Fixes sandbox drift issues

Author: daschwanden

sandboxes/cleartext-xfcc-mode/docker-compose.yaml

@@ -29,14 +29,12 @@ services:
     - "10000:10000"
 
   fleetspeak-server:
-    build:
-      context: .
-      dockerfile: ../shared/fleetspeak-server/Dockerfile
+    image: ghcr.io/google/fleetspeak:latest
     hostname: fleetspeak-server
     depends_on:
       mysql-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"
     ports:
@@ -60,6 +58,6 @@ services:
     depends_on:
       fleetspeak-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"

sandboxes/direct-mtls-mode/docker-compose.yaml

@@ -19,14 +19,12 @@ services:
       retries: 10
 
   fleetspeak-server:
-    build:
-      context: .
-      dockerfile: ../shared/fleetspeak-server/Dockerfile
+    image: ghcr.io/google/fleetspeak:latest
     hostname: fleetspeak-frontend
     depends_on:
       mysql-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"
     ports:
@@ -50,6 +48,6 @@ services:
     depends_on:
       fleetspeak-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"

sandboxes/https-header-mode/docker-compose.yaml

@@ -29,14 +29,12 @@ services:
     - "10000:10000"
 
   fleetspeak-server:
-    build:
-      context: .
-      dockerfile: ../shared/fleetspeak-server/Dockerfile
+    image: ghcr.io/google/fleetspeak:latest
     hostname: fleetspeak-server
     depends_on:
       mysql-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"
     ports:
@@ -60,6 +58,6 @@ services:
     depends_on:
       fleetspeak-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"

sandboxes/passthrough-mode/docker-compose.yaml

@@ -31,14 +31,12 @@ services:
       - '10003'
 
   fleetspeak-server:
-    build:
-      context: .
-      dockerfile: ../shared/fleetspeak-server/Dockerfile
+    image: ghcr.io/google/fleetspeak:latest
     hostname: fleetspeak-server
     depends_on:
       mysql-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/server", "-components_config", "/config/fleetspeak-server/components.textproto", "-services_config", "/config/fleetspeak-server/services.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"
     ports:
@@ -62,6 +60,6 @@ services:
     depends_on:
       fleetspeak-server:
         condition: service_healthy
-    entrypoint: ["/app/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
+    entrypoint: ["/fleetspeak/bin/client", "-config", "/config/fleetspeak-client/config.textproto", "-alsologtostderr"]
     volumes:
       - "./config:/config"

sandboxes/shared/envoy/Dockerfile

@@ -17,7 +17,7 @@ COPY --chmod=644 cert.pem /etc/cert.pem
 COPY --chmod=644 key.pem /etc/key.pem
 CMD ["/usr/local/bin/envoy", "-c", "/etc/envoy.yaml"]
 
-FROM envoy-base as envoy-admin
+FROM envoy-base AS envoy-admin
 ARG ENVOY_ADMIN_PORT=10001
 ENV ENVOY_ADMIN_PORT="$ENVOY_ADMIN_PORT"
 HEALTHCHECK \
@@ -28,15 +28,15 @@ HEALTHCHECK \
     CMD curl -s "localhost:${ENVOY_ADMIN_PORT}/stats?filter=server.state" | grep 0 \
              && curl -s "localhost:${ENVOY_ADMIN_PORT}/stats?filter=listener_manager.workers_started" | grep 1
 
-FROM envoy-base as envoy-fault-injection
+FROM envoy-base AS envoy-fault-injection
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
     apt-get -qq update -y \
     && apt-get -qq install --no-install-recommends -y tree
 COPY enable_delay_fault_injection.sh disable_delay_fault_injection.sh enable_abort_fault_injection.sh disable_abort_fault_injection.sh send_request.sh /
 
 
-FROM envoy-base as envoy-jaeger-native
+FROM envoy-base AS envoy-jaeger-native
 #
 # for discussion on jaeger binary compatibility, and the source of the file, see here:
 #  https://github.com/envoyproxy/envoy/issues/11382#issuecomment-638012072
@@ -49,7 +49,7 @@ RUN echo "4a7d17d4724ee890490bcd6cfdedb12a02316a3d33214348d30979abd201f1ca /usr/
          && rm /tmp/checksum
 
 
-FROM envoy-base as envoy-load-balancing
+FROM envoy-base AS envoy-load-balancing
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
     apt-get -qq update -y \
@@ -58,40 +58,40 @@ COPY ./client.py /client.py
 EXPOSE 8001
 
 
-FROM envoy-base as envoy-double-proxy-base
+FROM envoy-base AS envoy-double-proxy-base
 COPY --chmod=777 ./certs/ca.crt /certs/cacert.pem
 
 
-FROM envoy-double-proxy-base as envoy-double-proxy-frontend
+FROM envoy-double-proxy-base AS envoy-double-proxy-frontend
 COPY  --chmod=777 ./certs/postgres-frontend.example.com.crt /certs/clientcert.pem
 COPY  --chmod=777 ./certs/example.com.key /certs/clientkey.pem
 
 
-FROM envoy-double-proxy-base as envoy-double-proxy-backend
+FROM envoy-double-proxy-base AS envoy-double-proxy-backend
 COPY --chmod=777 ./certs/postgres-backend.example.com.crt /certs/servercert.pem
 COPY --chmod=777 ./certs/example.com.key /certs/serverkey.pem
 
 
-FROM envoy-base as envoy-certs
+FROM envoy-base AS envoy-certs
 COPY --chmod=777 ./certs /certs
 
 
-FROM envoy-base as envoy-lua
+FROM envoy-base AS envoy-lua
 ADD  --chmod=777 ./lib/mylibrary.lua /lib/mylibrary.lua
 
 
-FROM envoy-base as envoy-go
+FROM envoy-base AS envoy-go
 ENV GODEBUG=cgocheck=0
 COPY --chmod=777 ./lib/simple.so /lib/simple.so
 
 
-FROM envoy-base as envoy-ext_authz
+FROM envoy-base AS envoy-ext_authz
 COPY --chmod=777 ./config /etc/envoy-config
 COPY --chmod=777 ./run_envoy.sh /run_envoy.sh
 CMD ["/bin/sh", "/run_envoy.sh"]
 
 
-FROM envoy-base as envoy-dynamic-fs
+FROM envoy-base AS envoy-dynamic-fs
 COPY --chmod=777 ./configs /var/lib/envoy
 
 

sandboxes/shared/fleetspeak-client/Dockerfile

@@ -1,4 +1,4 @@
-# Copyright 2023 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -11,7 +11,8 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM golang:1.22 as builder
+FROM ghcr.io/google/fleetspeak:latest AS fleetspeakbin
+FROM golang:1.22 AS builder
 
 RUN apt update && \
     apt install -y python3-venv && \
@@ -24,21 +25,10 @@ SHELL ["/bin/bash", "-c"]
 
 RUN git clone https://github.com/google/fleetspeak.git && \
     cd fleetspeak && \
-    go get -u golang.org/x/lint/golint && \
-    ./fleetspeak/generate_protos_setup.sh
-
-ENV PATH="$HOME/.local/bin:$PATH"
-
-RUN mkdir -p /app/bin
-
-RUN cd /fleetspeak && \
     python3 -m venv /venv/FSENV && \
     source /venv/FSENV/bin/activate && \
     pip install wheel pytest && \
     pip install -e ./fleetspeak_python[test] && \
-    pip install -e ./frr_python && \
-    ./fleetspeak/generate_protos.sh && \
-    go build -o /app/bin/server ./cmd/fleetspeak_server && \
-    go build -o /app/bin/client ./cmd/fleetspeak_client && \
-    go build -o /app/bin/fleetspeak_config ./cmd/fleetspeak_config
+    pip install -e ./frr_python
 
+COPY --from=fleetspeakbin /fleetspeak/bin/client /fleetspeak/bin/client

sandboxes/shared/fleetspeak-server/Dockerfile

@@ -1,4 +1,4 @@
-# Copyright 2023 Google LLC
+# Copyright 2025 Google LLC
 # 
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -11,7 +11,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-FROM golang:1.22 as builder
+FROM golang:1.22 AS builder
 
 RUN apt update && \
     apt install -y python3-venv && \