1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
# kukuri buildbot worker image - self-contained.
#
# HISTORY: this file used to be `FROM jenkins-kotlin:latest`, an image that was
# built interactively during the Jenkins era and whose Dockerfile was never
# committed. That image no longer exists anywhere (verified: not in this repo's
# history, not on the build host, not in the cgit repositories). Rather than
# resurrect a lost image, the toolchain it provided is reproduced explicitly
# here so the worker can be rebuilt from source on any host.
#
# What the pipeline in deploy/buildbot/master/master.cfg actually needs:
# - JDK 21 (master comment) with a Java 17 target (modules set jvmTarget=17)
# - Gradle wrapper 8.14.3 -> fetched by ./gradlew itself from services.gradle.org
# - Android SDK: AGP 8.13.2 needs build-tools + a platform + platform-tools
# - node/npm for wasmJsNodeTest (Kotlin/Wasm node target) and bundleWeb
# - X11 + ALSA + PulseAudio for the webrtc-java native library (used by
# services/signaling-server tests and the desktop bundle)
# - python3 + buildbot-worker 4.x
# - git/curl/unzip for checkout, artifact fetch and deploy
#
# The image still runs as user "jenkins" with HOME=/var/jenkins_home and
# GRADLE_USER_HOME=/var/jenkins_home/.gradle so that the existing run-worker.sh
# volume mount (`-v jenkins-data:/var/jenkins_home`) keeps working and the
# Gradle/Konan caches persist across container rebuilds.
FROM eclipse-temurin:21-jdk-jammy
ENV DEBIAN_FRONTEND=noninteractive
# --- base tooling the build and the worker agent need -----------------------
# APT::Cache-Start is raised because the default 24MB mmap cache is too small
# to parse the full Ubuntu jammy package lists (universe is ~17MB on its own),
# which fails with "Dynamic MMap ran out of room" on constrained hosts.
#
# NOTE on audio: only libasound2/libpulse0 (the client libraries webrtc-java
# links against) are installed, not the pulseaudio server package. The server
# package drags in systemd and its postinst HANGS when this image is built
# under a non-systemd runtime (observed building under FreeBSD's podman +
# Linuxulator: "systemd.postinst configure" blocked the build indefinitely).
# The worker has no need for an audio daemon - it never plays back media; the
# libraries exist so the desktop/signaling test binaries can load. If a build
# ever needs a live PulseAudio, run it as a sidecar rather than baking it in.
RUN echo 'APT::Cache-Start "268435456";' > /etc/apt/apt.conf.d/99cache-start \
&& echo 'APT::Cache-Grow "1073741824";' >> /etc/apt/apt.conf.d/99cache-start \
&& apt-get update && apt-get install -y --no-install-recommends \
ca-certificates curl wget unzip zip xz-utils git openssh-client \
python3 python3-pip python3-venv \
libx11-6 libxcb1 libxext6 libxrender1 libxi6 libxtst6 \
libasound2 libpulse0 \
procps \
&& rm -rf /var/lib/apt/lists/*
# --- nodejs (Kotlin/Wasm node tests, web bundle) ---------------------------
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
&& apt-get install -y --no-install-recommends nodejs \
&& rm -rf /var/lib/apt/lists/*
# --- buildbot worker ------------------------------------------------------
RUN pip3 install --no-cache-dir 'buildbot-worker==4.1.0' \
|| pip3 install --no-cache-dir buildbot-worker
# --- Android SDK (AGP 8.13.2) -----------------------------------------------
# compileSdk/targetSdk are 35 across apps/android and the kotlin modules
# (apps/android, modules/orgflow-domain, modules/orgflow-ui,
# modules/zero-bridge-android all say 35). Build-tools 35.0.0 comes with
# platform 35; 36 is installed as well so AGP can use it if it asks.
# The SDK dir is chowned to the build user: AGP writes into the SDK (it
# installs missing components and creates .knownPackages), so it must not be
# root-only, otherwise the build dies with "The SDK directory is not writable".
ENV ANDROID_SDK_ROOT=/opt/android-sdk
ENV ANDROID_HOME=/opt/android-sdk
ENV PATH=/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:${PATH}
ARG ANDROID_CMDLINE_TOOLS=13114758
RUN mkdir -p /opt/android-sdk/cmdline-tools \
&& curl -fsSL -o /tmp/cmdline-tools.zip \
"https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS}_latest.zip" \
&& unzip -q /tmp/cmdline-tools.zip -d /tmp/ct \
&& mv /tmp/ct/cmdline-tools /opt/android-sdk/cmdline-tools/latest \
&& rm -rf /tmp/cmdline-tools.zip /tmp/ct \
&& yes | sdkmanager --licenses > /dev/null \
&& sdkmanager --install \
"platform-tools" \
"platforms;android-35" \
"build-tools;35.0.0" \
"platforms;android-36" \
"build-tools;36.0.0" \
&& rm -rf /opt/android-sdk/.temp /root/.android/cache
# --- the Jenkins-era user, kept so the existing volume/mount setup is valid --
# /opt/android-sdk is chowned too: AGP writes into the SDK tree at build time.
RUN useradd --create-home --home-dir /var/jenkins_home --shell /bin/bash jenkins \
&& mkdir -p /var/jenkins_home/.gradle /worker /run/secrets \
&& chown -R jenkins:jenkins /var/jenkins_home /worker /run/secrets /opt/android-sdk
COPY start-worker.sh /usr/local/bin/start-worker.sh
RUN chmod +x /usr/local/bin/start-worker.sh
ENV GRADLE_USER_HOME=/var/jenkins_home/.gradle
ENV BUILDWORKER_WORKDIR=/worker
ENV HOME=/var/jenkins_home
USER jenkins
WORKDIR /worker
ENTRYPOINT ["/usr/local/bin/start-worker.sh"]
|
