| ADD alpine-minirootfs-3.24.2-x86_64.tar.gz / # buildkit |
| CMD ["/bin/sh"] |
| RUN /bin/sh -c apk add --no-cache ca-certificates openssh-client git # buildkit |
| RUN /bin/sh -c [ -e /etc/nsswitch.conf ] && grep '^hosts: files dns' /etc/nsswitch.conf # buildkit |
| RUN /bin/sh -c set -eux; addgroup -g 2375 -S docker # buildkit |
| ENV DOCKER_VERSION=29.8.2 |
| RUN /bin/sh -c set -eux; apkArch="$(apk --print-arch)"; case "$apkArch" in 'x86_64') url='https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz'; ;; 'armhf') url='https://download.docker.com/linux/static/stable/armel/docker-29.8.2.tgz'; ;; 'armv7') url='https://download.docker.com/linux/static/stable/armhf/docker-29.8.2.tgz'; ;; 'aarch64') url='https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz'; ;; *) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; esac; wget -O 'docker.tgz' "$url"; tar --extract --file docker.tgz --strip-components 1 --directory /usr/local/bin/ --no-same-owner 'docker/docker' ; rm docker.tgz; docker --version # buildkit |
| ENV DOCKER_BUILDX_VERSION=0.37.2 |
| RUN /bin/sh -c set -eux; apkArch="$(apk --print-arch)"; case "$apkArch" in 'x86_64') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-amd64'; sha256='982ca20490b45ed1ec8d99795974d3d874a358f75938c9c237305010e6b7e548'; ;; 'armhf') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-arm-v6'; sha256='53a8d26bde4af99ce5123abec1d79f6c778cd22ad0c18bab1ae2056302b32805'; ;; 'armv7') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-arm-v7'; sha256='82ce19352521eec762566346d48eb04f1f66ecf4fef6385fa903503c5530367a'; ;; 'aarch64') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-arm64'; sha256='efa38cb7aa7db2dbb9ad049b00b0a9737f66f033626177b5a4e845184ad7ab29'; ;; 'ppc64le') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-ppc64le'; sha256='59b5565dba49775232e1c14f29342c1453ca40ee5edf57ca016a7ee123780afa'; ;; 'riscv64') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-riscv64'; sha256='0678850b5e49218e0c22990a1b9a9ea1e0835d92a89f01a21dc7e9c85033826b'; ;; 's390x') url='https://github.com/docker/buildx/releases/download/v0.37.2/buildx-v0.37.2.linux-s390x'; sha256='1c43e151e84cf570a1124215ba15f92b6b240eac4c83115a94b8378b54409f3c'; ;; *) echo >&2 "warning: unsupported 'docker-buildx' architecture ($apkArch); skipping"; exit 0 ;; esac; wget -O 'docker-buildx' "$url"; echo "$sha256 *"'docker-buildx' | sha256sum -c -; plugin='/usr/local/libexec/docker/cli-plugins/docker-buildx'; mkdir -p "$(dirname "$plugin")"; mv -vT 'docker-buildx' "$plugin"; chmod +x "$plugin"; docker buildx version # buildkit |
| ENV DOCKER_COMPOSE_VERSION=5.6.0 |
| RUN /bin/sh -c set -eux; apkArch="$(apk --print-arch)"; case "$apkArch" in 'x86_64') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-x86_64'; sha256='40343e21ca777173e69cff5dbafeb37c6f81f3b0d57d9e597f036e95eb63e76a'; ;; 'armhf') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-armv6'; sha256='5531d2b21378cd0600d78c0ff44425fdcc2c0ba3b424a2e683004ff7987a4b53'; ;; 'armv7') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-armv7'; sha256='7bce2792fb474aa3bbb67ee7060622eb0f66516c92083712bdec520127d4f105'; ;; 'aarch64') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-aarch64'; sha256='733ec76717ceb59052a9609b9dadfb523b2df8eab57a54212872d10a58078ea2'; ;; 'ppc64le') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-ppc64le'; sha256='59893abdb92b6f23ed105f82472ba8df92e688916186b8622c4ebdf7abbf9984'; ;; 'riscv64') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-riscv64'; sha256='ea7702b8ac29d2b84bf05dc31727d5eceb3bd46f36ea30725b7532d4e3d8ae43'; ;; 's390x') url='https://github.com/docker/compose/releases/download/v5.6.0/docker-compose-linux-s390x'; sha256='c1ed074ea3854870272a8d988e2f87ca7be0299aa51ad4ad024ef02cf5c273e1'; ;; *) echo >&2 "warning: unsupported 'docker-compose' architecture ($apkArch); skipping"; exit 0 ;; esac; wget -O 'docker-compose' "$url"; echo "$sha256 *"'docker-compose' | sha256sum -c -; plugin='/usr/local/libexec/docker/cli-plugins/docker-compose'; mkdir -p "$(dirname "$plugin")"; mv -vT 'docker-compose' "$plugin"; chmod +x "$plugin"; ln -sv "$plugin" /usr/local/bin/; docker-compose --version; docker compose version # buildkit |
| COPY modprobe.sh /usr/local/bin/modprobe # buildkit |
| COPY docker-entrypoint.sh /usr/local/bin/ # buildkit |
| ENV DOCKER_TLS_CERTDIR=/certs |
| RUN /bin/sh -c mkdir /certs /certs/client && chmod 1777 /certs /certs/client # buildkit |
| ENTRYPOINT ["docker-entrypoint.sh"] |
| CMD ["sh"] |
| RUN /bin/sh -c set -eux; apk add --no-cache ip6tables iptables openssl pigz shadow-uidmap xz ; # buildkit |
| RUN /bin/sh -c set -eux; apk add --no-cache iptables-legacy; mkdir -p /usr/local/sbin/.iptables-legacy; for f in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore ; do b="$(command -v "${f/tables/tables-legacy}")"; "$b" --version; ln -svT "$b" "/usr/local/sbin/.iptables-legacy/$f"; done; export PATH="/usr/local/sbin/.iptables-legacy:$PATH"; iptables --version | grep legacy # buildkit |
| RUN /bin/sh -c set -eux; addgroup -S dockremap; adduser -S -G dockremap dockremap; echo 'dockremap:165536:65536' >> /etc/subuid; echo 'dockremap:165536:65536' >> /etc/subgid # buildkit |
| RUN /bin/sh -c set -eux; apkArch="$(apk --print-arch)"; case "$apkArch" in 'x86_64') url='https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz'; ;; 'armhf') url='https://download.docker.com/linux/static/stable/armel/docker-29.8.2.tgz'; ;; 'armv7') url='https://download.docker.com/linux/static/stable/armhf/docker-29.8.2.tgz'; ;; 'aarch64') url='https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz'; ;; *) echo >&2 "error: unsupported 'docker.tgz' architecture ($apkArch)"; exit 1 ;; esac; wget -O 'docker.tgz' "$url"; tar --extract --file docker.tgz --strip-components 1 --directory /usr/local/bin/ --no-same-owner --exclude 'docker/docker' ; rm docker.tgz; dockerd --version; containerd --version; ctr --version; runc --version # buildkit |
| ENV DIND_COMMIT=8d9e3502aba39127e4d12196dae16d306f76993d |
| RUN /bin/sh -c set -eux; wget -O /usr/local/bin/dind "https://raw.githubusercontent.com/docker/docker/${DIND_COMMIT}/hack/dind"; chmod +x /usr/local/bin/dind # buildkit |
| COPY dockerd-entrypoint.sh /usr/local/bin/ # buildkit |
| VOLUME [/var/lib/docker] |
| EXPOSE map[2375/tcp:{} 2376/tcp:{}] |
| ENTRYPOINT ["dockerd-entrypoint.sh"] |
| CMD [] |
| ARG WORKBENCH_VERSION=v0.1.55 |
| LABEL org.opencontainers.image.title=spatial-workbench-sandbox org.opencontainers.image.description=Isolated Docker daemon for Hermes agent workers org.opencontainers.image.version=v0.1.55 |
| COPY --chmod=0755 deploy/sandbox/entrypoint.sh /usr/local/bin/sandbox-entrypoint # buildkit |
| ENV DOCKER_TLS_CERTDIR=/certs DOCKER_TLS_SAN=DNS:sandbox |
| ENTRYPOINT ["/usr/local/bin/sandbox-entrypoint"] |
| CMD [] |
