mirror of
https://github.com/hanzokms/csi-provider.git
synced 2026-10-30 20:50:44 +00:00
zeekayandHanzo Dev
ee7665a0fd
The official golang images set GOTOOLCHAIN=local. A floating golang:1.26 tag
that resolves one patch behind the `go` directive in go.mod therefore kills the
container build outright:
go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)
This already shipped as a live failure in hanzoai/visor v1.108.16. go.mod here
declares go 1.26.4 against a floating tag, so the repo is one go.mod patch bump
away from the same break.
Two orthogonal changes:
- pin the base to golang:1.26.5 -> hermetic; the image and the
directive always agree, nothing to download.
- ENV GOTOOLCHAIN=auto -> resilient; if go.mod later moves
past the pin, the toolchain is fetched (checksum-verified via sum.golang.org)
instead of hard-failing. This is what stops the class recurring.
The `go` directive in go.mod is deliberately unchanged: a newer toolchain
building an older directive is always valid, and raising the directive would
propagate a floor to every consumer.
Verified: golang:1.26.5 exists and today resolves to the same digest as
golang:1.26 (sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647),
so the pin is behavior-neutral right now. go build ./... and go vet ./... pass
locally on go1.26.5 (the repo has no test files).
Co-authored-by: Hanzo Dev <[email protected]>
39 lines
1.5 KiB
Docker
39 lines
1.5 KiB
Docker
# Build the manager binary
|
|
FROM golang:1.26.5 as builder
|
|
# Pinned to the exact patch the go.mod directive needs, and GOTOOLCHAIN=auto so a
|
|
# future go.mod bump downloads its toolchain instead of hard-failing under the
|
|
# official image's GOTOOLCHAIN=local.
|
|
ENV GOTOOLCHAIN=auto
|
|
|
|
ARG VERSION
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /workspace
|
|
# Copy the Go Modules manifests
|
|
COPY go.mod go.mod
|
|
COPY go.sum go.sum
|
|
# cache deps before building and copying source so that we don't need to re-download as much
|
|
# and so that source changes don't invalidate our downloaded layer
|
|
RUN go mod download
|
|
|
|
# Copy the go source
|
|
COPY main.go main.go
|
|
COPY internal/ internal/
|
|
|
|
|
|
# Build
|
|
# the GOARCH has not a default value to allow the binary be built according to the host where the command
|
|
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
|
|
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
|
|
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
|
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager -ldflags "-X github.com/hanzokms/csi-provider/internal/version.BuildVersion=${VERSION}"
|
|
|
|
# Use distroless as minimal base image to package the manager binary
|
|
# Refer to https://github.com/GoogleContainerTools/distroless for more details
|
|
FROM gcr.io/distroless/static
|
|
WORKDIR /
|
|
COPY --from=builder /workspace/manager .
|
|
|
|
ENTRYPOINT ["/manager"]
|