mirror of
https://github.com/pgsty/minio.git
synced 2026-08-10 00:03:29 +03:00
Feng Ruohang
4c34d23099
Publish pgsty/silo:<RELEASE>-distroless (and a rolling :distroless tag) alongside the classic image: gcr.io/distroless/static-debian12 plus exactly one program, the silo binary. No shell, no mc, no curl, no entrypoint script - the binary is the ENTRYPOINT and the baked-in exec-form HEALTHCHECK runs 'silo healthcheck ready'. The classic image and its mc-based health checks are deliberately unchanged. Design: silo.pgsty.com/compatibility/feature/healthcheck/ /data is created in the image layer, world-writable, because Docker seeds fresh volumes from the layer mountpoint and no entrypoint exists to repair ownership at runtime (issue #55); the parent directory is copied from a throwaway busybox stage since COPY of a directory copies contents rather than the entry itself, which would silently leave /data at root:0755 and break every non-root run. The MINIO_USERNAME drop-user path is not supported in this variant; use --user. test-release.yml now builds the real Dockerfile.distroless on every gate run (it has no download stages, so it stays offline) and asserts: the HEALTHCHECK survives into the image config, /data ships 0777, no shell and no /usr/bin/minio are present, Docker's health state turns healthy from the baked probe alone, the probe binary execs without a shell, and SIGTERM still stops the server gracefully - as root and as --user 1001:1001. docker-release.yml gains the distroless build lanes, multi-arch manifests, SBOM and provenance attestations, and a release-blocking check that the pushed manifest still carries the HEALTHCHECK (a Docker extension absent from the OCI image spec). Verified locally on linux/arm64: full gate assertions plus bare 'docker run ... healthcheck' exit-code semantics and --version passthrough. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
261 lines
11 KiB
Makefile
261 lines
11 KiB
Makefile
PWD := $(shell pwd)
|
|
GOPATH := $(shell go env GOPATH)
|
|
LDFLAGS := $(shell go run buildscripts/gen-ldflags.go)
|
|
|
|
GOOS ?= $(shell go env GOOS)
|
|
GOARCH ?= $(shell go env GOARCH)
|
|
GOLANGCI_VERSION ?= v2.11.3
|
|
|
|
VERSION ?= $(shell git describe --tags)
|
|
REPO ?= docker.io/pgsty
|
|
TAG ?= $(REPO)/silo:$(VERSION)
|
|
|
|
GOLANGCI_DIR = .bin/golangci/$(GOLANGCI_VERSION)
|
|
GOLANGCI = $(GOLANGCI_DIR)/golangci-lint
|
|
|
|
all: build
|
|
|
|
checks: ## check dependencies
|
|
@echo "Checking dependencies"
|
|
@(env bash $(PWD)/buildscripts/checkdeps.sh)
|
|
|
|
help: ## print this help
|
|
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' Makefile | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-40s\033[0m %s\n", $$1, $$2}'
|
|
|
|
getdeps: ## fetch necessary dependencies
|
|
@mkdir -p ${GOPATH}/bin
|
|
@if [ ! -x "$(GOLANGCI)" ]; then \
|
|
set -e; \
|
|
echo "Installing golangci-lint $(GOLANGCI_VERSION)"; \
|
|
script=$$(mktemp); \
|
|
trap 'rm -f "$$script"' EXIT; \
|
|
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCI_VERSION)/install.sh -o "$$script"; \
|
|
sh "$$script" -b $(GOLANGCI_DIR) $(GOLANGCI_VERSION); \
|
|
fi
|
|
|
|
crosscompile: ## cross compile Silo
|
|
@(env bash $(PWD)/buildscripts/cross-compile.sh)
|
|
|
|
verifiers: lint check-gen rebrand-guard
|
|
|
|
rebrand-guard: ## verify Silo branding and protected compatibility identifiers
|
|
@go run ./buildscripts/rebrand-guard
|
|
@env bash $(PWD)/buildscripts/verify-rebrand.sh
|
|
@env bash $(PWD)/dockerscripts/docker-entrypoint_test.sh
|
|
|
|
credits: ## regenerate CREDITS from the licenses of Go modules linked into the binary
|
|
@env bash $(PWD)/buildscripts/gen-credits.sh
|
|
|
|
check-gen: ## check for updated autogenerated files
|
|
@go generate ./... >/dev/null
|
|
@go mod tidy -compat=1.26
|
|
@env bash $(PWD)/buildscripts/gen-credits.sh
|
|
@changed=$$(git diff --name-only -- '*_gen.go' '*_gen_test.go' '*_msgp_test.go' '*_string.go' go.mod go.sum CREDITS); \
|
|
if [ -n "$$changed" ]; then \
|
|
echo "Non-committed generated changes detected:"; \
|
|
echo "$$changed"; \
|
|
exit 1; \
|
|
fi
|
|
@untracked=$$(git ls-files --others --exclude-standard -- '*_gen.go' '*_gen_test.go' '*_msgp_test.go' '*_string.go'); \
|
|
if [ -n "$$untracked" ]; then \
|
|
echo "Untracked generated files detected:"; \
|
|
echo "$$untracked"; \
|
|
exit 1; \
|
|
fi
|
|
|
|
lint: getdeps ## runs golangci-lint suite of linters
|
|
@echo "Running $@ check"
|
|
@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml
|
|
@if command -v typos >/dev/null 2>&1; then typos ./; else echo "typos binary is not found.. skipping.."; fi
|
|
|
|
lint-fix: getdeps ## runs golangci-lint suite of linters with automatic fixes
|
|
@echo "Running $@ check"
|
|
@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml --fix
|
|
|
|
check: test
|
|
test: verifiers build ## builds Silo, runs linters, tests
|
|
@echo "Running unit tests"
|
|
@MINIO_API_REQUESTS_MAX=10000 CGO_ENABLED=0 go test -v -tags kqueue,dev ./...
|
|
|
|
test-root-disable: install-race
|
|
@echo "Running Silo root lockdown tests"
|
|
@env bash $(PWD)/buildscripts/disable-root.sh
|
|
|
|
test-ilm: install-race
|
|
@echo "Running ILM tests"
|
|
@env bash $(PWD)/docs/bucket/replication/setup_ilm_expiry_replication.sh
|
|
|
|
test-ilm-transition: install-race
|
|
@echo "Running ILM tiering tests with healing"
|
|
@env bash $(PWD)/docs/bucket/lifecycle/setup_ilm_transition.sh
|
|
|
|
test-pbac: install-race
|
|
@echo "Running bucket policies tests"
|
|
@env bash $(PWD)/docs/iam/policies/pbac-tests.sh
|
|
|
|
test-decom: install-race
|
|
@echo "Running Silo decom tests"
|
|
@env bash $(PWD)/docs/distributed/decom.sh
|
|
@env bash $(PWD)/docs/distributed/decom-encrypted.sh
|
|
@env bash $(PWD)/docs/distributed/decom-encrypted-sse-s3.sh
|
|
@env bash $(PWD)/docs/distributed/decom-compressed-sse-s3.sh
|
|
@env bash $(PWD)/docs/distributed/decom-encrypted-kes.sh
|
|
|
|
test-versioning: install-race
|
|
@echo "Running Silo versioning tests"
|
|
@env bash $(PWD)/docs/bucket/versioning/versioning-tests.sh
|
|
|
|
test-configfile: install-race
|
|
@env bash $(PWD)/docs/distributed/distributed-from-config-file.sh
|
|
|
|
test-upgrade:
|
|
@echo "Running MinIO-to-Silo upgrade tests"
|
|
@(env bash $(PWD)/buildscripts/minio-upgrade.sh)
|
|
|
|
test-race: verifiers build ## builds Silo, runs linters, tests (race)
|
|
@echo "Running unit tests under -race"
|
|
@(env bash $(PWD)/buildscripts/race.sh)
|
|
|
|
test-iam: install-race ## verify IAM (external IDP, etcd backends)
|
|
@echo "Running tests for IAM (external IDP, etcd backends)"
|
|
@MINIO_API_REQUESTS_MAX=10000 CGO_ENABLED=0 go test -timeout 15m -tags kqueue,dev -v -run TestIAM* ./cmd
|
|
@echo "Running tests for IAM (external IDP, etcd backends) with -race"
|
|
@MINIO_API_REQUESTS_MAX=10000 GORACE=history_size=7 CGO_ENABLED=1 go test -timeout 15m -race -tags kqueue,dev -v -run TestIAM* ./cmd
|
|
|
|
test-iam-ldap-upgrade-import: install-race ## verify IAM (external LDAP IDP)
|
|
@echo "Running upgrade tests for IAM (LDAP backend)"
|
|
@env bash $(PWD)/buildscripts/minio-iam-ldap-upgrade-import-test.sh
|
|
|
|
test-iam-import-with-missing-entities: install-race ## test import of external iam config withg missing entities
|
|
@echo "Test IAM import configurations with missing entities"
|
|
@env bash $(PWD)/docs/distributed/iam-import-with-missing-entities.sh
|
|
|
|
test-iam-import-with-openid: install-race
|
|
@echo "Test IAM import configurations with openid"
|
|
@env bash $(PWD)/docs/distributed/iam-import-with-openid.sh
|
|
|
|
test-sio-error:
|
|
@(env bash $(PWD)/docs/bucket/replication/sio-error.sh)
|
|
|
|
test-replication-2site:
|
|
@(env bash $(PWD)/docs/bucket/replication/setup_2site_existing_replication.sh)
|
|
|
|
test-replication-3site:
|
|
@(env bash $(PWD)/docs/bucket/replication/setup_3site_replication.sh)
|
|
|
|
test-delete-replication:
|
|
@(env bash $(PWD)/docs/bucket/replication/delete-replication.sh)
|
|
|
|
test-delete-marker-proxying:
|
|
@(env bash $(PWD)/docs/bucket/replication/test_del_marker_proxying.sh)
|
|
|
|
test-replication: install-race test-replication-2site test-replication-3site test-delete-replication test-sio-error test-delete-marker-proxying ## verify multi site replication
|
|
@echo "Running tests for replicating three sites"
|
|
|
|
test-site-replication-ldap: install-race ## verify automatic site replication
|
|
@echo "Running tests for automatic site replication of IAM (with LDAP)"
|
|
@(env bash $(PWD)/docs/site-replication/run-multi-site-ldap.sh)
|
|
|
|
test-site-replication-oidc: install-race ## verify automatic site replication
|
|
@echo "Running tests for automatic site replication of IAM (with OIDC)"
|
|
@(env bash $(PWD)/docs/site-replication/run-multi-site-oidc.sh)
|
|
|
|
test-site-replication-silo: install-race ## verify automatic site replication
|
|
@echo "Running tests for automatic site replication of IAM (with Silo IDP)"
|
|
@(env bash $(PWD)/docs/site-replication/run-multi-site-silo-idp.sh)
|
|
@echo "Running tests for automatic site replication of SSE-C objects"
|
|
@(env bash $(PWD)/docs/site-replication/run-ssec-object-replication.sh)
|
|
@echo "Running tests for automatic site replication of SSE-C objects with SSE-KMS enabled for bucket"
|
|
@(env bash $(PWD)/docs/site-replication/run-sse-kms-object-replication.sh)
|
|
@echo "Running tests for automatic site replication of SSE-C objects with compression enabled for site"
|
|
@(env bash $(PWD)/docs/site-replication/run-ssec-object-replication-with-compression.sh)
|
|
|
|
test-multipart: install-race ## test multipart
|
|
@echo "Test multipart behavior when part files are missing"
|
|
@(env bash $(PWD)/buildscripts/multipart-quorum-test.sh)
|
|
|
|
test-timeout: install-race ## test multipart
|
|
@echo "Test server timeout"
|
|
@(env bash $(PWD)/buildscripts/test-timeout.sh)
|
|
|
|
verify: install-race ## verify Silo in various setups
|
|
@echo "Verifying build with race"
|
|
@(env bash $(PWD)/buildscripts/verify-build.sh)
|
|
|
|
verify-healing: install-race ## verify healing and replacing disks with the Silo binary
|
|
@echo "Verify healing build with race"
|
|
@(env bash $(PWD)/buildscripts/verify-healing.sh)
|
|
@(env bash $(PWD)/buildscripts/verify-healing-empty-erasure-set.sh)
|
|
@(env bash $(PWD)/buildscripts/heal-inconsistent-versions.sh)
|
|
|
|
verify-healing-with-root-disks: install-race ## verify healing root disks
|
|
@echo "Verify healing with root drives"
|
|
@(env bash $(PWD)/buildscripts/verify-healing-with-root-disks.sh)
|
|
|
|
verify-healing-with-rewrite: install-race ## verify healing to rewrite old xl.meta -> new xl.meta
|
|
@echo "Verify healing with rewrite"
|
|
@(env bash $(PWD)/buildscripts/rewrite-old-new.sh)
|
|
|
|
verify-healing-inconsistent-versions: install-race ## verify resolving inconsistent versions
|
|
@echo "Verify resolving inconsistent versions build with race"
|
|
@(env bash $(PWD)/buildscripts/resolve-right-versions.sh)
|
|
|
|
build-debugging:
|
|
@(env bash $(PWD)/docs/debugging/build.sh)
|
|
|
|
build: checks build-debugging ## builds Silo to $(PWD)
|
|
@echo "Building Silo binary to './silo'"
|
|
@CGO_ENABLED=0 GOOS=$(GOOS) GOARCH=$(GOARCH) go build -tags kqueue -trimpath --ldflags "$(LDFLAGS)" -o $(PWD)/silo 1>/dev/null
|
|
|
|
docker: checks build-debugging ## builds the local Linux Silo container image
|
|
@echo "Building Silo container image '$(TAG)'"
|
|
@set -e; \
|
|
context=$$(mktemp -d); \
|
|
trap 'rm -rf "$$context"' EXIT; \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) go build -tags kqueue -trimpath \
|
|
--ldflags "$(LDFLAGS)" -o "$$context/silo"; \
|
|
mkdir -p "$$context/dockerscripts"; \
|
|
cp Dockerfile.goreleaser LICENSE NOTICE CREDITS "$$context/"; \
|
|
cp dockerscripts/docker-entrypoint.sh dockerscripts/download-static-curl.sh \
|
|
"$$context/dockerscripts/"; \
|
|
docker build -q --no-cache --platform linux/$(GOARCH) -t $(TAG) --build-arg TARGETARCH=$(GOARCH) \
|
|
-f "$$context/Dockerfile.goreleaser" "$$context"
|
|
|
|
docker-distroless: checks build-debugging ## builds the local Linux Silo distroless container image
|
|
@echo "Building Silo distroless container image '$(TAG)-distroless'"
|
|
@set -e; \
|
|
context=$$(mktemp -d); \
|
|
trap 'rm -rf "$$context"' EXIT; \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=$(GOARCH) go build -tags kqueue -trimpath \
|
|
--ldflags "$(LDFLAGS)" -o "$$context/silo"; \
|
|
cp Dockerfile.distroless LICENSE NOTICE CREDITS "$$context/"; \
|
|
docker build -q --no-cache --platform linux/$(GOARCH) -t $(TAG)-distroless \
|
|
-f "$$context/Dockerfile.distroless" "$$context"
|
|
|
|
test-resiliency: build
|
|
@echo "Running resiliency tests"
|
|
@(DOCKER_COMPOSE_FILE=$(PWD)/docs/resiliency/docker-compose.yaml env bash $(PWD)/docs/resiliency/resiliency-tests.sh)
|
|
|
|
install-race: checks build-debugging ## builds Silo to $(PWD)
|
|
@echo "Building Silo binary with -race to './silo'"
|
|
@GORACE=history_size=7 CGO_ENABLED=1 go build -tags kqueue,dev -race -trimpath --ldflags "$(LDFLAGS)" -o $(PWD)/silo 1>/dev/null
|
|
@echo "Installing Silo binary with -race to '$(GOPATH)/bin/silo'"
|
|
@mkdir -p $(GOPATH)/bin && cp -af $(PWD)/silo $(GOPATH)/bin/silo
|
|
|
|
install: build ## builds Silo and installs it to $GOPATH/bin.
|
|
@echo "Installing Silo binary to '$(GOPATH)/bin/silo'"
|
|
@mkdir -p $(GOPATH)/bin && cp -af $(PWD)/silo $(GOPATH)/bin/silo
|
|
@echo "Installation successful. To learn more, try \"silo --help\"."
|
|
|
|
clean: ## cleanup all generated assets
|
|
@echo "Cleaning up all the generated files"
|
|
@find . -name '*.test' | xargs rm -fv
|
|
@find . -name '*~' | xargs rm -fv
|
|
@find . -name '.#*#' | xargs rm -fv
|
|
@find . -name '#*#' | xargs rm -fv
|
|
@rm -rvf silo
|
|
@rm -rvf build
|
|
@rm -rvf release
|
|
@rm -rvf .verify*
|
|
@rm -rvf pkger_*.deb
|