docker/debian: Add separate GCC layer (#477)

Signed-off-by: Ryan Northey <[email protected]>

Author: phlax

.github/workflows/build.yml

@@ -94,6 +94,22 @@ jobs:
             - amd64
             - arm64
             artifact-pattern: oci-debian-{arch}/debian-worker-${{ steps.docker-sha.outputs.sha }}-{arch}.tar
+          # gcc
+          - name: envoy-build
+            tag: gcc-${{ steps.docker-sha.outputs.sha }}
+            registry: docker.io/envoyproxy
+            architectures:
+            - amd64
+            - arm64
+            artifact-pattern: oci-debian-{arch}/debian-gcc-${{ steps.docker-sha.outputs.sha }}-{arch}.tar
+          # gcc (gcr)
+          - name: envoy-build
+            tag: gcc-${{ steps.docker-sha.outputs.sha }}
+            registry: gcr.io/envoy-ci
+            architectures:
+            - amd64
+            - arm64
+            artifact-pattern: oci-debian-{arch}/debian-gcc-${{ steps.docker-sha.outputs.sha }}-{arch}.tar
           # docker
           - name: envoy-build
             tag: docker-${{ steps.docker-sha.outputs.sha }}

docker/linux/common_fun.sh

@@ -32,7 +32,9 @@ install_build_tools () {
 
 install_build () {
     setup_tcpdump
-    install_build_tools
+    if [[ -z "${NO_INSTALL_BUILDTOOLS}" ]]; then
+        install_build_tools
+    fi
     git config --global --add safe.directory /source
     mv ~/.gitconfig /etc/gitconfig
 }

docker/linux/debian/Dockerfile

@@ -34,6 +34,18 @@ COPY debian/entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 
 
+# This can be removed if/when we implement hermetic gcc toolchains
+FROM worker-base AS gcc-base
+RUN --mount=type=tmpfs,target=/var/cache/apt \
+    --mount=type=tmpfs,target=/var/lib/apt/lists \
+    --mount=type=bind,source=/common_fun.sh,target=/common_fun.sh \
+    --mount=type=bind,source=/debian/fun.sh,target=/debian/fun.sh \
+    . ./debian/fun.sh \
+    && install_gcc
+COPY debian/entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
+
+
 FROM ci-base AS docker-base
 ARG APT_KEY_K8S=https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Testing/Release.key \
     APT_KEY_DOCKER=https://download.docker.com/linux/debian/gpg
@@ -108,6 +120,13 @@ RUN --mount=type=bind,source=/common_fun.sh,target=/common_fun.sh \
     . ./debian/fun.sh \
     && stamp_build worker "$CONTAINER_TAG"
 
+FROM gcc-base AS gcc
+ARG CONTAINER_TAG
+RUN --mount=type=bind,source=/common_fun.sh,target=/common_fun.sh \
+    --mount=type=bind,source=/debian/fun.sh,target=/debian/fun.sh \
+    . ./debian/fun.sh \
+    && stamp_build gcc "$CONTAINER_TAG"
+
 FROM docker-base AS docker
 ARG CONTAINER_TAG
 RUN --mount=type=bind,source=/common_fun.sh,target=/common_fun.sh \

docker/linux/debian/fun.sh

@@ -21,7 +21,6 @@ DEBIAN_PACKAGES=(
     docker-ce-cli
     doxygen
     expect
-    g++-13
     gdb
     git
     gnupg2
@@ -159,7 +158,10 @@ install_devel () {
 
     apt_install "${DEV_PACKAGES[@]}"
     apt-get -qq dist-upgrade -y
-    update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 1
+    install_gcc
+
+    # not sure if this is necessary
+    export NO_INSTALL_BUILDTOOLS=1
     install_build
 
     echo "Development tools installation completed - compilers provided by toolchains"
@@ -171,6 +173,12 @@ install () {
     create_user
 }
 
+install_gcc () {
+    apt-get -qq update -y
+    apt-get -qq install -y g++-13
+    update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 1
+}
+
 install_bazelisk () {
     apt-get -qq update
     apt-get -qq install -y --no-install-recommends wget

docker/linux/debian_build.sh

@@ -3,7 +3,7 @@
 set -o pipefail
 
 # Debian-specific build configuration
-DEBIAN_DOCKER_VARIANTS=("worker" "ci" "devtools" "docker" "llvm" "mobile" "test")
+DEBIAN_DOCKER_VARIANTS=("worker" "ci" "gcc" "devtools" "docker" "llvm" "mobile" "test")
 IMAGE_TAGS=${IMAGE_TAGS:-}
 OS_DISTRO="debian"
 
@@ -57,8 +57,8 @@ build_and_push_variants () {
             push_arg+=(--push)
         fi
 
-        # Platform logic: worker, ci, devtools, docker and test get multi-arch, others get amd64 only
-        if [[ "$variant" == "test" || "$variant" == "ci" || "$variant" == "docker" || "$variant" == "worker" || "$variant" == "devtools" ]]; then
+        # Platform logic: worker, ci, gcc, devtools, docker and test get multi-arch, others get amd64 only
+        if [[ "$variant" == "test" || "$variant" == "ci" || "$variant" == "gcc" || "$variant" == "docker" || "$variant" == "worker" || "$variant" == "devtools" ]]; then
             platform="${BUILD_TOOLS_PLATFORMS}"
         elif [[ "$BUILD_TOOLS_PLATFORMS" == *"linux/amd64"* ]]; then
             # devtools and mobile are amd64 only (matching original behavior for full/mobile)

docker/linux/group_manifests.sh

@@ -8,7 +8,7 @@ if [[ -z "$TAG_SHA" ]]; then
     TAG_SHA="$(git log -1 --pretty=format:"%H" .)"
 fi
 
-VARIANTS=(ci worker devtools docker llvm mobile test)
+VARIANTS=(ci worker gcc devtools docker llvm mobile test)
 ARCHES=(amd64 arm64)
 
 exists () {