3.0 \
#     --build-arg SHADOW_REF=v3.3.0 -f Containerfile .
#
#   podman build -t getoptimum/shadow:v3.3.0-futex-patch \
#     --build-arg SHADOW_REF=futex-shared-v3.3.0 -f Containerfile .
#
# Both tags come from getoptimum/shadow: the `v3.3.0` tag is stock upstream,
# the `futex-shared-v3.3.0` branch adds cross-process futex support so a
# shared-memory IPC stack can wait and wake across processes under simulation.
#
# The image carries Shadow plus a Go and C toolchain, because the harnesses build
# their binaries inside the container from a bind-mounted repo. The Rust toolchain
# needed to compile Shadow stays in the builder stage and is not shipped.
#
# Shadow ptraces the processes it manages, so run it with:
#   --cap-add=SYS_PTRACE --security-opt seccomp=unconfined
# and, on an SELinux-enforcing host, --security-opt label=disable for bind mounts.

ARG UBUNTU_VERSION=22.04

# ---------------------------------------------------------------------------
FROM ubuntu:${UBUNTU_VERSION} AS builder

ENV DEBIAN_FRONTEND=noninteractive

# Shadow's documented build dependencies.
RUN apt-get update && apt-get install -y --no-install-recommends \
      cmake make gcc g++ pkg-config xz-utils ca-certificates curl git \
      python3 libc6-dbg libclang-dev libglib2.0-0 libglib2.0-dev \
 && rm -rf /var/lib/apt/lists/*

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
      | sh -s -- -y --default-toolchain stable
ENV PATH=/root/.cargo/bin:$PATH

ARG SHADOW_REPO=https://github.com/getoptimum/shadow.git
ARG SHADOW_REF=v3.3.0
RUN git clone --recursive --depth 1 --branch "${SHADOW_REF}" "${SHADOW_REPO}" /tmp/shadow \
 && cd /tmp/shadow \
 && ./setup build --jobs "$(nproc)" --clean --prefix /usr/local \
 && ./setup install \
 && rm -rf /tmp/shadow

# ---------------------------------------------------------------------------
FROM ubuntu:${UBUNTU_VERSION}

ENV DEBIAN_FRONTEND=noninteractive

# Shadow's runtime libraries, plus the C toolchain the harnesses need: their
# binaries must be glibc-dynamic (CGO_ENABLED=1, external linking) because
# Shadow refuses to run statically linked executables.
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl git make gcc g++ pkg-config \
      libglib2.0-0 libc6-dbg \
 && rm -rf /var/lib/apt/lists/*

ARG GO_VERSION=1.26.5
RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" | tar -C /usr/local -xz
ENV PATH=/usr/local/go/bin:$PATH

COPY --from=builder /usr/local/bin/shadow /usr/local/bin/shadow
COPY --from=builder /usr/local/lib/libshadow_injector.so \
                    /usr/local/lib/libshadow_libc.so \
                    /usr/local/lib/libshadow_openssl_crypto.so \
                    /usr/local/lib/libshadow_openssl_rng.so \
                    /usr/local/lib/libshadow_shim.so \
                    /usr/local/lib/

ARG SHADOW_REF=v3.3.0
LABEL org.opencontainers.image.title="shadow" \
      org.opencontainers.image.description="Shadow network simulator v3.3.0 with a Go and C toolchain" \
      org.opencontainers.image.source="https://github.com/getoptimum/shadow" \
      org.opencontainers.image.version="${SHADOW_REF}" \
      org.opencontainers.image.licenses="BSD-3-Clause"

WORKDIR /work