From 25f2d55d7c3ab3ecf72625c3ccaa6cc9041be337 Mon Sep 17 00:00:00 2001
From: Dreista <Dreista@users.noreply.github.com>
Date: Thu, 12 May 2022 01:10:54 -0400
Subject: [PATCH] Support multiarch through cross-compilation

---
 Dockerfile           |  42 +++++++++++++---
 README.md            |  34 +++++++++----
 azure-pipelines.yaml | 113 ++++++++++++++++++++++++++++---------------
 3 files changed, 133 insertions(+), 56 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index fe23d0f..5be204e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,19 +1,48 @@
 ## builder
-FROM debian:10-slim as builder
+FROM --platform=$BUILDPLATFORM debian:stable-slim as builder
 LABEL image="ripe-atlas-builder"
+ARG BUILDPLATFORM
+ARG TARGETPLATFORM
 ARG DEBIAN_FRONTEND=noninteractive
 ARG GIT_URL=https://github.com/RIPE-NCC/ripe-atlas-software-probe.git
 
-RUN apt-get update -y \
-	&& apt-get install -y git tar fakeroot libssl-dev libcap2-bin autoconf automake libtool build-essential python
-
 WORKDIR /root
 
+RUN if [ "$BUILDPLATFORM" != "$TARGETPLATFORM" ] ; then \
+		case ${TARGETPLATFORM} in \
+			"linux/arm64")	echo 'export CROSSBUILD_ARCH=arm64 CROSS_COMPILE_TARGET=aarch64-linux-gnu' > env ;; \
+			"linux/arm/v6")	echo 'export CROSSBUILD_ARCH=armel CROSS_COMPILE_TARGET=arm-linux-gnueabi' > env ;; \
+			"linux/arm/v7")	echo 'export CROSSBUILD_ARCH=armhf CROSS_COMPILE_TARGET=arm-linux-gnueabihf' > env ;; \
+			"linux/386")	echo 'export CROSSBUILD_ARCH=i386 CROSS_COMPILE_TARGET=i686-linux-gnu' > env ;; \
+			"linux/amd64")	echo 'export CROSSBUILD_ARCH=amd64 CROSS_COMPILE_TARGET=x86_64-linux-gnu' > env ;; \
+			*) echo "Unsupported platform"; exit 1 ;; \
+		esac \
+		&& . ./env \
+		&& dpkg --add-architecture $CROSSBUILD_ARCH \
+		&& apt-get update -y \
+		&& apt-get install -y libssl-dev:$CROSSBUILD_ARCH crossbuild-essential-$CROSSBUILD_ARCH; \
+	fi \
+	&& apt-get update -y \
+	&& apt-get install -y git tar fakeroot libssl-dev libcap2-bin autoconf automake libtool build-essential
+
 RUN git clone --recursive "$GIT_URL"
-RUN ./ripe-atlas-software-probe/build-config/debian/bin/make-deb
+
+RUN if [ "$BUILDPLATFORM" != "$TARGETPLATFORM" ] ; then \
+		. ./env \
+		&& export CROSS_COMPILE="$CROSS_COMPILE_TARGET-" \
+		&& sed -i 's/.\/configure/.\/configure --host='$CROSS_COMPILE_TARGET'/g' ./ripe-atlas-software-probe/build-config/debian/bin/make-deb \
+		&& sed -i 's/ARCH=$(get_arch)/ARCH='$CROSSBUILD_ARCH'/g' ./ripe-atlas-software-probe/build-config/debian/bin/make-deb; \
+	fi \
+	&& ./ripe-atlas-software-probe/build-config/debian/bin/make-deb
+
+## artifacts
+FROM scratch AS artifacts
+LABEL image="ripe-atlas-artifacts"
+
+COPY --from=builder /root/atlasswprobe-*.deb /
 
 ## the actual image
-FROM debian:10-slim
+FROM debian:stable-slim
 LABEL maintainer="dockerhub@public.swineson.me"
 LABEL image="ripe-atlas"
 ARG DEBIAN_FRONTEND=noninteractive
@@ -46,4 +75,3 @@ VOLUME [ "/var/atlas-probe/etc", "/var/atlas-probe/status" ]
 
 ENTRYPOINT [ "entrypoint.sh" ]
 CMD [ "atlas" ]
-
diff --git a/README.md b/README.md
index b01cb95..6d8aa6e 100644
--- a/README.md
+++ b/README.md
@@ -12,13 +12,6 @@ This is the [RIPE Atlas software probe](https://atlas.ripe.net/docs/software-pro
 * A Linux installation with Docker installed
 * Internet access
 
-## Tags
-
-The following prebuilt tags are available at [Docker Hub](https://hub.docker.com/r/jamesits/ripe-atlas):
-
-* `latest`: For arm64 (x86\_64) devices
-* `latest-armv7l`: For armv7l (armhf) devices, e.g. Raspberry Pi (CI donated by [@OtakuNekoP](https://github.com/OtakuNekoP))
-
 ## Running
 
 First we start the container:
@@ -47,7 +40,9 @@ cat /var/atlas-probe/etc/probe_key.pub
 
 ### IPv6
 
-Docker's IPv6 support is still [like shit](https://github.com/moby/moby/issues/25407). As a workaround, you can use IPv6 NAT like this:
+Docker's IPv6 support is still [like shit](https://github.com/moby/moby/issues/25407). As a workaround, you can use IPv6 NAT using either `docker-ipv6nat` or native method (experimental).
+
+First, edit kernel parameters.
 
 ```shell
 cat > /etc/sysctl.d/50-docker-ipv6.conf <<EOF
@@ -56,13 +51,31 @@ net.ipv6.conf.all.forwarding=1
 net.ipv6.conf.default.forwarding=1
 EOF
 sysctl -p /etc/sysctl.d/50-docker-ipv6.conf
+```
+
+Note this might break your network and your mileage may vary. You should swap `eth0` with your primary network adapter name, and if you use static IPv6 assignment instead of SLAAC, change `accept_ra` to `0`.
+
+#### Using robbertkl/docker-ipv6nat
+
+```shell
 docker network create --ipv6 --subnet=fd00:a1a3::/48 ripe-atlas-network
 docker run -d --restart=always -v /var/run/docker.sock:/var/run/docker.sock:ro -v /lib/modules:/lib/modules:ro --cap-drop=ALL --cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=SYS_MODULE --net=host --name=ipv6nat robbertkl/ipv6nat:latest
 ```
 
 Then start the RIPE Atlas container with argument `--net=ripe-atlas-network`. 
 
-Note this might break your network and your mileage may vary. You should swap `eth0` with your primary network adapter name, and if you use static IPv6 assignment instead of SLAAC, change `accept_ra` to `0`.
+#### Using native method (experimental)
+
+Edit `/etc/docker/daemon.json`, then restart docker daemon.
+
+```json
+{
+  "experimental": true,
+  "ipv6": true,
+  "ip6tables": true,
+  "fixed-cidr-v6": "fd00:a1a3::/48"
+}
+```
 
 ### Auto Update
 
@@ -78,3 +91,6 @@ Then start the RIPE Atlas container with argument `--label=com.centurylinklabs.w
 
 All the config files are stored at `/var/atlas-probe`. Just backup it.
 
+### BuildKit
+
+The `Dockerfile` requires [BuildKit](https://docs.docker.com/develop/develop-images/build_enhancements/).
diff --git a/azure-pipelines.yaml b/azure-pipelines.yaml
index 257c360..6acd675 100644
--- a/azure-pipelines.yaml
+++ b/azure-pipelines.yaml
@@ -28,26 +28,34 @@ schedules:
       - master
 
 jobs:
-  - job: docker_nightly
-    displayName: "docker"
+  - job: build
+    displayName: "build"
     pool:
-      name: "$(POOL)"
       vmImage: "ubuntu-latest"
     workspace:
       clean: all
+    variables:
+      ARTIFACTS_DIR: "/tmp/ripe-atlas-artifacts"
     timeoutInMinutes: 60
     
     strategy:
       matrix:
+        arm64:
+          ARCH: "arm64"
+          DOCKER_IMAGE_TAG: "latest-arm64"
+        armel:
+          ARCH: "armel"
+          DOCKER_IMAGE_TAG: "latest-armel"
+        armhf:
+          ARCH: "armhf"
+          DOCKER_IMAGE_TAG: "latest-armv7l"
+        i386:
+          ARCH: "i386"
+          DOCKER_IMAGE_TAG: "latest-i386"
         amd64:
           ARCH: "amd64"
-          DOCKER_IMAGE_TAG: "latest"
-          POOL: "Azure Pipelines"
-        armv7l:
-          ARCH: "armv7l"
-          DOCKER_IMAGE_TAG: "latest-armv7l"
-          POOL: "OtakuNeko ARM32"
-      maxParallel: 2
+          DOCKER_IMAGE_TAG: "latest-amd64"
+      maxParallel: 5
 
     steps:
     - checkout: self
@@ -56,33 +64,31 @@ jobs:
 
     - bash: |
         set -Eeuo pipefail
-        
-        docker stop watchtower || true
 
-        docker build --no-cache --rm=false -t ripe-atlas .
+        docker run --privileged --rm tonistiigi/binfmt --install=$(ARCH)
+
+        export DOCKER_BUILDKIT=1
+
+        docker build --platform=$(ARCH) --no-cache --rm=false -t ripe-atlas .
         docker images --digests ripe-atlas
 
-        BUILDER_IMAGE_ID=$(docker ps -a --format="{{.ID}}" --filter="label=image=ripe-atlas-builder" --filter="status=exited" --latest)
-        docker cp "$BUILDER_IMAGE_ID":/root /tmp
-        rm -rf /tmp/root/atlasswprobe-*-work
-        tar -cvzf ${BUILD_ARTIFACTSTAGINGDIRECTORY}/build-artifacts.tar.gz /tmp/root/atlasswprobe-*/
-        cp -r /tmp/root/atlasswprobe-*.deb ${BUILD_ARTIFACTSTAGINGDIRECTORY}
-      displayName: "Build image"
+        docker build --target=artifacts --platform=$(ARCH) --output=type=local,dest=$(ARTIFACTS_DIR) .
+        cp -r $(ARTIFACTS_DIR)/* ${BUILD_ARTIFACTSTAGINGDIRECTORY}
+      displayName: "build image and release artifacts"
 
-    - task: PublishBuildArtifacts@1
+    - task: PublishPipelineArtifact@1
       inputs:
-        pathtoPublish: '$(Build.ArtifactStagingDirectory)' 
+        targetPath: '$(Build.ArtifactStagingDirectory)'
         artifactName: '$(ARCH)'
         parallel: true
         parallelCount: 20
-
-    - task: Docker@1
-      displayName: "Docker login"
+    
+    - task: Docker@2
+      displayName: "docker login"
       condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/master'), ne(variables['Build.Reason'], 'PullRequest'))
       inputs:
-        containerregistrytype: 'Container Registry'
-        dockerRegistryEndpoint: "Docker Hub: Jamesits"
-        command: login
+        containerRegistry: 'Docker Hub: Jamesits'
+        command: 'login'
 
     - bash: |
         set -Eeuo pipefail
@@ -91,22 +97,49 @@ jobs:
       displayName: "Push image"
       condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/master'), ne(variables['Build.Reason'], 'PullRequest'))
 
-    - task: Docker@1
-      displayName: "Docker logout"
+    - task: Docker@2
+      displayName: "docker logout"
       condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/master'), ne(variables['Build.Reason'], 'PullRequest'))
       inputs:
-        containerregistrytype: 'Container Registry'
-        dockerRegistryEndpoint: "Docker Hub: Jamesits"
-        command: logout
+        containerRegistry: 'Docker Hub: Jamesits'
+        command: 'logout'
+
+  - job: manifest
+    displayName: "create docker manifest"
+    pool:
+      vmImage: "ubuntu-latest"
+    workspace:
+      clean: all
+    variables:
+      DOCKER_IMAGE_TAG: "latest"
+    timeoutInMinutes: 60
+    dependsOn:
+      - build
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/master'), ne(variables['Build.Reason'], 'PullRequest'))
+
+    steps:
+    - task: Docker@2
+      displayName: "Docker login"
+      inputs:
+        containerRegistry: 'Docker Hub: Jamesits'
+        command: 'login'
 
     - bash: |
-        docker volume prune --force --filter "label=image=ripe-atlas-builder"
-        docker volume prune --force --filter "label=image=ripe-atlas"
-        
-        docker system prune --all --force --filter "label=image=ripe-atlas-builder"
-        docker system prune --all --force --filter "label=image=ripe-atlas"
-        
-        docker start watchtower || true
+        set -Eeuo pipefail
 
-      displayName: "Clean up"
+        docker manifest create \
+          $(DOCKER_IMAGE_BASENAME):$(DOCKER_IMAGE_TAG) \
+          --amend $(DOCKER_IMAGE_BASENAME):latest-arm64 \
+          --amend $(DOCKER_IMAGE_BASENAME):latest-armel \
+          --amend $(DOCKER_IMAGE_BASENAME):latest-armv7l \
+          --amend $(DOCKER_IMAGE_BASENAME):latest-i386 \
+          --amend $(DOCKER_IMAGE_BASENAME):latest-amd64
 
+          docker manifest push $(DOCKER_IMAGE_BASENAME):$(DOCKER_IMAGE_TAG)
+      displayName: "create and push manifest"
+
+    - task: Docker@2
+      displayName: "docker logout"
+      inputs:
+        containerRegistry: 'Docker Hub: Jamesits'
+        command: 'logout'