build(docker): add OpenShift in-cluster build variants for supervisor and gateway images - #3236
Draft
akram wants to merge 1 commit into
Draft
build(docker): add OpenShift in-cluster build variants for supervisor and gateway images#3236akram wants to merge 1 commit into
akram wants to merge 1 commit into
Conversation
akram
requested review from
a team,
derekwaynecarr,
mrunalp and
sjenning
as code owners
September 9, 2026 10:08
… and gateway Add multi-stage Dockerfiles that build the OpenShell supervisor and gateway images entirely inside an OpenShift/Buildah cluster, for environments without the upstream Nix CI pipeline that stages prebuilt binaries under deploy/docker/.build/prebuilt-binaries. Both reproduce the exact upstream artifacts by running the project's own Nix devShells in a builder stage, then assembling a runtime stage identical to the existing Dockerfile.supervisor / Dockerfile.gateway: - Dockerfile.supervisor.multistage: builds the static musl openshell-sandbox binary via the musl devShell; runtime is alpine:3.22 with nftables/iptables and COPY --chmod=0555. - Dockerfile.gateway.multistage: builds openshell-gateway via the glibc-2-28 devShell, normalizes the ELF interpreter with patchelf and asserts z3 is statically embedded; runtime is distroless cc-debian13. Each builder collapses build and cleanup into a single RUN so the Nix store never enters the committed layer, keeping the intermediate commit small and within the node's ephemeral-storage budget. The upstream Dockerfiles and CI binary pipeline are unchanged. Signed-off-by: Akram Signed-off-by: Akram <akram.benaissi@gmail.com>
akram
force-pushed
the
refactor/sandbox-alpine-default
branch
from
September 10, 2026 16:21
1344ed3 to
e3e2878
Compare
akram
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add multi-stage Dockerfiles that build the OpenShell supervisor and gateway images entirely inside an OpenShift/Buildah cluster, for environments without the upstream Nix CI pipeline that stages prebuilt binaries. The upstream
Dockerfile.*and the CI binary pipeline are unchanged, and image-name resolution is unchanged.Related Issue
Relates to #3116. This PR only adds in-cluster build tooling; it does not change the default sandbox image resolution.
Changes
deploy/docker/Dockerfile.supervisor.multistage: builds the static muslopenshell-sandboxvia the NixmusldevShell, then analpine:3.22runtime stage identical toDockerfile.supervisor(nftables/iptables,COPY --chmod=0555).deploy/docker/Dockerfile.gateway.multistage: buildsopenshell-gatewayvia the Nixglibc-2-28devShell, normalizes the ELF interpreter withpatchelfand asserts z3 is statically embedded, then adistroless/cc-debian13runtime stage identical toDockerfile.gateway.RUNso the Nix store never enters the committed layer (fast intermediate commit, fits the node's ephemeral-storage budget).Testing
Both images built in-cluster on OpenShift (amd64) and run:
ldd→ld-muslonly), executes natively on Alpine.openshell-system, pod 1/1 Running, serves on:8080and health on:8081.Checklist