# syntax=docker/dockerfile:1.7

# Cloud Hypervisor, virtiofsd and the guest kernel for microvm sandboxes,
# published as public.ecr.aws/n4e0e1y0/beta9-microvm:<hack/microvm-image-tag.sh>.
# Worker images copy /microvm/bin and /microvm/share from the tag they pin, so
# a worker release never rebuilds the kernel.

# Cloud Hypervisor + virtiofsd
# ========================
# Static release binaries, pinned and checksummed. virtiofsd publishes x86_64
# only; on arm64 the hypervisor ships but NewMicroVM reports the runtime
# unavailable ("virtiofsd not found in PATH") rather than failing the build.
FROM debian:bookworm AS tools

ARG TARGETARCH
ARG CLOUD_HYPERVISOR_VERSION=v53.0
ARG CLOUD_HYPERVISOR_AMD64_SHA256=448af3d4e59b22c2987f7df94c213ad40fb53a10d437e42b5ee6c4fce7c29ecc
ARG CLOUD_HYPERVISOR_ARM64_SHA256=f192b510eea1c710cbc439d716bb0573c223fc463dbe3e6523788a2b7ef62850
ARG VIRTIOFSD_VERSION=v1.14.0
ARG VIRTIOFSD_AMD64_URL=https://gitlab.com/-/project/21523468/uploads/f505704014ae7a816e515f2a05a93d8b/virtiofsd-v1.14.0.zip
ARG VIRTIOFSD_AMD64_SHA256=2e4fe9571f492b00baa34bc4e708e950039c5da05b830b31a8d179cb6ac8978e

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl unzip && rm -rf /var/lib/apt/lists/*

RUN <<EOT
set -eux
mkdir -p /out
base="https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/${CLOUD_HYPERVISOR_VERSION}"
case "$TARGETARCH" in
    amd64)
        curl -fsSL "${base}/cloud-hypervisor-static" -o /out/cloud-hypervisor
        echo "${CLOUD_HYPERVISOR_AMD64_SHA256}  /out/cloud-hypervisor" | sha256sum -c -
        curl -fsSL "${VIRTIOFSD_AMD64_URL}" -o /tmp/virtiofsd.zip
        echo "${VIRTIOFSD_AMD64_SHA256}  /tmp/virtiofsd.zip" | sha256sum -c -
        unzip -j -q /tmp/virtiofsd.zip -d /tmp/virtiofsd
        install -m 0755 /tmp/virtiofsd/virtiofsd /out/virtiofsd
        ;;
    arm64)
        curl -fsSL "${base}/cloud-hypervisor-static-aarch64" -o /out/cloud-hypervisor
        echo "${CLOUD_HYPERVISOR_ARM64_SHA256}  /out/cloud-hypervisor" | sha256sum -c -
        echo "virtiofsd ${VIRTIOFSD_VERSION} has no published arm64 binary; the microvm runtime is amd64-only" >&2
        ;;
    *) echo "Unsupported architecture: $TARGETARCH" >&2; exit 1 ;;
esac
chmod 0755 /out/cloud-hypervisor
if [ "$TARGETARCH" = "amd64" ]; then
    /out/cloud-hypervisor --version
    /out/virtiofsd --version
fi
EOT

# Guest kernel
# ========================
# Mainline longterm kernel with Cloud Hypervisor's reference config plus the
# netfilter/bridge/IPv6 set Docker-in-VM needs (docker/microvm/). Everything
# needed to boot is built in: the guest boots straight from the virtio-fs
# root without an initramfs. Images can supply modules for passed-through GPUs.
# amd64 only.
FROM debian:bookworm AS kernel

ARG TARGETARCH
ARG GUEST_KERNEL_VERSION=6.12.111
ARG GUEST_KERNEL_SHA256=9e59dc67624188fa12a6601f9598499cd6662a9066be572b59f935e3d7849810

WORKDIR /build
COPY docker/microvm/guest-kernel.config docker/microvm/guest-kernel.fragment docker/microvm/*.patch /build/beam/

RUN <<EOT
set -eux
mkdir -p /out
if [ "$TARGETARCH" != "amd64" ]; then
    echo "guest kernel is built for amd64 only; skipping on $TARGETARCH" >&2
    exit 0
fi
apt-get update
apt-get install -y --no-install-recommends \
    bc bison build-essential ca-certificates cpio curl flex kmod libelf-dev \
    libssl-dev patch perl python3 rsync xz-utils
curl -fsSL "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${GUEST_KERNEL_VERSION}.tar.xz" -o linux.tar.xz
echo "${GUEST_KERNEL_SHA256}  linux.tar.xz" | sha256sum -c -
tar -xJf linux.tar.xz --strip-components=1
rm linux.tar.xz
# Guest-kernel fixes we carry until they land upstream (see each patch header).
for p in beam/*.patch; do patch -p1 --forward < "$p"; done

KCONFIG_CONFIG=.config scripts/kconfig/merge_config.sh -m beam/guest-kernel.config beam/guest-kernel.fragment
make olddefconfig
for opt in VIRTIO_FS VIRTIO_BLK VIRTIO_NET VIRTIO_VSOCKETS OVERLAY_FS EXT4_FS IPV6 NETFILTER NF_NAT \
           IP_NF_IPTABLES IP_NF_NAT IP_NF_TARGET_MASQUERADE NETFILTER_XT_MATCH_ADDRTYPE \
           NETFILTER_XT_MATCH_CONNTRACK BRIDGE BRIDGE_NETFILTER VETH CGROUPS MEMCG CGROUP_PIDS \
           NAMESPACES DEVTMPFS_MOUNT SERIAL_8250_CONSOLE DEFERRED_STRUCT_PAGE_INIT \
           MODULES MODULE_UNLOAD DRM DRM_KMS_HELPER DRM_FBDEV_EMULATION BPF_UNPRIV_DEFAULT_OFF; do
    grep -q "^CONFIG_${opt}=y" .config || { echo "guest kernel config lost CONFIG_${opt}" >&2; exit 1; }
done
grep -q '^# CONFIG_NUMA is not set$' .config || { echo "guest kernel must expose a single memory node" >&2; exit 1; }
make -j"$(nproc)" vmlinux modules
cp vmlinux /out/vmlinux
cp .config /out/vmlinux.config
EOT

# Driver image builds consume the exact sources, generated headers and symbols
# corresponding to the runtime artifact with the same content-derived tag.
FROM scratch AS kernel-devel
COPY --from=kernel /build/ /usr/src/beam-kernel/

FROM scratch AS runtime
COPY --from=tools /out/ /microvm/bin/
COPY --from=kernel /out/ /microvm/share/