1# Copyright (C) 2019 The Android Open Source Project
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7#      http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15# docker:stable is an Alpine-based distro.
16FROM docker:stable
17
18RUN apk update && apk add python py-pip sudo tini
19RUN pip install oauth2client httplib2
20
21# Unfortunately Docker doesn't allow to copy a file from ../. So we copy instead
22# the config files into tmp/ from the Makefile that runs docker build.
23COPY tmp/config.py /home/perfetto/config.py
24COPY tmp/common_utils.py /home/perfetto/common_utils.py
25COPY artifacts_uploader.py /home/perfetto/
26COPY perf_metrics_uploader.py /home/perfetto/
27COPY run_job.py /home/perfetto/
28COPY worker.py /home/perfetto/
29
30# Allow the worker to spawn new docker containers (for the jobs' sandboxes).
31# This makes the worker container highly priviledged (effectiveely can run  any
32# commands on the GCE vm). The worker container is trusted and must never run
33# code from a tryjob (which instead is run into the sandbox containers).
34RUN set -e; \
35    echo 'root ALL=(ALL) ALL' /etc/sudoers; \
36    echo 'perfetto ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers; \
37    addgroup -S perfetto; \
38    adduser -S -h /home/perfetto perfetto perfetto; \
39    chown perfetto.perfetto -R /home/perfetto; \
40    chmod -R 755 /home/perfetto;
41
42USER perfetto:perfetto
43WORKDIR /home/perfetto
44
45ENTRYPOINT [ "tini", "--" ]
46CMD [ "python2", "/home/perfetto/worker.py" ]
47