构建理想容器镜像——以CSI为例

skopeo copy --override-os linux docker://registry.k8s.io/cloud-provider-gcp/gcp-compute-persistent-disk-csi-driver:v1.15.1 oci:gcpls gcp/blobs/sha256 | wc -l

syft oci-dir:gcp

#!/bin/bashset -e
# This directory is distroless specific, and recognized by syftmkdir -p /staging-node/var/lib/dpkg/status.d
DEPS=(    /etc/mke2fs.conf /sbin/{fsck,mkfs,mount,umount}.{ext{2,3,4},xfs,nfs}    /usr/bin/{mount,umount,lspci,mkdir,chmod,grep,tail,nsenter}    /usr/sbin/{fsck,mkfs,sfdisk,losetup,blockdev}    /sbin/dumpe2fs /sbin/resize2fs    /usr/sbin/xfs_io /usr/sbin/xfs_growfs)
declare -A FILE_PACKAGESfor line in $(dpkg-query --show --showformat 'PKG_NAME:${Package}\n${db-fsys:Files}'); do    if [[ "$line" = PKG_NAME:* ]]; then        pkg=${line#PKG_NAME:}    else        FILE_PACKAGES[$line]=$pkg    fidoneecho "indexed ${#FILE_PACKAGES[@]} files"
MTIME=0gather_dep() {    local source target t pkg copyright    # resolve all but last component of symlink    source=$(realpath "$(dirname "$1")")/$(basename "$1")
    # find the package that contains the source    pkg=${FILE_PACKAGES[$source]}    if [ -z "$pkg" ] && [[ "$source" = /usr/* ]]; then        # retry without /usr prefix        # use source path matching dpkg for SBOM to work, because /lib is not linked to /usr/lib in distroless        source="${source#/usr}"        pkg=${FILE_PACKAGES[$source]}    fi    if [ -z "$pkg" ]; then        echo "failed to find package for $source"        return 1    fi    if [ -e "/base$source" ]; then        echo "$source already exist in base"        return 0    fi
    [ -e "/staging-node$source" ] && return 0    if [ -h "$source" ]; then        target=$(realpath "$source")        echo "gathering link $source => $target"        gather_dep "$target"    fi    echo "gathering dep $pkg: $source"    t=$(stat -c '%Y' "$source")    [ "$t" -gt "$MTIME" ] && MTIME=$t    cp -dp --parents "$source" /staging-node
    # deb package metadata is useful for SBOM    [ -e "/staging-node/var/lib/dpkg/status.d/$pkg" ] && return 0    echo "installing deb package $pkg metadata"    dpkg-query --status "$pkg" > "/staging-node/var/lib/dpkg/status.d/$pkg"    dpkg-query --control-show "$pkg" md5sums > "/staging-node/var/lib/dpkg/status.d/$pkg.md5sums"    copyright="/usr/share/doc/$pkg/copyright"    if [ -e "$copyright" ]; then        echo "installing deb package $pkg copyright"        cp -dp --parents "$copyright" /staging-node    fi}for f in "${DEPS[@]}"; do    if ! [ -e "$f" ]; then        echo "$f does not exist"        continue    fi    gather_dep "$f"done
mapfile -t LIBS < <(ldd /staging-node/{usr/,}{bin,sbin}/* 2>/dev/null | grep -Po '(?<= => )[^ ]+' | sort -u)for f in "${LIBS[@]}"; do    gather_dep "$f"doneecho "latest mtime is $(date --date "@$MTIME" --iso-8601=seconds)"find /staging-node -type d -exec touch --date="@$MTIME" {} +touch --date="@$MTIME" /staging-node/var/lib/dpkg/status.d/*

echo 'Acquire::Check-Valid-Until false;' > /etc/apt/apt.conf.d/snapshot && \sed -i '/^URIs:/d; s|^# \(http://snapshot.debian.org/\)|URIs: \1|' /etc/apt/sources.list.d/debian.sources && \apt-get update

FROM build-0 as build-util-linux-amd64ENV HOST=x86_64-linux-gnu
FROM build-0 as build-util-linux-arm64ENV HOST=aarch64-linux-gnu
FROM build-util-linux-$TARGETARCH as build-util-linuxARG BUILDARCHRUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=apt-cache-$BUILDARCH \    --mount=type=cache,target=/var/lib/apt,sharing=locked,id=apt-lib-$BUILDARCH <<EOF#!/bin/bashapt-get update && apt-get install -y gcc-${HOST//_/-}EOF

ADD --link --checksum=sha256:59e676aa53ccb44b6c39f0ffe01a8fa274891c91bef1474752fad92461def24f \    https://www.kernel.org/pub/linux/utils/util-linux/v2.40/util-linux-2.40.1.tar.xz /src.tar.xzRUN mkdir -p /src && tar -C /src --strip-components=1 -xf /src.tar.xz
RUN <<EOFset -ecd /srcSOURCE_DATE_EPOCH=$(stat -c %Y /src.tar.xz)export SOURCE_DATE_EPOCHecho "util-linux released at $(date --date "@$SOURCE_DATE_EPOCH" --iso-8601=seconds)"./configure --disable-all-programs --enable-blkid --enable-libblkid --prefix=/usr/local \    --disable-nls --disable-bash-completion --disable-asciidoc --disable-dependency-tracking --disable-static --host=$HOSTmake -jmake install-strip DESTDIR=/outcd /out/usr/local && rm -r include share lib/pkgconfigEOF

FROM --platform=$BUILDPLATFORM golang:1.22.3 as buildWORKDIR /go/src/github.com/kubernetes-sigs/alibaba-cloud-csi-driverARG TARGETARCHARG TARGETOSRUN --mount=type=bind,target=. \    --mount=type=cache,target=/root/.cache/go-build \    GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 \    go build -o /out/plugin.csi.alibabacloud.com

FROM debian:bookworm-20241016-slim as debian
ARG TARGETARCHRUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=apt-cache-$TARGETARCH \    --mount=type=cache,target=/var/lib/apt,sharing=locked,id=apt-lib-$TARGETARCH \    rm -f /etc/apt/apt.conf.d/docker-clean && \    echo 'Acquire::Check-Valid-Until false;' > /etc/apt/apt.conf.d/snapshot && \    sed -i '/^URIs:/d; s|^# \(http://snapshot.debian.org/\)|URIs: \1|' /etc/apt/sources.list.d/debian.sources && \    apt-get update && \    apt-get install -y nfs-common e2fsprogs xfsprogs pciutils fdisk

skopeo copy --override-os linux docker://$IMAGE oci-archive:csi.tarls -lh csi.tar

podman pull $IMAGEpodman images $IMAGE