Work around COPY --link limitations by pre-creating full filesystem…

… tree Without this, `COPY --link` insists on creating `/usr` and `/usr/local` for us, and does so with non-reproducible timestamps, defeating the purpose of our carefully crafted reproducible `/usr/local/go` -- this combats that by pre-creating a full `/target` directory that includes `/target/usr/local/go` so we can `COPY --link /target/ /` and get a *properly* reproducible layer. I've also added more sanity checks to validate our reproducibility assumptions (namely that our detected `SOURCE_DATE_EPOCH` value is older than our build/wall clock and that no files in our final tree are newer than our `SOURCE_DATE_EPOCH`).
docker-library · Jun 13, 2024 · 81c0d31 · 81c0d31
1 parent 58bc678
commit 81c0d31
Show file tree

Hide file tree

Showing 9 changed files with 144 additions and 45 deletions.
diff --git a/1.21/alpine3.19/Dockerfile b/1.21/alpine3.19/Dockerfile
diff --git a/1.21/alpine3.20/Dockerfile b/1.21/alpine3.20/Dockerfile
diff --git a/1.21/bookworm/Dockerfile b/1.21/bookworm/Dockerfile
diff --git a/1.21/bullseye/Dockerfile b/1.21/bullseye/Dockerfile
diff --git a/1.22/alpine3.19/Dockerfile b/1.22/alpine3.19/Dockerfile
diff --git a/1.22/alpine3.20/Dockerfile b/1.22/alpine3.20/Dockerfile
diff --git a/1.22/bookworm/Dockerfile b/1.22/bookworm/Dockerfile