Erich Blume
ac40a18f3f
Docs-first for C1: tailscale-operator card gains Local Images and Rollout Safety sections (device identity lives in state Secrets; image swaps don't re-register devices). New containers/tailscale-operator (container.py for indri/arm64, default.nix for ringtail/amd64) builds cmd/k8s-operator from the forge mirror, mirroring upstream's mkctr recipe. containers/tailscale gains a container.py so indri's ProxyClass can use a local arm64 proxy image (ringtail already consumes the nix build). Manifest updates follow once images are built and tagged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
104 lines
2.9 KiB
Python
104 lines
2.9 KiB
Python
"""Tailscale proxy image (containerboot) — native Dagger build.
|
|
|
|
Builds cmd/tailscale, cmd/tailscaled, and cmd/containerboot from the forge
|
|
mirror, mirroring the upstream Dockerfile: Alpine runtime with iptables
|
|
(legacy symlinked over the default, per upstream issue #17854), iproute2,
|
|
and the /tailscale/run.sh compat symlink.
|
|
|
|
Consumed by the tailscale-operator ProxyClass on indri's minikube (arm64);
|
|
ringtail's ProxyClass uses the -nix tag from default.nix instead.
|
|
"""
|
|
|
|
import dagger
|
|
|
|
from blumeops.containers import (
|
|
alpine_runtime,
|
|
clone_from_forge,
|
|
go_build,
|
|
oci_labels,
|
|
)
|
|
|
|
VERSION = "v1.94.2"
|
|
|
|
|
|
async def build(src: dagger.Directory) -> dagger.Container:
|
|
source = clone_from_forge("tailscale", VERSION)
|
|
semver = VERSION.removeprefix("v")
|
|
|
|
ldflags = (
|
|
"-w -s"
|
|
f" -X tailscale.com/version.longStamp={semver}"
|
|
f" -X tailscale.com/version.shortStamp={semver}"
|
|
)
|
|
builder = go_build(
|
|
source,
|
|
"/out/tailscale",
|
|
cmd_path="./cmd/tailscale",
|
|
ldflags=ldflags,
|
|
)
|
|
builder = builder.with_exec(
|
|
[
|
|
"go",
|
|
"build",
|
|
f"-ldflags={ldflags}",
|
|
"-o",
|
|
"/out/tailscaled",
|
|
"./cmd/tailscaled",
|
|
]
|
|
).with_exec(
|
|
[
|
|
"go",
|
|
"build",
|
|
f"-ldflags={ldflags}",
|
|
"-o",
|
|
"/out/containerboot",
|
|
"./cmd/containerboot",
|
|
]
|
|
)
|
|
|
|
runtime = alpine_runtime(
|
|
extra_apk=["ca-certificates", "iptables", "iproute2", "ip6tables"],
|
|
create_user=False,
|
|
)
|
|
runtime = oci_labels(
|
|
runtime,
|
|
title="Tailscale",
|
|
description="Tailscale containerboot proxy image for the k8s operator",
|
|
version=VERSION,
|
|
)
|
|
return (
|
|
runtime
|
|
# Match upstream Dockerfile: nftables-backed iptables misbehaves in
|
|
# some environments, force the legacy backend (tailscale/tailscale#17854).
|
|
.with_exec(
|
|
[
|
|
"sh",
|
|
"-c",
|
|
"rm /usr/sbin/iptables && ln -s /usr/sbin/iptables-legacy /usr/sbin/iptables"
|
|
" && rm /usr/sbin/ip6tables && ln -s /usr/sbin/ip6tables-legacy /usr/sbin/ip6tables",
|
|
]
|
|
)
|
|
.with_file(
|
|
"/usr/local/bin/tailscale",
|
|
builder.file("/out/tailscale"),
|
|
permissions=0o555,
|
|
)
|
|
.with_file(
|
|
"/usr/local/bin/tailscaled",
|
|
builder.file("/out/tailscaled"),
|
|
permissions=0o555,
|
|
)
|
|
.with_file(
|
|
"/usr/local/bin/containerboot",
|
|
builder.file("/out/containerboot"),
|
|
permissions=0o555,
|
|
)
|
|
.with_exec(
|
|
[
|
|
"sh",
|
|
"-c",
|
|
"mkdir /tailscale && ln -s /usr/local/bin/containerboot /tailscale/run.sh",
|
|
]
|
|
)
|
|
.with_entrypoint(["/usr/local/bin/containerboot"])
|
|
)
|