1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
|
#!/usr/bin/make -f
# Copyright 2019 The gVisor Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Described below.
OPTIONS :=
TARGETS := //runsc
ARGS :=
default: runsc
.PHONY: default
## usage: make <target>
## or
## make <build|test|copy|run|sudo> OPTIONS="..." TARGETS="..." ARGS="..."
##
## Basic targets.
##
## This Makefile wraps basic build and test targets for ease-of-use. Bazel
## is run inside a canonical Docker container in order to simplify up-front
## requirements.
##
## There are common arguments that may be passed to targets. These are:
## OPTIONS - Build or test options.
## TARGETS - The bazel targets.
## ARGS - Arguments for run or sudo.
##
## Additionally, the copy target expects a DESTINATION to be provided.
##
## For example, to build runsc using this Makefile, you can run:
## make build OPTIONS="" TARGETS="//runsc"'
##
help: ## Shows all targets and help from the Makefile (this message).
@grep --no-filename -E '^([a-z.A-Z_-]+:.*?|)##' $(MAKEFILE_LIST) | \
awk 'BEGIN {FS = "(:.*?|)## ?"}; { \
if (length($$1) > 0) { \
printf " \033[36m%-20s\033[0m %s\n", $$1, $$2; \
} else { \
printf "%s\n", $$2; \
} \
}'
build: ## Builds the given $(TARGETS) with the given $(OPTIONS). E.g. make build TARGETS=runsc
test: ## Tests the given $(TARGETS) with the given $(OPTIONS). E.g. make test TARGETS=pkg/buffer:buffer_test
copy: ## Copies the given $(TARGETS) to the given $(DESTINATION). E.g. make copy TARGETS=runsc DESTINATION=/tmp
run: ## Runs the given $(TARGETS), built with $(OPTIONS), using $(ARGS). E.g. make run TARGETS=runsc ARGS=-version
sudo: ## Runs the given $(TARGETS) as per run, but using "sudo -E". E.g. make sudo TARGETS=test/root:root_test ARGS=-test.v
.PHONY: help build test copy run sudo
# Load all bazel wrappers.
#
# This file should define the basic "build", "test", "run" and "sudo" rules, in
# addition to the $(BRANCH_NAME) variable.
ifneq (,$(wildcard tools/google.mk))
include tools/google.mk
else
include tools/bazel.mk
endif
##
## Docker image targets.
##
## Images used by the tests must also be built and available locally.
## The canonical test targets defined below will automatically load
## relevant images. These can be loaded or built manually via these
## targets.
##
## (*) Note that you may provide an ARCH parameter in order to build
## and load images from an alternate archiecture (using qemu). When
## bazel is run as a server, this has the effect of running an full
## cross-architecture chain, and can produce cross-compiled binaries.
##
define images
$(1)-%: ## Image tool: $(1) a given image (also may use 'all-images').
@$(MAKE) -C images $$@
endef
rebuild-...: ## Rebuild the given image. Also may use 'rebuild-all-images'.
$(eval $(call images,rebuild))
push-...: ## Push the given image. Also may use 'push-all-images'.
$(eval $(call images,pull))
pull-...: ## Pull the given image. Also may use 'pull-all-images'.
$(eval $(call images,push))
load-...: ## Load (pull or rebuild) the given image. Also may use 'load-all-images'.
$(eval $(call images,load))
list-images: ## List all available images.
@$(MAKE) -C images $$@
##
## Canonical build and test targets.
##
## These targets are used by continuous integration and provide
## convenient entrypoints for testing changes. If you're adding a
## new subsystem or workflow, consider adding a new target here.
##
runsc: ## Builds the runsc binary.
@$(MAKE) build TARGETS="//runsc"
.PHONY: runsc
smoke-test: ## Runs a simple smoke test after build runsc.
@$(MAKE) run DOCKER_PRIVILEGED="" ARGS="--alsologtostderr --network none --debug --TESTONLY-unsafe-nonroot=true --rootless do true"
.PHONY: smoke-tests
unit-tests: ## Runs all unit tests in pkg runsc and tools.
@$(MAKE) test OPTIONS="pkg/... runsc/... tools/..."
.PHONY: unit-tests
tests: ## Runs all local ptrace system call tests.
@$(MAKE) test OPTIONS="--test_tag_filters runsc_ptrace test/syscalls/..."
.PHONY: tests
##
## Website & documentation helpers.
##
## The website is built from repository documentation and wrappers, using
## using a locally-defined Docker image (see images/jekyll). The following
## variables may be set when using website-push:
## WEBSITE_IMAGE - The name of the container image.
## WEBSITE_SERVICE - The backend service.
## WEBSITE_PROJECT - The project id to use.
## WEBSITE_REGION - The region to deploy to.
##
WEBSITE_IMAGE := gcr.io/gvisordev/gvisordev
WEBSITE_SERVICE := gvisordev
WEBSITE_PROJECT := gvisordev
WEBSITE_REGION := us-central1
website-build: load-jekyll ## Build the site image locally.
@$(MAKE) run TARGETS="//website:website"
.PHONY: website-build
website-server: website-build ## Run a local server for development.
@docker run -i -p 8080:8080 gvisor.dev/images/website
.PHONY: website-server
website-push: website-build ## Push a new image and update the service.
@docker tag gvisor.dev/images/website $(WEBSITE_IMAGE) && docker push $(WEBSITE_IMAGE)
.PHONY: website-push
website-deploy: website-push ## Deploy a new version of the website.
@gcloud run deploy $(WEBSITE_SERVICE) --platform=managed --region=$(WEBSITE_REGION) --project=$(WEBSITE_PROJECT) --image=$(WEBSITE_IMAGE)
.PHONY: website-push
##
## Repository builders.
##
## This builds a local apt repository. The following variables may be set:
## RELEASE_ROOT - The repository root (default: "repo" directory).
## RELEASE_KEY - The repository GPG private key file (default: dummy key is created).
## RELEASE_NIGHTLY - Set to true if a nightly release (default: false).
##
RELEASE_ROOT := $(CURDIR)/repo
RELEASE_KEY := repo.key
RELEASE_NIGHTLY := false
$(RELEASE_KEY):
@echo "WARNING: Generating a key for testing ($@); don't use this."
T=$$(mktemp /tmp/keyring.XXXXXX); \
gpg --no-default-keyring --keyring $$T --batch --passphrase "" --quick-generate-key $(shell whoami) && \
gpg --export-secret-keys --no-default-keyring --keyring $$T > $@; \
rc=$$?; rm -f $$T; exit $$rc
release: $(RELEASE_KEY) ## Builds a release.
@mkdir -p $(RELEASE_ROOT)
@T=$$(mktemp -d /tmp/release.XXXXXX); \
$(MAKE) copy TARGETS="runsc" DESTINATION=$$T && \
$(MAKE) copy TARGETS="runsc:runsc-debian" DESTINATION=$$T && \
NIGHTLY=$(RELEASE_NIGHTLY) tools/make_release.sh $(RELEASE_KEY) $(RELEASE_ROOT) $$T/*; \
rc=$$?; rm -rf $$T; exit $$rc
.PHONY: release
##
## Development helpers and tooling.
##
## These targets faciliate local development by automatically
## installing and configuring a runtime. Several variables may
## be used here to tweak the installation:
## RUNTIME - The name of the installed runtime (default: branch).
## RUNTIME_DIR - Where the runtime will be installed (default: temporary directory with the $RUNTIME).
## RUNTIME_BIN - The runtime binary (default: $RUNTIME_DIR/runsc).
## RUNTIME_LOG_DIR - The logs directory (default: $RUNTIME_DIR/logs).
## RUNTIME_LOGS - The log pattern (default: $RUNTIME_LOG_DIR/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%).
##
ifeq (,$(BRANCH_NAME))
RUNTIME := runsc
RUNTIME_DIR := $(shell dirname $(shell mktemp -u))/runsc
else
RUNTIME := $(BRANCH_NAME)
RUNTIME_DIR := $(shell dirname $(shell mktemp -u))/$(BRANCH_NAME)
endif
RUNTIME_BIN := $(RUNTIME_DIR)/runsc
RUNTIME_LOG_DIR := $(RUNTIME_DIR)/logs
RUNTIME_LOGS := $(RUNTIME_LOG_DIR)/runsc.log.%TEST%.%TIMESTAMP%.%COMMAND%
dev: ## Installs a set of local runtimes. Requires sudo.
@$(MAKE) refresh ARGS="--net-raw"
@$(MAKE) configure RUNTIME="$(RUNTIME)" ARGS="--net-raw"
@$(MAKE) configure RUNTIME="$(RUNTIME)-d" ARGS="--net-raw --debug --strace --log-packets"
@$(MAKE) configure RUNTIME="$(RUNTIME)-p" ARGS="--net-raw --profile"
@sudo systemctl restart docker
.PHONY: dev
refresh: ## Refreshes the runtime binary (for development only). Must have called 'dev' or 'test-install' first.
@mkdir -p "$(RUNTIME_DIR)"
@$(MAKE) copy TARGETS=runsc DESTINATION="$(RUNTIME_BIN)" && chmod 0755 "$(RUNTIME_BIN)"
.PHONY: install
test-install: ## Installs the runtime for testing. Requires sudo.
@$(MAKE) refresh ARGS="--net-raw --TESTONLY-test-name-env=RUNSC_TEST_NAME --debug --strace --log-packets $(ARGS)"
@$(MAKE) configure
@sudo systemctl restart docker
.PHONY: install-test
configure: ## Configures a single runtime. Requires sudo. Typically called from dev or test-install.
@sudo sudo "$(RUNTIME_BIN)" install --experimental=true --runtime="$(RUNTIME)" -- --debug-log "$(RUNTIME_LOGS)" $(ARGS)
@echo "Installed runtime \"$(RUNTIME)\" @ $(RUNTIME_BIN)"
@echo "Logs are in: $(RUNTIME_LOG_DIR)"
@sudo rm -rf "$(RUNTIME_LOG_DIR)" && mkdir -p "$(RUNTIME_LOG_DIR)"
.PHONY: configure
test-runtime: ## A convenient wrapper around test that provides the runtime argument. Target must still be provided.
@$(MAKE) test OPTIONS="$(OPTIONS) --test_arg=--runtime=$(RUNTIME)"
.PHONY: runtime-test
|
