ci/github: Build images natively

Signed-off-by: Ryan Northey <[email protected]>

Author: phlax

.github/workflows/_build_image.yml

@@ -23,9 +23,15 @@ on:
         type: string
         required: true
 
-      host_platform:
+      host-platform:
         type: string
-        default: ubuntu-22.04
+        required: true
+      target-platforms:
+        type: string
+        required: true
+      runs-on:
+        type: string
+        required: true
 
       go_version:
         type: string
@@ -38,14 +44,16 @@ on:
         type: string
         default:
 
+
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.distro }}-${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ inputs.distro }}-${{ inputs.host-platform }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   image:
-    runs-on: ${{ inputs.host_platform }}
-    name: Build and test Docker image
+    name: |
+      [${{ inputs.host-platform }}] Build and test Docker image
+    runs-on: ${{ inputs.runs-on }}
     steps:
     - uses: envoyproxy/toolshed/gh-actions/[email protected]
       name: 'Free disk space'
@@ -63,6 +71,7 @@ jobs:
       name: Build (${{ inputs.image_prefix }}${{ inputs.distro }}@${{ steps.container.outputs.tag }})
       shell: bash
       env:
+        BUILD_TOOLS_PLATFORMS: ${{ inputs.target-platforms  }}
         OS_FAMILY: ${{ inputs.os_family }}
         SOURCE_BRANCH: ${{ github.ref }}
         DOCKERHUB_USERNAME: ${{ secrets.dockerhub_username }}

.github/workflows/build.yml

@@ -20,21 +20,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-        - target: ubuntu
-          name: Linux Ubuntu
-          gcr_push: true
-        - target: debian
-          name: Linux Debian
-          gcr_push: true
+        target: [ubuntu, debian]
+        arch: [amd64, arm64]
     name: Build (${{ matrix.name || matrix.target }})
     uses: ./.github/workflows/_build_image.yml
     with:
       distro: ${{ matrix.target }}
-      gcr_push: ${{ matrix.gcr_push }}
+      gcr_push: true
       gcr_name: ${{ matrix.gcr_name != '' && matrix.gcr_name || 'envoy-build' }}
       os_family: ${{ matrix.os_family != '' && matrix.os_family || 'linux' }}
-      host_platform: ${{ matrix.host_platform != '' && matrix.host_platform || 'ubuntu-22.04' }}
+      host-platform: ${{ matrix.arch }}
+      runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-22.04' || 'ubuntu-22.04-arm' }}
+      target-platforms: ${{ matrix.arch == 'amd64' && 'linux/amd64' || 'linux/arm64' }}
     secrets:
       dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }}
       dockerhub_password: ${{ secrets.DOCKERHUB_PASSWORD }}

docker/linux/build.sh

@@ -6,16 +6,6 @@ UBUNTU_DOCKER_VARIANTS=("ci" "mobile" "test")
 IMAGE_TAGS=${IMAGE_TAGS:-}
 
 
-# Setting environments for buildx tools
-config_env() {
-    # Install QEMU emulators
-    docker run --rm --privileged tonistiigi/binfmt --install all
-
-    # Remove older build instance
-    docker buildx rm envoy-build-tools-builder &> /dev/null || :
-    docker buildx create --use --name envoy-build-tools-builder --platform "${BUILD_TOOLS_PLATFORMS}"
-}
-
 [[ -z "${OS_DISTRO}" ]] && OS_DISTRO="ubuntu"
 [[ -z "${IMAGE_NAME}" ]] && IMAGE_NAME="envoyproxy/envoy-build-${OS_DISTRO}"
 
@@ -27,7 +17,28 @@ if [[ -z "${BUILD_TOOLS_PLATFORMS}" ]]; then
     fi
 fi
 
-ci_log_run config_env
+HOST_ARCH="$(uname -m)"
+MULTI_ARCH=
+CROSS_ARCH=
+
+if [[ "$BUILD_TOOLS_PLATFORMS" == *","* ]]; then
+    MULTI_ARCH=true
+elif [[ "$HOST_ARCH" == "x86_64" && "$BUILD_TOOLS_PLATFORMS" != "linux/amd64" ]]; then
+    CROSS_ARCH=true
+elif [[ "$HOST_ARCH" == "aarch64" && "$BUILD_TOOLS_PLATFORMS" != "linux/arm64" ]]; then
+    CROSS_ARCH=true
+fi
+
+# Setting environments for buildx tools
+config_env() {
+    if [[ -n "$MULTI_ARCH" || -n "$CROSS_ARCH" ]]; then
+        # Install QEMU emulators
+        docker run --rm --privileged tonistiigi/binfmt --install all
+    fi
+    # Remove older build instance
+    docker buildx rm envoy-build-tools-builder &> /dev/null || :
+    docker buildx create --use --name envoy-build-tools-builder --platform "${BUILD_TOOLS_PLATFORMS}"
+}
 
 # TODO(phlax): add (json) build images config
 build_and_push_variants () {
@@ -44,10 +55,12 @@ build_and_push_variants () {
         fi
 
         if [[ "$variant" == "test" || "$variant" == "ci" ]]; then
-            platform="linux/amd64,linux/arm64"
-        else
-            # Only build variants for linux/amd64
+            platform="$BUILD_TOOLS_PLATFORMS"
+        elif [[ "$BUILD_TOOLS_PLATFORMS" == *"linux/amd64"* ]]; then
+            # devtools and mobile are amd64 only (matching original behavior for full/mobile)
             platform="linux/amd64"
+        else
+            continue
         fi
         ci_log_run docker buildx build . \
                    -f "${OS_DISTRO}/Dockerfile" \
@@ -58,6 +71,8 @@ build_and_push_variants () {
     done
 }
 
+ci_log_run config_env
+
 ci_log_run docker buildx build . -f "${OS_DISTRO}/Dockerfile" -t "${IMAGE_NAME}:${CONTAINER_TAG}" --target full --platform "${BUILD_TOOLS_PLATFORMS}"
 
 if [[ -z "${NO_BUILD_VARIANTS}" ]]; then
@@ -76,7 +91,7 @@ if [[ -n "${IMAGE_TAGS}" ]]; then
     done
 fi
 
-if [[ "$LOAD_IMAGE" == "true" ]]; then
+if [[ "$LOAD_IMAGE" == "true" && "$BUILD_TOOLS_PLATFORMS" == *"linux/amd64"*  ]]; then
     # Testing after push to save CI time because this invalidates arm64 cache
     ci_log_run docker buildx build . -f "${OS_DISTRO}/Dockerfile" -t "${IMAGE_NAME}:${CONTAINER_TAG}" --platform "linux/amd64" --load
 fi

docker/linux/debian_build.sh

@@ -7,29 +7,41 @@ DEBIAN_DOCKER_VARIANTS=("worker" "ci" "devtools" "mobile" "test")
 IMAGE_TAGS=${IMAGE_TAGS:-}
 OS_DISTRO="debian"
 
-# Setting environments for buildx tools
-config_env() {
-    # Install QEMU emulators
-    docker run --rm --privileged tonistiigi/binfmt --install all
-
-    # Remove older build instance
-    docker buildx rm envoy-build-tools-builder &> /dev/null || :
-    docker buildx create --use --name envoy-build-tools-builder --platform "${BUILD_TOOLS_PLATFORMS}"
-}
-
 [[ -z "${IMAGE_NAME}" ]] && IMAGE_NAME="envoyproxy/envoy-build"
 
 # Debian uses multi-arch builds
 if [[ -z "${BUILD_TOOLS_PLATFORMS}" ]]; then
     export BUILD_TOOLS_PLATFORMS=linux/arm64,linux/amd64
 fi
 
-ci_log_run config_env
+HOST_ARCH="$(uname -m)"
+MULTI_ARCH=
+CROSS_ARCH=
+
+if [[ "$BUILD_TOOLS_PLATFORMS" == *","* ]]; then
+    MULTI_ARCH=true
+elif [[ "$HOST_ARCH" == "x86_64" && "$BUILD_TOOLS_PLATFORMS" != "linux/amd64" ]]; then
+    CROSS_ARCH=true
+elif [[ "$HOST_ARCH" == "aarch64" && "$BUILD_TOOLS_PLATFORMS" != "linux/arm64" ]]; then
+    CROSS_ARCH=true
+fi
+
+# Setting environments for buildx tools
+config_env() {
+    if [[ -n "$MULTI_ARCH" || -n "$CROSS_ARCH" ]]; then
+        # Install QEMU emulators
+        docker run --rm --privileged tonistiigi/binfmt --install all
+    fi
+
+    # Remove older build instance
+    docker buildx rm envoy-build-tools-builder &> /dev/null || :
+    docker buildx create --use --name envoy-build-tools-builder --platform "${BUILD_TOOLS_PLATFORMS}"
+}
 
 # Build Debian variants with specific platform logic
 build_and_push_variants () {
     local variant="" platform push_arg
-    
+
     for variant in "${DEBIAN_DOCKER_VARIANTS[@]}"; do
         push_arg=()
         if [[ -n "${IMAGE_TAGS}" && "$variant" != "test" ]]; then
@@ -40,12 +52,13 @@ build_and_push_variants () {
 
         # Platform logic: worker, ci and test get multi-arch, others get amd64 only
         if [[ "$variant" == "test" || "$variant" == "ci" || "$variant" == "worker" ]]; then
-            platform="linux/amd64,linux/arm64"
-        else
+            platform="${BUILD_TOOLS_PLATFORMS}"
+        elif [[ "$BUILD_TOOLS_PLATFORMS" == *"linux/amd64"* ]]; then
             # devtools and mobile are amd64 only (matching original behavior for full/mobile)
             platform="linux/amd64"
+        else
+            continue
         fi
-        
         ci_log_run docker buildx build . \
                    -f "${OS_DISTRO}/Dockerfile" \
                    -t "${IMAGE_NAME}:${variant}-${CONTAINER_TAG}" \
@@ -55,6 +68,9 @@ build_and_push_variants () {
     done
 }
 
+
+ci_log_run config_env
+
 # Default target for Debian is 'ci' (includes bazel for builds)
 ci_log_run docker buildx build . -f "${OS_DISTRO}/Dockerfile" -t "${IMAGE_NAME}:${CONTAINER_TAG}" --target ci --platform "${BUILD_TOOLS_PLATFORMS}"
 
@@ -75,7 +91,6 @@ if [[ -n "${IMAGE_TAGS}" ]]; then
     done
 fi
 
-if [[ "$LOAD_IMAGE" == "true" ]]; then
-    # Testing after push to save CI time because this invalidates arm64 cache
+if [[ "$LOAD_IMAGE" == "true" && "$BUILD_TOOLS_PLATFORMS" == *"linux/amd64"*  ]]; then
     ci_log_run docker buildx build . -f "${OS_DISTRO}/Dockerfile" -t "${IMAGE_NAME}:${CONTAINER_TAG}" --target ci --platform "linux/amd64" --load
-fi
+fi