Skip to content

Commit ccc6727

Browse files
kvinwangkvinwang
authored
Merge pull request #39 from Dstack-TEE/better-pkg-pin
Better package pinning
2 parents cdc97f0 + 09d8b5d commit ccc6727

File tree

6 files changed

+352
-18
lines changed

6 files changed

+352
-18
lines changed

‎custom-domain/dstack-ingress/Dockerfile‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,41 @@
11
FROM nginx@sha256:b6653fca400812e81569f9be762ae315db685bc30b12ddcdc8616c63a227d3ca
22

3-
# Use a specific Debian snapshot for reproducible builds
3+
COPY pinned-packages.txt /tmp/
4+
45
RUN set -e; \
56
# Create a sources.list file pointing to a specific snapshot
67
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/20250411T024939Z bookworm main' > /etc/apt/sources.list && \
78
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20250411T024939Z bookworm-security main' >> /etc/apt/sources.list && \
89
echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/10no-check-valid-until && \
9-
# Install packages with exact versions for reproducibility
10-
apt-get -o Acquire::Check-Valid-Until=false update && \
10+
# Create preferences file to pin all packages
11+
mkdir -p /etc/apt/preferences.d && \
12+
cat /tmp/pinned-packages.txt | while read line; do \
13+
pkg=$(echo $line | cut -d= -f1); \
14+
ver=$(echo $line | cut -d= -f2); \
15+
if [ ! -z "$pkg" ] && [ ! -z "$ver" ]; then \
16+
echo "Package: $pkg\nPin: version $ver\nPin-Priority: 1001\n" >> /etc/apt/preferences.d/pinned-packages; \
17+
fi; \
18+
done && \
19+
apt-get update && \
1120
apt-get install -y --no-install-recommends \
12-
certbot=2.1.0-4 \
13-
openssl=3.0.15-1~deb12u1 \
14-
bash=5.2.15-2+b7 \
15-
python3=3.11.2-1+b1 \
16-
python3-pip=23.0.1+dfsg-1 \
17-
python3-requests=2.28.1+dfsg-1 \
18-
python3.11-venv=3.11.2-6+deb12u5 \
19-
curl=7.88.1-10+deb12u12 \
20-
jq=1.6-2.1 \
21-
coreutils=9.1-1 && \
22-
rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
23-
21+
certbot \
22+
openssl \
23+
bash \
24+
python3-pip \
25+
python3-requests \
26+
python3.11 \
27+
python3.11-venv \
28+
curl \
29+
jq \
30+
coreutils && \
31+
rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache /tmp/pinned-packages.txt
2432

2533
RUN mkdir -p /etc/letsencrypt /var/www/certbot /usr/share/nginx/html
2634

2735
COPY ./scripts/* /scripts/
2836
RUN chmod +x /scripts/*
2937
ENV PATH="/scripts:$PATH"
38+
COPY .GIT_REV /etc/
3039

3140
ENTRYPOINT ["/scripts/entrypoint.sh"]
3241
CMD ["nginx", "-g", "daemon off;"]

‎custom-domain/dstack-ingress/build-image.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,8 @@ fi
88
if ! docker buildx inspect buildkit_20 &>/dev/null; then
99
docker buildx create --use --driver-opt image=moby/buildkit:v0.20.2 --name buildkit_20
1010
fi
11+
touch pinned-packages.txt
12+
git rev-parse HEAD > .GIT_REV
1113
docker buildx build --builder buildkit_20 --no-cache --build-arg SOURCE_DATE_EPOCH="0" --output type=docker,name=$NAME,rewrite-timestamp=true .
14+
docker run --rm --entrypoint bash $NAME -c "dpkg -l | grep '^ii' |awk '{print \$2\"=\"\$3}' | sort" > pinned-packages.txt
15+
rm .GIT_REV

‎custom-domain/dstack-ingress/pinned-packages.txt‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
adduser=3.134
2+
apt=2.6.1
3+
base-files=12.4+deb12u10
4+
base-passwd=3.6.1
5+
bash=5.2.15-2+b8
6+
bsdutils=1:2.38.1-5+deb12u3
7+
ca-certificates=20230311
8+
certbot=2.1.0-4
9+
coreutils=9.1-1
10+
curl=7.88.1-10+deb12u12
11+
dash=0.5.12-2
12+
debconf=1.5.82
13+
debian-archive-keyring=2023.3+deb12u1
14+
debianutils=5.7-0.5~deb12u1
15+
diffutils=1:3.8-4
16+
dpkg=1.21.22
17+
e2fsprogs=1.47.0-2
18+
findutils=4.9.0-4
19+
fontconfig-config=2.14.1-4
20+
fonts-dejavu-core=2.37-6
21+
gcc-12-base:amd64=12.2.0-14
22+
gettext-base=0.21-12
23+
gpgv=2.2.40-1.1
24+
grep=3.8-5
25+
gzip=1.12-1
26+
hostname=3.23+nmu1
27+
init-system-helpers=1.65.2
28+
jq=1.6-2.1
29+
libabsl20220623:amd64=20220623.1-1
30+
libacl1:amd64=2.3.1-3
31+
libaom3:amd64=3.6.0-1+deb12u1
32+
libapt-pkg6.0:amd64=2.6.1
33+
libattr1:amd64=1:2.5.1-4
34+
libaudit-common=1:3.0.9-1
35+
libaudit1:amd64=1:3.0.9-1
36+
libavif15:amd64=0.11.1-1
37+
libblkid1:amd64=2.38.1-5+deb12u3
38+
libbrotli1:amd64=1.0.9-2+b6
39+
libbsd0:amd64=0.11.7-2
40+
libbz2-1.0:amd64=1.0.8-5+b1
41+
libc-bin=2.36-9+deb12u10
42+
libc6:amd64=2.36-9+deb12u10
43+
libcap-ng0:amd64=0.8.3-1+b3
44+
libcap2:amd64=1:2.66-4
45+
libcom-err2:amd64=1.47.0-2
46+
libcrypt1:amd64=1:4.4.33-2
47+
libcurl4:amd64=7.88.1-10+deb12u12
48+
libdav1d6:amd64=1.0.0-2+deb12u1
49+
libdb5.3:amd64=5.3.28+dfsg2-1
50+
libde265-0:amd64=1.0.11-1+deb12u2
51+
libdebconfclient0:amd64=0.270
52+
libdeflate0:amd64=1.14-1
53+
libedit2:amd64=3.1-20221030-2
54+
libexpat1:amd64=2.5.0-1+deb12u1
55+
libext2fs2:amd64=1.47.0-2
56+
libffi8:amd64=3.4.4-1
57+
libfontconfig1:amd64=2.14.1-4
58+
libfreetype6:amd64=2.12.1+dfsg-5+deb12u4
59+
libgav1-1:amd64=0.18.0-1+b1
60+
libgcc-s1:amd64=12.2.0-14
61+
libgcrypt20:amd64=1.10.1-3
62+
libgd3:amd64=2.3.3-9
63+
libgeoip1:amd64=1.6.12-10
64+
libgmp10:amd64=2:6.2.1+dfsg1-1.1
65+
libgnutls30:amd64=3.7.9-2+deb12u4
66+
libgpg-error0:amd64=1.46-1
67+
libgssapi-krb5-2:amd64=1.20.1-2+deb12u2
68+
libheif1:amd64=1.15.1-1+deb12u1
69+
libhogweed6:amd64=3.8.1-2
70+
libicu72:amd64=72.1-3
71+
libidn2-0:amd64=2.3.3-1+b1
72+
libjbig0:amd64=2.1-6.1
73+
libjpeg62-turbo:amd64=1:2.1.5-2
74+
libjq1:amd64=1.6-2.1
75+
libk5crypto3:amd64=1.20.1-2+deb12u2
76+
libkeyutils1:amd64=1.6.3-2
77+
libkrb5-3:amd64=1.20.1-2+deb12u2
78+
libkrb5support0:amd64=1.20.1-2+deb12u2
79+
libldap-2.5-0:amd64=2.5.13+dfsg-5
80+
liblerc4:amd64=4.0.0+ds-2
81+
liblz4-1:amd64=1.9.4-1
82+
liblzma5:amd64=5.4.1-1
83+
libmd0:amd64=1.0.4-2
84+
libmount1:amd64=2.38.1-5+deb12u3
85+
libncursesw6:amd64=6.4-4
86+
libnettle8:amd64=3.8.1-2
87+
libnghttp2-14:amd64=1.52.0-1+deb12u2
88+
libnsl2:amd64=1.3.0-2
89+
libnuma1:amd64=2.0.16-1
90+
libonig5:amd64=6.9.8-1
91+
libp11-kit0:amd64=0.24.1-2
92+
libpam-modules-bin=1.5.2-6+deb12u1
93+
libpam-modules:amd64=1.5.2-6+deb12u1
94+
libpam-runtime=1.5.2-6+deb12u1
95+
libpam0g:amd64=1.5.2-6+deb12u1
96+
libpcre2-8-0:amd64=10.42-1
97+
libpng16-16:amd64=1.6.39-2
98+
libpsl5:amd64=0.21.2-1
99+
libpython3-stdlib:amd64=3.11.2-1+b1
100+
libpython3.11-minimal:amd64=3.11.2-6+deb12u6
101+
libpython3.11-stdlib:amd64=3.11.2-6+deb12u6
102+
librav1e0:amd64=0.5.1-6
103+
libreadline8:amd64=8.2-1.3
104+
librtmp1:amd64=2.4+20151223.gitfa8646d.1-2+b2
105+
libsasl2-2:amd64=2.1.28+dfsg-10
106+
libsasl2-modules-db:amd64=2.1.28+dfsg-10
107+
libseccomp2:amd64=2.5.4-1+deb12u1
108+
libselinux1:amd64=3.4-1+b6
109+
libsemanage-common=3.4-1
110+
libsemanage2:amd64=3.4-1+b5
111+
libsepol2:amd64=3.4-2.1
112+
libsmartcols1:amd64=2.38.1-5+deb12u3
113+
libsqlite3-0:amd64=3.40.1-2+deb12u1
114+
libss2:amd64=1.47.0-2
115+
libssh2-1:amd64=1.10.0-3+b1
116+
libssl3:amd64=3.0.16-1~deb12u1
117+
libstdc++6:amd64=12.2.0-14
118+
libsvtav1enc1:amd64=1.4.1+dfsg-1
119+
libsystemd0:amd64=252.36-1~deb12u1
120+
libtasn1-6:amd64=4.19.0-2+deb12u1
121+
libtiff6:amd64=4.5.0-6+deb12u2
122+
libtinfo6:amd64=6.4-4
123+
libtirpc-common=1.3.3+ds-1
124+
libtirpc3:amd64=1.3.3+ds-1
125+
libudev1:amd64=252.36-1~deb12u1
126+
libunistring2:amd64=1.0-2
127+
libuuid1:amd64=2.38.1-5+deb12u3
128+
libwebp7:amd64=1.2.4-0.2+deb12u1
129+
libx11-6:amd64=2:1.8.4-2+deb12u2
130+
libx11-data=2:1.8.4-2+deb12u2
131+
libx265-199:amd64=3.5-2+b1
132+
libxau6:amd64=1:1.0.9-1
133+
libxcb1:amd64=1.15-1
134+
libxdmcp6:amd64=1:1.1.2-3
135+
libxml2:amd64=2.9.14+dfsg-1.3~deb12u1
136+
libxpm4:amd64=1:3.5.12-1.1+deb12u1
137+
libxslt1.1:amd64=1.1.35-1+deb12u1
138+
libxxhash0:amd64=0.8.1-1
139+
libyuv0:amd64=0.0~git20230123.b2528b0-1
140+
libzstd1:amd64=1.5.4+dfsg2-5
141+
login=1:4.13+dfsg1-1+b1
142+
logsave=1.47.0-2
143+
lsb-release=12.0-1
144+
mawk=1.3.4.20200120-3.1
145+
media-types=10.0.0
146+
mount=2.38.1-5+deb12u3
147+
ncurses-base=6.4-4
148+
ncurses-bin=6.4-4
149+
nginx-module-geoip=1.27.4-1~bookworm
150+
nginx-module-image-filter=1.27.4-1~bookworm
151+
nginx-module-njs=1.27.4+0.8.9-1~bookworm
152+
nginx-module-xslt=1.27.4-1~bookworm
153+
nginx=1.27.4-1~bookworm
154+
openssl=3.0.16-1~deb12u1
155+
passwd=1:4.13+dfsg1-1+b1
156+
perl-base=5.36.0-7+deb12u1
157+
python3-acme=2.1.0-1
158+
python3-certbot=2.1.0-4
159+
python3-certifi=2022.9.24-1
160+
python3-cffi-backend:amd64=1.15.1-5+b1
161+
python3-chardet=5.1.0+dfsg-2
162+
python3-charset-normalizer=3.0.1-2
163+
python3-configargparse=1.5.3-1
164+
python3-configobj=5.0.8-1
165+
python3-cryptography=38.0.4-3+deb12u1
166+
python3-distro=1.8.0-1
167+
python3-distutils=3.11.2-3
168+
python3-idna=3.3-1+deb12u1
169+
python3-josepy=1.13.0-1
170+
python3-lib2to3=3.11.2-3
171+
python3-minimal=3.11.2-1+b1
172+
python3-openssl=23.0.0-1
173+
python3-parsedatetime=2.6-3
174+
python3-pip-whl=23.0.1+dfsg-1
175+
python3-pip=23.0.1+dfsg-1
176+
python3-pkg-resources=66.1.1-1+deb12u1
177+
python3-requests=2.28.1+dfsg-1
178+
python3-rfc3339=1.1-4
179+
python3-setuptools-whl=66.1.1-1+deb12u1
180+
python3-setuptools=66.1.1-1+deb12u1
181+
python3-six=1.16.0-4
182+
python3-tz=2022.7.1-4
183+
python3-urllib3=1.26.12-1+deb12u1
184+
python3-wheel=0.38.4-2
185+
python3.11-minimal=3.11.2-6+deb12u6
186+
python3.11-venv=3.11.2-6+deb12u6
187+
python3.11=3.11.2-6+deb12u6
188+
python3=3.11.2-1+b1
189+
readline-common=8.2-1.3
190+
sed=4.9-1
191+
sysvinit-utils=3.06-4
192+
tar=1.34+dfsg-1.2+deb12u1
193+
tzdata=2025b-0+deb12u1
194+
usr-is-merged=37~deb12u1
195+
util-linux-extra=2.38.1-5+deb12u3
196+
util-linux=2.38.1-5+deb12u3
197+
zlib1g:amd64=1:1.2.13.dfsg-1

‎launcher/Dockerfile‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,30 @@
11
FROM debian:bookworm-slim@sha256:4b44499bc2a6c78d726f3b281e6798009c0ae1f034b0bfaf6a227147dcff928b
22

3+
COPY pinned-packages.txt /tmp/
4+
35
# Use a specific Debian snapshot for reproducible builds
46
RUN set -e; \
57
# Create a sources.list file pointing to a specific snapshot
68
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/20250411T024939Z bookworm main' > /etc/apt/sources.list && \
79
echo 'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20250411T024939Z bookworm-security main' >> /etc/apt/sources.list && \
810
echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/10no-check-valid-until && \
11+
# Create preferences file to pin all packages
12+
mkdir -p /etc/apt/preferences.d && \
13+
cat /tmp/pinned-packages.txt | while read line; do \
14+
pkg=$(echo $line | cut -d= -f1); \
15+
ver=$(echo $line | cut -d= -f2); \
16+
if [ ! -z "$pkg" ] && [ ! -z "$ver" ]; then \
17+
echo "Package: $pkg\nPin: version $ver\nPin-Priority: 1001\n" >> /etc/apt/preferences.d/pinned-packages; \
18+
fi; \
19+
done && \
920
# Install packages with exact versions for reproducibility
10-
apt-get -o Acquire::Check-Valid-Until=false update && \
11-
apt-get install -y --no-install-recommends docker-compose=1.29.2-3 && \
21+
apt-get update && \
22+
apt-get install -y --no-install-recommends curl ca-certificates && \
23+
curl -L "https://github.com/docker/compose/releases/download/v2.24.6/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && \
24+
chmod +x /usr/local/bin/docker-compose && \
25+
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose && \
1226
rm -rf /var/lib/apt/lists/* && \
13-
rm -rf /var/log/* /var/cache/ldconfig/aux-cache
27+
rm -rf /var/log/* /var/cache/ldconfig/aux-cache /tmp/pinned-packages.txt
1428

1529
COPY entrypoint.sh get-latest.sh /scripts/
1630
RUN chmod +x /scripts/*.sh

‎launcher/build-image.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,8 @@ fi
88
if ! docker buildx inspect buildkit_20 &>/dev/null; then
99
docker buildx create --use --driver-opt image=moby/buildkit:v0.20.2 --name buildkit_20
1010
fi
11+
touch pinned-packages.txt
12+
git rev-parse HEAD > .GIT_REV
1113
docker buildx build --builder buildkit_20 --no-cache --build-arg SOURCE_DATE_EPOCH="0" --output type=docker,name=$NAME,rewrite-timestamp=true .
14+
docker run --rm --entrypoint bash $NAME -c "dpkg -l | grep '^ii' |awk '{print \$2\"=\"\$3}' | sort" > pinned-packages.txt
15+
rm .GIT_REV

0 commit comments

Comments
 (0)