mirror of
https://github.com/sigp/lighthouse.git
synced 2026-03-02 16:21:42 +00:00
1e6cdeb88a
Which issue # does this PR address? This PR addresses reproducible builds. The current dockerfile builds the lighthouse binary but not reproducibly. You can verify that by following these steps: ``` docker build --no-cache --output=. . mv usr/local/bin/lighthouse lighthouse1 rm usr/local/bin/lighthouse docker build --no-cache --output=. . mv usr/local/bin/lighthouse lighthouse2 sha256sum lighthouse1 lighthouse2 ``` You will notice that each one of the binaries has a different checksum upon each build. This is critical for systems that depends on requiring reproducible builds, such as running lighthouse in confidential computing, like Intel TDX. This PR adds a new build profile as well as a Dockerfile.reproducible that enables building the lighthouse binary reproducibly. By following the steps I listed above, you will be able to verify that the resulted binary has the same hash upon several subsequent builds for the same version. How to test it: ``` mkdir output1 output2 docker build --no-cache -f Dockerfile.reproducible --output=output1 . docker build --no-cache -f Dockerfile.reproducible --output=output2 . sha256sum output1/lighthouse output2/lighthouse # hashes should be identical rm -rf output1 output2 ```
45 lines
1.5 KiB
Docker
45 lines
1.5 KiB
Docker
# Define the Rust image as an argument with a default to x86_64 Rust 1.82 image based on Debian Bullseye
|
|
ARG RUST_IMAGE="rust:1.82-bullseye@sha256:ac7fe7b0c9429313c0fe87d3a8993998d1fe2be9e3e91b5e2ec05d3a09d87128"
|
|
FROM ${RUST_IMAGE} AS builder
|
|
|
|
# Install specific version of the build dependencies
|
|
RUN apt-get update && apt-get install -y libclang-dev=1:11.0-51+nmu5 cmake=3.18.4-2+deb11u1
|
|
|
|
# Add target architecture argument with default value
|
|
ARG RUST_TARGET="x86_64-unknown-linux-gnu"
|
|
|
|
# Copy the project to the container
|
|
COPY . /app
|
|
WORKDIR /app
|
|
|
|
# Get the latest commit timestamp and set SOURCE_DATE_EPOCH (default it to 0 if not passed)
|
|
ARG SOURCE_DATE=0
|
|
|
|
# Set environment variables for reproducibility
|
|
ARG RUSTFLAGS="-C link-arg=-Wl,--build-id=none -C metadata='' --remap-path-prefix $(pwd)=."
|
|
ENV SOURCE_DATE_EPOCH=$SOURCE_DATE \
|
|
CARGO_INCREMENTAL=0 \
|
|
LC_ALL=C \
|
|
TZ=UTC \
|
|
RUSTFLAGS="${RUSTFLAGS}"
|
|
|
|
# Set the default features if not provided
|
|
ARG FEATURES="gnosis,slasher-lmdb,slasher-mdbx,slasher-redb,jemalloc"
|
|
|
|
# Set the default profile if not provided
|
|
ARG PROFILE="reproducible"
|
|
|
|
# Build the project with the reproducible settings
|
|
RUN cargo build --bin lighthouse \
|
|
--features "${FEATURES}" \
|
|
--profile "${PROFILE}" \
|
|
--locked \
|
|
--target "${RUST_TARGET}"
|
|
|
|
RUN mv /app/target/${RUST_TARGET}/${PROFILE}/lighthouse /lighthouse
|
|
|
|
# Create a minimal final image with just the binary
|
|
FROM gcr.io/distroless/cc-debian12:nonroot-6755e21ccd99ddead6edc8106ba03888cbeed41a
|
|
COPY --from=builder /lighthouse /lighthouse
|
|
ENTRYPOINT [ "/lighthouse" ]
|