fix(IDX): update build-ic script to correctly check container logic (#8413)

cgundy · web-flow · commit 854cb5b88363 · 2026-01-19T15:38:02.000Z
Reverts #8404 This reverts the revert, but updates the script logic to now be: 1. If you are in a container, but not the DFINITY container, error out 2. If you are not in a container, drop into the DFINITY container 3. if you are inside the DFINITY container, continue
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a",
+  "image": "ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 90
diff --git a/.github/workflows/ci-pr-only.yml b/.github/workflows/ci-pr-only.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     steps:
diff --git a/.github/workflows/pocket-ic-tests-windows.yml b/.github/workflows/pocket-ic-tests-windows.yml
@@ -45,7 +45,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 90
diff --git a/.github/workflows/rate-limits-backend-release.yml b/.github/workflows/rate-limits-backend-release.yml
@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
 
diff --git a/.github/workflows/release-testing.yml b/.github/workflows/release-testing.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 180
diff --git a/.github/workflows/rosetta-release.yml b/.github/workflows/rosetta-release.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     environment: DockerHub
diff --git a/.github/workflows/salt-sharing-canister-release.yml b/.github/workflows/salt-sharing-canister-release.yml
@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
 
diff --git a/.github/workflows/schedule-daily.yml b/.github/workflows/schedule-daily.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/schedule-rust-bench.yml b/.github/workflows/schedule-rust-bench.yml
@@ -24,7 +24,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       # running on bare metal machine using ubuntu user
       options: --user ubuntu --mount type=tmpfs,target="/home/ubuntu/.local/share/containers"
     timeout-minutes: 720 # 12 hours
diff --git a/.github/workflows/schedule-weekly.yml b/.github/workflows/schedule-weekly.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 60 # 1 hour
diff --git a/.github/workflows/update-mainnet-canister-revisions.yaml b/.github/workflows/update-mainnet-canister-revisions.yaml
@@ -25,7 +25,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a
+      image: ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     env:
diff --git a/ci/container/Dockerfile b/ci/container/Dockerfile
@@ -8,7 +8,7 @@ ARG PACKAGE_FILE=ci/container/files/packages.common
 COPY ${PACKAGE_FILE} /tmp/
 COPY ./ci/container/files/gitconfig /etc/gitconfig
 COPY ./ci/container/files/containers.conf /etc/containers/containers.conf
-COPY ./ci/container/TAG /home/ubuntu/.DFINITY-TAG
+ENV DFINITY_CONTAINER=true
 
 # Todo: split out essential packages from application-level packages
 RUN export DEBIAN_FRONTEND=noninteractive && ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
diff --git a/ci/container/TAG b/ci/container/TAG
@@ -1 +1 @@
-057e56cf5ed9e5dafad7526846b8f476c316d689ebccf1b5504dfc5bff885a30
+93b0b3a6f186b9db017d3c6f6de5cf95ace497cef2a48ec346ce4f068b1bbdfe
diff --git a/ci/container/build-ic.sh b/ci/container/build-ic.sh
@@ -12,9 +12,14 @@ export BUILD_IC_NESTED=1
 
 export ROOT_DIR="$(git rev-parse --show-toplevel)"
 
-# Drop into the container if we're not already inside it. This ensures
-# we run in a predictable environment (Ubuntu with known deps).
-if ! ([ -e /home/ubuntu/.DFINITY-TAG ] && ([ -e /.dockerenv ] || [ -e /run/.containerenv ] || [ -n "${CI_JOB_NAME:-}" ])); then
+# If running in the wrong container, abort.
+# if not running in a container, drop into the correct container.
+if ([ -e /.dockerenv ] || [ -e /run/.containerenv ]); then
+    if [ -z "${DFINITY_CONTAINER:-}" ]; then
+        echo "ERROR: Detected container environment, but not running in the DFINITY container. Please exit your container and rerun the script."
+        exit 1
+    fi
+else
     echo dropping into container
     exec "$ROOT_DIR"/ci/container/container-run.sh bash "$0" "$@"
 fi

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`{`
`2`		`- "image": "ghcr.io/dfinity/ic-build@sha256:77078e5579d70f97b177ffb5265d08163da65e0e6743376a164c7348c9aa475a",`
	`2`	`+ "image": "ghcr.io/dfinity/ic-build@sha256:4a80139e1172d1eb886db6511ac4ce8bc151c8904ce06606595f15f18e163faf",`
`3`	`3`	`"remoteUser": "ubuntu",`
`4`	`4`	`"privileged": true,`
`5`	`5`	`"runArgs": [`