Dockerfile-envoy

ARG BUILD_OS=ubuntu
ARG BUILD_TAG=22.04@sha256:1b8d8ff4777f36f19bfe73ee4df61e3a0b789caeff29caa019539ec7c9a57f95
ARG ENVOY_VRP_BASE_IMAGE=envoy-base


FROM scratch AS binary
COPY ci/docker-entrypoint.sh /
ADD configs/envoyproxy_io_proxy.yaml /etc/envoy/envoy.yaml
# See https://github.com/docker/buildx/issues/510 for why this _must_ be this way
ARG TARGETPLATFORM
ENV TARGETPLATFORM="${TARGETPLATFORM:-linux/amd64}"
ADD "${TARGETPLATFORM}/release.tar.zst" /usr/local/bin/


# STAGE: envoy-base
FROM ${BUILD_OS}:${BUILD_TAG} AS envoy-base
ENV DEBIAN_FRONTEND=noninteractive
EXPOSE 10000
CMD ["envoy", "-c", "/etc/envoy/envoy.yaml"]
RUN mkdir -p /etc/envoy \
    && adduser --group --system envoy
ENTRYPOINT ["/docker-entrypoint.sh"]
# NB: Adding this here means that following steps, for example updating the system packages, are run
#   when the version file changes. This should mean that a release version will always update.
#   In PRs this will just use cached layers unless either this file changes or the version has changed.
ADD VERSION.txt /etc/envoy
RUN --mount=type=tmpfs,target=/var/cache/apt \
    --mount=type=tmpfs,target=/var/lib/apt/lists \
    apt-get -qq update \
    && apt-get -qq upgrade -y \
    && apt-get -qq install --no-install-recommends -y ca-certificates \
    && apt-get -qq autoremove -y


# STAGE: envoy
FROM envoy-base AS envoy
COPY --from=binary --chown=0:0 --chmod=644 \
    /etc/envoy/envoy.yaml /etc/envoy/envoy.yaml
COPY --from=binary --chown=0:0 --chmod=755 \
    /docker-entrypoint.sh /
COPY --from=binary --chown=0:0 --chmod=755 \
    /usr/local/bin/utils/su-exec /usr/local/bin/
ARG ENVOY_BINARY=envoy
ARG ENVOY_BINARY_PREFIX=
COPY --from=binary --chown=0:0 --chmod=755 \
    "/usr/local/bin/${ENVOY_BINARY_PREFIX}${ENVOY_BINARY}" /usr/local/bin/envoy
COPY --from=binary --chown=0:0 --chmod=755 \
    /usr/local/bin/${ENVOY_BINARY_PREFIX}${ENVOY_BINARY}\.* /usr/local/bin/


# STAGE: envoy-tools
FROM envoy AS envoy-tools
# See https://github.com/docker/buildx/issues/510 for why this _must_ be this way
ARG TARGETPLATFORM
ENV TARGETPLATFORM="${TARGETPLATFORM:-linux/amd64}"
COPY --chown=0:0 --chmod=755 \
    "${TARGETPLATFORM}/schema_validator_tool" "${TARGETPLATFORM}/router_check_tool" /usr/local/bin/


# STAGE: envoy-distroless
FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:8a09e5752fb3ab9c9534fcc627eb1f451cd9bcfe66a6b149df62dcb84fb841a6 AS envoy-distroless
EXPOSE 10000
ENTRYPOINT ["/usr/local/bin/envoy"]
CMD ["-c", "/etc/envoy/envoy.yaml"]
COPY --from=binary --chown=0:0 --chmod=644 \
    /etc/envoy/envoy.yaml /etc/envoy/envoy.yaml
COPY --from=binary --chown=0:0 --chmod=755 \
    /usr/local/bin/envoy /usr/local/bin/


# STAGE: envoy-google-vrp-base
FROM ${ENVOY_VRP_BASE_IMAGE} AS envoy-google-vrp-base
EXPOSE 10000
EXPOSE 10001
CMD ["supervisord", "-c", "/etc/supervisor.conf"]
ENTRYPOINT []
ADD --chown=0:0 --chmod=644 \
    configs/google-vrp/*.yaml /etc/envoy/
ADD --chown=0:0 --chmod=755 \
    configs/google-vrp/launch_envoy.sh /usr/local/bin/launch_envoy.sh
ADD --chown=0:0 --chmod=644 \
    test/config/integration/certs/serverkey.pem /etc/envoy/certs/serverkey.pem
ADD --chown=0:0 --chmod=644 \
    test/config/integration/certs/servercert.pem /etc/envoy/certs/servercert.pem
RUN --mount=type=tmpfs,target=/var/cache/apt \
    --mount=type=tmpfs,target=/var/lib/apt/lists \
    apt-get -qq update \
    && apt-get -qq upgrade -y \
    && apt-get -qq install -y libc++1 supervisor gdb strace tshark \
    && apt-get autoremove -y \
    && chmod 777 /var/log/supervisor
ADD --chown=0:0 --chmod=755 configs/google-vrp/supervisor.conf /etc/supervisor.conf


# STAGE: envoy-google-vrp
FROM envoy-google-vrp-base as envoy-google-vrp
COPY  --from=binary --chown=0:0 --chmod=755 \
    /usr/local/bin/envoy /usr/local/bin/envoy


# STAGE: envoy-google-vrp-custom
FROM envoy-google-vrp-base as envoy-google-vrp-custom
ARG ENVOY_CTX_BINARY_PATH
ADD "${ENVOY_CTX_BINARY_PATH}" /usr/local/bin/envoy


# Make envoy image as last stage so it is built by default
FROM envoy