Reapply "Add rules_oci (#7568)" (#7617)

This reverts commit 717547f.

MODULE.bazel

@@ -3,6 +3,7 @@ module(name = "buildbuddy")
 bazel_dep(name = "bazel_skylib", version = "1.6.1")
 bazel_dep(name = "platforms", version = "0.0.10")
 bazel_dep(name = "rules_proto", version = "6.0.0")
+bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "toolchains_musl", version = "0.1.15")
 bazel_dep(name = "googleapis", version = "0.0.0-20240326-1c8d509c5")
 single_version_override(
@@ -453,3 +454,26 @@ http_archive(
         "https://github.com/sluongng/nogo-analyzer/archive/refs/tags/v0.0.2.tar.gz",
     ],
 )
+
+bazel_dep(name = "rules_oci", version = "2.0.0")
+
+oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
+oci.pull(
+    name = "buildbuddy_go_oci_image_base",
+    digest = "sha256:388145607c79313a1e49b783a7ee71e4ef3df31d87c45adb46bfb9b257b643d1",
+    image = "gcr.io/distroless/cc-debian12",
+    platforms = ["linux/amd64"],
+)
+oci.pull(
+    name = "bazel_oci_image_base",
+    digest = "sha256:8bb82ccf73085b71159ce05d2cc6030cbaa927b403c04774f0b22f37ab4fd78a",
+    image = "gcr.io/distroless/java17-debian12",
+    platforms = ["linux/amd64"],
+)
+use_repo(
+    oci,
+    "bazel_oci_image_base",
+    "bazel_oci_image_base_linux_amd64",
+    "buildbuddy_go_oci_image_base",
+    "buildbuddy_go_oci_image_base_linux_amd64",
+)

WORKSPACE

@@ -26,6 +26,12 @@ load("@bazel_features//:deps.bzl", "bazel_features_deps")
 
 bazel_features_deps()
 
+http_archive(
+    name = "rules_pkg",
+    integrity = "sha256-0gyVGWDtd8t7NBwqWUiFNOSU1a0dMMSBjHNtV3cqn+8=",
+    url = "https://github.com/bazelbuild/rules_pkg/releases/download/1.0.1/rules_pkg-1.0.1.tar.gz",
+)
+
 # Proto rules
 
 http_archive(
@@ -344,6 +350,21 @@ k8s_defaults(
     kind = "deployment",
 )
 
+http_archive(
+    name = "rules_oci",
+    sha256 = "d007e6c96eb62c88397b68f329e4ca56e0cfe31204a2c54b0cb17819f89f83c8",
+    strip_prefix = "rules_oci-2.0.0",
+    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.0/rules_oci-v2.0.0.tar.gz",
+)
+
+load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
+
+rules_oci_dependencies()
+
+load("@rules_oci//oci:repositories.bzl", "oci_register_toolchains")
+
+oci_register_toolchains(name = "oci")
+
 load("@io_bazel_rules_docker//contrib:dockerfile_build.bzl", "dockerfile_image")
 
 dockerfile_image(
@@ -370,23 +391,6 @@ dockerfile_image(
     visibility = ["//visibility:public"],
 )
 
-load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
-
-container_pull(
-    name = "buildbuddy_go_image_base",
-    digest = "sha256:388145607c79313a1e49b783a7ee71e4ef3df31d87c45adb46bfb9b257b643d1",
-    registry = "gcr.io",
-    repository = "distroless/cc-debian12",
-)
-
-# Base image that can be used to build images that are capable of running the Bazel binary.
-container_pull(
-    name = "bazel_image_base",
-    digest = "sha256:8bb82ccf73085b71159ce05d2cc6030cbaa927b403c04774f0b22f37ab4fd78a",
-    registry = "gcr.io",
-    repository = "distroless/java17-debian12",
-)
-
 dockerfile_image(
     name = "rbe-ubuntu20-04_image",
     dockerfile = "//dockerfiles/rbe-ubuntu20-04:Dockerfile",
@@ -415,6 +419,39 @@ dockerfile_image(
     visibility = ["//visibility:public"],
 )
 
+load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
+
+container_pull(
+    name = "buildbuddy_go_image_base",
+    digest = "sha256:388145607c79313a1e49b783a7ee71e4ef3df31d87c45adb46bfb9b257b643d1",
+    registry = "gcr.io",
+    repository = "distroless/cc-debian12",
+)
+
+# Base image that can be used to build images that are capable of running the Bazel binary.
+container_pull(
+    name = "bazel_image_base",
+    digest = "sha256:8bb82ccf73085b71159ce05d2cc6030cbaa927b403c04774f0b22f37ab4fd78a",
+    registry = "gcr.io",
+    repository = "distroless/java17-debian12",
+)
+
+load("@rules_oci//oci:pull.bzl", "oci_pull")
+
+oci_pull(
+    name = "buildbuddy_go_oci_image_base",
+    digest = "sha256:388145607c79313a1e49b783a7ee71e4ef3df31d87c45adb46bfb9b257b643d1",
+    image = "gcr.io/distroless/cc-debian12",
+    platforms = ["linux/amd64"],
+)
+
+oci_pull(
+    name = "bazel_oci_image_base",
+    digest = "sha256:8bb82ccf73085b71159ce05d2cc6030cbaa927b403c04774f0b22f37ab4fd78a",
+    image = "gcr.io/distroless/java17-debian12",
+    platforms = ["linux/amd64"],
+)
+
 # BuildBuddy Toolchain
 # Keep up-to-date with docs/rbe-setup.md and docs/rbe-github-actions.md
 http_archive(

WORKSPACE.bzlmod

@@ -105,23 +105,6 @@ dockerfile_image(
     visibility = ["//visibility:public"],
 )
 
-load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
-
-container_pull(
-    name = "buildbuddy_go_image_base",
-    digest = "sha256:3172df37ef8caa768ce74ebbc7f0e2b6a2641d3b35d18659d36f3815e30fe620",
-    registry = "gcr.io",
-    repository = "distroless/cc-debian11",
-)
-
-# Base image that can be used to build images that are capable of running the Bazel binary.
-container_pull(
-    name = "bazel_image_base",
-    digest = "sha256:ab0c5fbe16bc01c03eb081a5724ba618110cbd24940ab123a8dbee0382a4c175",
-    registry = "gcr.io",
-    repository = "distroless/java11-debian11",
-)
-
 dockerfile_image(
     name = "rbe-ubuntu20-04_image",
     dockerfile = "//dockerfiles/rbe-ubuntu20-04:Dockerfile",
@@ -150,6 +133,23 @@ dockerfile_image(
     visibility = ["//visibility:public"],
 )
 
+load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
+
+container_pull(
+    name = "buildbuddy_go_image_base",
+    digest = "sha256:3172df37ef8caa768ce74ebbc7f0e2b6a2641d3b35d18659d36f3815e30fe620",
+    registry = "gcr.io",
+    repository = "distroless/cc-debian11",
+)
+
+# Base image that can be used to build images that are capable of running the Bazel binary.
+container_pull(
+    name = "bazel_image_base",
+    digest = "sha256:ab0c5fbe16bc01c03eb081a5724ba618110cbd24940ab123a8dbee0382a4c175",
+    registry = "gcr.io",
+    repository = "distroless/java11-debian11",
+)
+
 # BuildBuddy Toolchain
 # Keep up-to-date with docs/rbe-setup.md and docs/rbe-github-actions.md
 http_archive(

codesearch/cmd/server/BUILD

@@ -1,6 +1,8 @@
 load("@io_bazel_rules_docker//container:container.bzl", "container_push")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "server_lib",
@@ -52,3 +54,25 @@ container_push(
     tag_file = "//deployment:image_tag_file",
     tags = ["manual"],  # Don't include this target in wildcard patterns
 )
+
+pkg_tar(
+    name = "tar",
+    srcs = [":server"],
+)
+
+oci_image(
+    name = "oci_image",
+    base = "@buildbuddy_go_oci_image_base",
+    entrypoint = ["/server"],
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [":tar"],
+    visibility = ["//visibility:public"],
+)
+
+oci_push(
+    name = "push",
+    image = ":oci_image",
+    # Set the image tag with the bazel run flag "--//deployment:image_tag=TAG"
+    remote_tags = "//deployment:oci_tag_file",
+    repository = "gcr.io/flame-build/codesearch-oci",
+)

deployment/BUILD

@@ -1,4 +1,5 @@
 load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
+load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 load("@io_bazel_rules_k8s//k8s:object.bzl", "k8s_object")
 load("@io_bazel_rules_k8s//k8s:objects.bzl", "k8s_objects")
 load("//rules/flags:index.bzl", "write_flag_to_file")
@@ -39,3 +40,13 @@ write_flag_to_file(
     flag = ":image_tag",
     visibility = ["//visibility:public"],
 )
+
+# TODO: Get rid of this.
+# Currently rules OCI only support tag file names with the ".txt" extension.
+copy_file(
+    name = "oci_tag_file",
+    src = ":image_tag_file",
+    out = "oci_tag.txt",
+    allow_symlink = True,
+    visibility = ["//visibility:public"],
+)

enterprise/server/cmd/cache_proxy/BUILD

@@ -1,5 +1,7 @@
 load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 package(default_visibility = ["//enterprise:__subpackages__"])
 
@@ -49,3 +51,17 @@ container_image(
     tags = ["manual"],
     visibility = ["//visibility:public"],
 )
+
+pkg_tar(
+    name = "tar",
+    srcs = [":cache_proxy"],
+)
+
+oci_image(
+    name = "oci_image",
+    base = "@buildbuddy_go_oci_image_base",
+    entrypoint = ["/cache_proxy"],
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [":tar"],
+    visibility = ["//visibility:public"],
+)

enterprise/server/cmd/server/BUILD

@@ -1,6 +1,8 @@
 load("@io_bazel_rules_docker//container:container.bzl", "container_image")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 # gazelle:default_visibility //enterprise:__subpackages__,@buildbuddy_internal//:__subpackages__
 package(default_visibility = [
@@ -130,3 +132,27 @@ container_image(
     tags = ["manual"],
     visibility = ["//visibility:public"],
 )
+
+# TODO(sluongng): Verify the layering of the image.
+pkg_tar(
+    name = "tar",
+    srcs = [
+        ":buildbuddy",
+    ],
+    remap_paths = {
+        "/buildbuddy": "/app/server/cmd/buildbuddy/buildbuddy",
+    },
+    symlinks = {
+        "config.yaml": "app/enterprise/server/cmd/server/buildbuddy.runfiles/buildbuddy/enterprise/config/buildbuddy.release.yaml",
+        "buildbuddy": "tmp",
+    },
+)
+
+oci_image(
+    name = "oci_image",
+    base = "@buildbuddy_go_oci_image_base",
+    entrypoint = ["/app/server/cmd/buildbuddy/buildbuddy"],
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [":tar"],
+    visibility = ["//visibility:public"],
+)

enterprise/tools/rbeperf/BUILD

@@ -1,6 +1,8 @@
 load("@io_bazel_rules_docker//container:container.bzl", "container_push")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 package(default_visibility = ["//enterprise:__subpackages__"])
 
@@ -57,3 +59,25 @@ container_push(
     tag_file = "//deployment:image_tag_file",
     tags = ["manual"],  # Don't include this target in wildcard patterns
 )
+
+pkg_tar(
+    name = "tar",
+    srcs = [":rbeperf"],
+)
+
+oci_image(
+    name = "oci_image",
+    base = "@buildbuddy_go_oci_image_base",
+    entrypoint = ["/rbeperf"],
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [":tar"],
+    visibility = ["//visibility:public"],
+)
+
+oci_push(
+    name = "push",
+    image = ":oci_image",
+    # Set the image tag with the bazel run flag "--//deployment:image_tag=TAG"
+    remote_tags = "//deployment:oci_tag_file",
+    repository = "gcr.io/flame-build/rbeperf-oci",
+)

tools/cacheload/BUILD

@@ -1,6 +1,8 @@
 load("@io_bazel_rules_docker//container:container.bzl", "container_push")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
 go_library(
     name = "cacheload_lib",
@@ -55,3 +57,24 @@ container_push(
     tag_file = "//deployment:image_tag_file",
     tags = ["manual"],  # Don't include this target in wildcard patterns
 )
+
+pkg_tar(
+    name = "tar",
+    srcs = [":cacheload"],
+)
+
+oci_image(
+    name = "oci_image",
+    base = "@buildbuddy_go_oci_image_base",
+    entrypoint = ["/cacheload"],
+    target_compatible_with = ["@platforms//os:linux"],
+    tars = [":tar"],
+)
+
+oci_push(
+    name = "push",
+    image = ":oci_image",
+    # Set the image tag with the bazel run flag "--//deployment:image_tag=TAG"
+    remote_tags = "//deployment:oci_tag_file",
+    repository = "gcr.io/flame-build/cacheload-oci",
+)