Skip to content

Use Network Isolation-compatible package feeds #7297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lbussell wants to merge 6 commits into
base: nightly
Choose a base branch
from
Open

Use Network Isolation-compatible package feeds #7297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
70f61d1
Use Network Isolation-compatible APT feeds
lbussell Jul 21, 2026
e3503d4
Redirect Debian security feeds during builds
lbussell Jul 22, 2026
2324975
Enable all CFSClean policies for unofficial validation
lbussell Jul 22, 2026
57aa040
Use Azure Ubuntu mirror for arm64 builds
lbussell Jul 23, 2026
df27826
Use patched Chisel for isolated builds
lbussell Jul 23, 2026
a5381c0
Move isolated APT mirrors to manifest
lbussell Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 27 additions & 2 deletions eng/dockerfile-templates/Dockerfile.linux.install-pkgs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,25 @@
set isDnf to ARGS["pkg-mgr"] = "dnf" || (isAzureLinux && !isAzureLinux3 && ARGS["pkg-mgr"] != "tdnf") ^
set isTdnf to ARGS["pkg-mgr"] = "tdnf" || (!isDnf && isAzureLinux) ^
set isApk to ARGS["pkg-mgr"] = "apk" || isAlpine ^

_ Temporarily use Network Isolation-compatible mirrors during APT installs. Restore
the original source files and metadata before the RUN completes so published images
retain their distro-provided configuration. Ubuntu armhf and chiseled images are excluded. ^
set isUbuntu to find(OS_ARCH_HYPHENATED, "Ubuntu") >= 0 ^
set isDebian to find(OS_ARCH_HYPHENATED, "Debian") >= 0 ^
set aptFeedFrom to when(isUbuntu,
VARIABLES[cat("apt-mirror|ubuntu|", ARCH_SHORT, "|from")],
when(isDebian,
VARIABLES[cat("apt-mirror|debian|", ARCH_SHORT, "|from")],
"")) ^
set aptMirrorFrom to replace(aptFeedFrom, ".", "\.") ^
set aptMirrorTo to when(isUbuntu,
VARIABLES[cat("apt-mirror|ubuntu|", ARCH_SHORT, "|to")],
when(isDebian,
VARIABLES[cat("apt-mirror|debian|", ARCH_SHORT, "|to")],
"")) ^
set useAptMirror to len(aptMirrorFrom) > 0 ^

set appendPkgSuffix(pkg, index) to:{{
_ Don't apply a space and continuation character after the package text if it's a comment or
the last of the Alpine packages ^
Expand All @@ -20,10 +39,16 @@
if isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^
elif isApk:apk add --upgrade --no-cache{{ARGS["pkg-mgr-opts"]}} \^
elif isTdnf:tdnf install -y{{ARGS["pkg-mgr-opts"]}} \^
else:apt-get update \
else:{{if useAptMirror:__netiso_apt_srcs="$(find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \))" \
&& __netiso_backup_dir="$(mktemp -d)" \
&& for f in $__netiso_apt_srcs; do cp -a --parents "$f" "$__netiso_backup_dir" || exit 1; done \
&& for f in $__netiso_apt_srcs; do sed -E -i 's#([[:space:]/]){{aptMirrorFrom}}([[:space:]/-]|$)#\1{{aptMirrorTo}}\2#g' "$f" || exit 1; done \
&& }}apt-get update \
&& apt-get install -y --no-install-recommends{{ARGS["pkg-mgr-opts"]}} \}}{{
for index, pkg in ARGS["pkgs"]:
{{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if !ARGS["no-clean"]:{{
{{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if useAptMirror:
&& for f in $__netiso_apt_srcs; do cp -a "$__netiso_backup_dir$f" "$f" || exit 1; done \
&& rm -rf "$__netiso_backup_dir" \}}{{if !ARGS["no-clean"]:{{
if isTdnf:
&& tdnf clean all{{ARGS["pkg-mgr-opts"]}}^
elif isDnf:
Expand Down
38 changes: 17 additions & 21 deletions eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,14 @@
set osVersionBase to match(OS_VERSION, ".+(?=.*-)")[0] ^
set osVersionNumber to split(OS_ARCH_HYPHENATED, "-")[1] ^

set chiselUrl to VARIABLES[cat("chisel|", dotnetVersion, "|", ARCH_SHORT, "|url")] ^
set chiselFileName to "chisel.tar.gz" ^
set shaFunction to "384" ^
set chiselSha to VARIABLES[cat("chisel|", dotnetVersion, "|", ARCH_SHORT, "|sha", shaFunction)] ^
set chiselCommit to VARIABLES[cat("chisel|", dotnetVersion, "|commit")] ^
set ubuntuAptFeed to VARIABLES["apt-mirror|ubuntu|x64|from"] ^
set ubuntuAptMirror to VARIABLES["apt-mirror|ubuntu|x64|to"] ^
Comment on lines +11 to +12

@mthalman mthalman Jul 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is hardcoding the architecture.

set rocksToolboxBaseUrl to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|url")] ^
set rocksToolboxRef to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|version")] ^
set rocksToolboxUrl to cat(rocksToolboxBaseUrl, "/", rocksToolboxRef, "/chisel-wrapper") ^

set installerImageTag to cat(ARCH_VERSIONED, "/buildpack-deps:", osVersionBase, "-curl") ^
set installerImageTag to VARIABLES[cat("chisel|", dotnetVersion, "|golang-image")] ^

set opensslPkg to when(match(osVersionBase, "jammy"), "libssl3", "libssl3t64") ^

Expand Down Expand Up @@ -62,24 +61,21 @@

}}FROM {{installerImageTag}} AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*
Comment on lines +64 to +66

@mthalman mthalman Jul 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Presumably this will be hitting deb.debian.org, not the Azure URL.


RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin {{chiselCommit}} \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://{{ubuntuAptFeed}}/|http://{{ubuntuAptMirror}}/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

@mthalman mthalman Jul 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we also need approved package feeds for Go? This ends up downloading modules.


RUN {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
"url": chiselUrl,
"out-file": chiselFileName
]]], " ")}} \
&& {{InsertTemplate("../Dockerfile.linux.validate-checksum", [
"file": chiselFileName,
"sha-function": shaFunction,
"sha": chiselSha,
"sha-var-name": cat("chisel_sha", shaFunction)
], " ")}} \
&& {{InsertTemplate("../Dockerfile.linux.extract-file", [
"file": chiselFileName,
"dest-dir": "/usr/bin/"
], " ")}} \
&& rm {{chiselFileName}} \
&& {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
"url": rocksToolboxUrl,
"out-file": "/usr/bin/chisel-wrapper"
]]], " ")}} \
Expand Down
1 change: 1 addition & 0 deletions eng/pipelines/dotnet-docker-nightly-unofficial.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ resources:
extends:
template: /eng/docker-tools/templates/1es.yml@self
parameters:
networkIsolationPolicy: Permissive,CFSClean,CFSClean2,CFSClean3
reposToExcludeFromScanning:
- VersionsRepo
stages:
Expand Down
56 changes: 23 additions & 33 deletions manifest.versions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,19 @@
"alpine|9.0|floating-tag-version": "$(alpine|floating-tag-version)",
"alpine|8.0|floating-tag-version": "$(alpine|floating-tag-version)",

"apt-mirror|debian|x64|from": "deb.debian.org/debian",
"apt-mirror|debian|x64|to": "debian-archive.trafficmanager.net/debian",
"apt-mirror|debian|arm|from": "deb.debian.org/debian",
"apt-mirror|debian|arm|to": "cdn-fastly.deb.debian.org/debian",
"apt-mirror|debian|arm64|from": "deb.debian.org/debian",
"apt-mirror|debian|arm64|to": "debian-archive.trafficmanager.net/debian",
"apt-mirror|ubuntu|x64|from": "archive.ubuntu.com/ubuntu",
"apt-mirror|ubuntu|x64|to": "azure.archive.ubuntu.com/ubuntu",
"apt-mirror|ubuntu|arm|from": "ports.ubuntu.com/ubuntu-ports",
"apt-mirror|ubuntu|arm|to": "azure.ports.ubuntu.com/ubuntu-ports",
"apt-mirror|ubuntu|arm64|from": "ports.ubuntu.com/ubuntu-ports",
"apt-mirror|ubuntu|arm64|to": "azure.ports.ubuntu.com/ubuntu-ports",

"aspire-dashboard|build-version": "13.5.0-preview.1.26359.7",
"aspire-dashboard|product-version": "13.5.0",
"aspire-dashboard|fixed-tag": "13.5.0",
Expand All @@ -43,39 +56,16 @@
"aspnet|11.0|build-version": "11.0.0-preview.6.26359.118",
"aspnet-composite|11.0|build-version": "$(aspnet|11.0|build-version)",

"chisel|latest|build-version": "v1.4.2",
"chisel|latest|x64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_amd64.tar.gz",
"chisel|latest|arm|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_arm.tar.gz",
"chisel|latest|arm64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_arm64.tar.gz",
"chisel|11.0|build-version": "$(chisel|latest|build-version)",
"chisel|11.0|x64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|11.0|build-version)/chisel_$(chisel|11.0|build-version)_linux_amd64.tar.gz",
"chisel|11.0|arm|url": "https://github.com/canonical/chisel/releases/download/$(chisel|11.0|build-version)/chisel_$(chisel|11.0|build-version)_linux_arm.tar.gz",
"chisel|11.0|arm64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|11.0|build-version)/chisel_$(chisel|11.0|build-version)_linux_arm64.tar.gz",
"chisel|10.0|x64|url": "$(chisel|latest|x64|url)",
"chisel|10.0|arm|url": "$(chisel|latest|arm|url)",
"chisel|10.0|arm64|url": "$(chisel|latest|arm64|url)",
"chisel|9.0|x64|url": "$(chisel|latest|x64|url)",
"chisel|9.0|arm|url": "$(chisel|latest|arm|url)",
"chisel|9.0|arm64|url": "$(chisel|latest|arm64|url)",
"chisel|8.0|x64|url": "$(chisel|latest|x64|url)",
"chisel|8.0|arm|url": "$(chisel|latest|arm|url)",
"chisel|8.0|arm64|url": "$(chisel|latest|arm64|url)",

"chisel|latest|x64|sha384": "8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6",
"chisel|latest|arm|sha384": "64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78",
"chisel|latest|arm64|sha384": "216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297",
"chisel|11.0|x64|sha384": "$(chisel|latest|x64|sha384)",
"chisel|11.0|arm|sha384": "$(chisel|latest|arm|sha384)",
"chisel|11.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
"chisel|10.0|x64|sha384": "$(chisel|latest|x64|sha384)",
"chisel|10.0|arm|sha384": "$(chisel|latest|arm|sha384)",
"chisel|10.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
"chisel|9.0|x64|sha384": "$(chisel|latest|x64|sha384)",
"chisel|9.0|arm|sha384": "$(chisel|latest|arm|sha384)",
"chisel|9.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
"chisel|8.0|x64|sha384": "$(chisel|latest|x64|sha384)",
"chisel|8.0|arm|sha384": "$(chisel|latest|arm|sha384)",
"chisel|8.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
"chisel|latest|commit": "1262471cb663f57f3e201f100019f9bf5b4a7d4f",
"chisel|latest|golang-image": "mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm",
"chisel|11.0|commit": "$(chisel|latest|commit)",
"chisel|11.0|golang-image": "$(chisel|latest|golang-image)",
"chisel|10.0|commit": "$(chisel|latest|commit)",
"chisel|10.0|golang-image": "$(chisel|latest|golang-image)",
"chisel|9.0|commit": "$(chisel|latest|commit)",
"chisel|9.0|golang-image": "$(chisel|latest|golang-image)",
"chisel|8.0|commit": "$(chisel|latest|commit)",
"chisel|8.0|golang-image": "$(chisel|latest|golang-image)",

"dotnet|8.0|product-version": "8.0.29",
"dotnet|8.0|fixed-tag": "$(dotnet|8.0|product-version)",
Expand Down
23 changes: 15 additions & 8 deletions src/runtime-deps/10.0/noble-chiseled-extra/amd64/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,20 @@
FROM amd64/buildpack-deps:noble-curl AS chisel
FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*

RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
&& chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
&& echo "$chisel_sha384 chisel.tar.gz" | sha384sum -c - \
&& tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
&& rm chisel.tar.gz \
&& curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
&& chmod 755 /usr/bin/chisel-wrapper

RUN groupadd \
Expand Down
23 changes: 15 additions & 8 deletions src/runtime-deps/10.0/noble-chiseled-extra/arm32v7/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,20 @@
FROM arm32v7/buildpack-deps:noble-curl AS chisel
FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*

RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
&& chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
&& echo "$chisel_sha384 chisel.tar.gz" | sha384sum -c - \
&& tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
&& rm chisel.tar.gz \
&& curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
&& chmod 755 /usr/bin/chisel-wrapper

RUN groupadd \
Expand Down
23 changes: 15 additions & 8 deletions src/runtime-deps/10.0/noble-chiseled-extra/arm64v8/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,20 @@
FROM arm64v8/buildpack-deps:noble-curl AS chisel
FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*

RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
&& chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
&& echo "$chisel_sha384 chisel.tar.gz" | sha384sum -c - \
&& tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
&& rm chisel.tar.gz \
&& curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
&& chmod 755 /usr/bin/chisel-wrapper

RUN groupadd \
Expand Down
23 changes: 15 additions & 8 deletions src/runtime-deps/10.0/noble-chiseled/amd64/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,20 @@
FROM amd64/buildpack-deps:noble-curl AS chisel
FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*

RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_amd64.tar.gz \
&& chisel_sha384='8e5e8df4dc783dcfa827ca9990ba871af350738de67c51706b3c06bfd4725ab0edbddd9ad4110d1047ecfdc586f7dac6' \
&& echo "$chisel_sha384 chisel.tar.gz" | sha384sum -c - \
&& tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
&& rm chisel.tar.gz \
&& curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
&& chmod 755 /usr/bin/chisel-wrapper

RUN groupadd \
Expand Down
23 changes: 15 additions & 8 deletions src/runtime-deps/10.0/noble-chiseled/arm32v7/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,20 @@
FROM arm32v7/buildpack-deps:noble-curl AS chisel
FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*

RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm.tar.gz \
&& chisel_sha384='64564dc399463daba343448533b87eaae0d21f6a32697487957c1ff9c39155269f020b880a40ca27284c6865395f4a78' \
&& echo "$chisel_sha384 chisel.tar.gz" | sha384sum -c - \
&& tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
&& rm chisel.tar.gz \
&& curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
&& chmod 755 /usr/bin/chisel-wrapper

RUN groupadd \
Expand Down
23 changes: 15 additions & 8 deletions src/runtime-deps/10.0/noble-chiseled/arm64v8/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,20 @@
FROM arm64v8/buildpack-deps:noble-curl AS chisel
FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.8-bookworm AS chisel

RUN apt-get update && apt-get install -y file
RUN apt-get update \
&& apt-get install -y --no-install-recommends file \
&& rm -rf /var/lib/apt/lists/*

RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.4.2/chisel_v1.4.2_linux_arm64.tar.gz \
&& chisel_sha384='216f10d4cc461411558fa4ac03fc24e104589126f87657457877389ae8015e1eac4299fcd8557c0dfea3d33342aa3297' \
&& echo "$chisel_sha384 chisel.tar.gz" | sha384sum -c - \
&& tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
&& rm chisel.tar.gz \
&& curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
RUN git init /src/chisel \
&& git -C /src/chisel remote add origin https://github.com/canonical/chisel.git \
&& git -C /src/chisel fetch --depth 1 origin 1262471cb663f57f3e201f100019f9bf5b4a7d4f \
&& git -C /src/chisel checkout --detach FETCH_HEAD \
&& sed --in-place 's|http://archive.ubuntu.com/ubuntu/|http://azure.archive.ubuntu.com/ubuntu/|' /src/chisel/internal/archive/archive.go

WORKDIR /src/chisel

ENV CHISEL_BIN="go run ./cmd/chisel"

RUN curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
&& chmod 755 /usr/bin/chisel-wrapper

RUN groupadd \
Expand Down
Loading
Loading