dockerfile

# syntax=docker/dockerfile:1

# Stage 1: Build Musl
# Use MIT licensed Alpine as the base image for the build environment
# shellcheck disable=SC2154
FROM --platform="linux/${TARGETARCH}" alpine:latest AS musl-builder

# version is passed through by Docker.
# shellcheck disable=SC2154
ARG MUSL_VER=${MUSL_VER:-"1.2.6"}
ENV MUSL_VER=${MUSL_VER}
ENV MUSL_PREFIX="/usr"
ENV MUSL_SYSROOT="/usr/local/musl-llvm-staging"

RUN set -eux \
    && apk add --no-cache \
        cmd:bsdtar \
        clang \
        llvm \
        cmd:llvm-ar \
        libc++ \
        libc++-dev \
        compiler-rt \
        llvm-runtimes \
        lld \
        make \
        binutils \
        curl \
        ca-certificates \
        build-base \
        gzip \
        perl \
        paxctl \
    && mkdir -vp /build \
    && mkdir -vp "${MUSL_SYSROOT}"

WORKDIR /build
ENV CC=clang
ENV AR=llvm-ar
ENV RANLIB=llvm-ranlib
ENV LD=ld.lld
ENV LDFLAGS="-fuse-ld=lld"
# epoch is passed through by Docker.
# shellcheck disable=SC2154
ARG MITL_DATE_EPOCH
ENV MITL_DATE_EPOCH=${MITL_DATE_EPOCH}
ARG TARGET_TRIPLE
ENV TARGET_TRIPLE=${TARGET_TRIPLE}

# Download musl
RUN curl -fsSL \
    --url "https://musl.libc.org/releases/musl-${MUSL_VER}.tar.gz" \
    -o musl-${MUSL_VER}.tar.gz && \
    bsdtar xf musl-${MUSL_VER}.tar.gz && \
    mv musl-${MUSL_VER} musl

WORKDIR /build/musl

# Configure, build, and install musl with shared enabled (default) using LLVM tools
RUN mkdir -p ${MUSL_PREFIX} && \
    ./configure --prefix=${MUSL_PREFIX} --target=${TARGET_TRIPLE} \
      CC=clang CFLAGS="${CFLAGS} -stdlib=libc++ -rtlib=compiler-rt -fno-math-errno -fPIC -fno-common" AR=llvm-ar LDFLAGS="${LDFLAGS}" && \
    make -j"$(nproc)" && \
    DESTDIR=${MUSL_SYSROOT} make install

# Ensure we have the dynamic loader and libs present
RUN ls -l ${MUSL_SYSROOT}${MUSL_PREFIX}/lib || true \
    && file ${MUSL_SYSROOT}${MUSL_PREFIX}/lib/* || true

# Strip unneeded symbols from shared objects to save space (optional)
RUN set -eux \
    && if command -v llvm-strip >/dev/null 2>&1; then \
         find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.so*" -exec llvm-strip --strip-unneeded {} + || true; \
         find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.o*" -exec llvm-strip --strip-unneeded {} + || true; \
       else \
         find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.so*" -exec strip --strip-unneeded {} + || true; \
         find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.o*" -exec strip --strip-unneeded {} + || true; \
       fi

RUN find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.so" -exec touch -d "${MITL_DATE_EPOCH}" {} + || true; \
    find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.o" -exec touch -d "${MITL_DATE_EPOCH}" {} + || true; \
    find ${MUSL_SYSROOT}${MUSL_PREFIX}/lib -type f -name "*.a" -exec touch -d "${MITL_DATE_EPOCH}" {} + || true; \
    find ${MUSL_SYSROOT}${MUSL_PREFIX}/include -type f -exec touch -d "${MITL_DATE_EPOCH}" {} + || true;

# Ensure we have the dynamic loader and libs striped and set
RUN ls -l ${MUSL_SYSROOT}${MUSL_PREFIX}/lib || true \
    && file ${MUSL_SYSROOT}${MUSL_PREFIX}/lib/* || true

# Stage 2: Build toybox based filesystem
# Use MIT licensed Alpine as the base image for the build environment
# shellcheck disable=SC2154
FROM --platform="linux/${TARGETARCH}" alpine:latest AS builder

# Set environment variables

# epoch is passed through by Docker.
# shellcheck disable=SC2154
ARG MITL_DATE_EPOCH
ENV MITL_DATE_EPOCH=${MITL_DATE_EPOCH}
# version is passed through by Docker.
# shellcheck disable=SC2154
ARG TOYBOX_VERSION=${TOYBOX_VERSION:-"0.8.13"}
ENV TOYBOX_VERSION=${TOYBOX_VERSION}
ENV PATH="/usr/local/bin:$PATH"
ENV CC=clang
ENV CXX=clang++
ENV AR=llvm-ar
ENV RANLIB=llvm-ranlib
ENV LDFLAGS="-fuse-ld=lld"
ENV BSD=/usr/include/bsd
ENV LINUX=/usr/include/linux
# version is passed through by Docker.
# shellcheck disable=SC2154
ARG MUSL_VER=${MUSL_VER:-"1.2.6"}
ENV MUSL_VER=${MUSL_VER}
ENV MUSL_PREFIX="/usr/local/musl-llvm-staging/usr"
ARG MUSL_LDLIB
ENV MUSL_LDLIB="${MUSL_LDLIB}"

# Install necessary packages
# llvm - LLVM-apache-2
# clang - llvm-apache-2
# lld - llvm-apache-2
# build-base - MIT
# git - LGPL2+ - do not bundle - used to clone during bootstrap
# musl-dev - MIT
# linux-headers - GPL-2.0-only - do not bundle - only used until toolbox bash is compiled
# libbsd-dev - BSD-3-Clause
# bash - GPL-3.0 - do not bundle - only until toolbox bash is compiled to run bootstrap scripts
# curl - curl License / MIT
# bsdtar - BSD-2 - used to unarchive during bootstrap (transient)
# openssl-dev - Apache-2.0
# zlib-dev - zlib license

RUN --mount=type=cache,target=/var/cache/apk,sharing=locked --network=default \
  apk update && \
  apk add \
    llvm \
    clang \
    build-base \
    git \
    musl-dev \
    linux-headers \
    bash \
    curl \
    cmd:bsdtar \
    openssl-dev \
    libbsd-dev \
    lld \
    zlib-dev

# Download Toybox and musl
RUN mkdir -p /opt && \
    cd /opt && \
    curl -fsSL \
    --url "https://github.com/landley/toybox/archive/refs/tags/${TOYBOX_VERSION}.tar.gz" \
    -o toybox-${TOYBOX_VERSION}.tar.gz && \
    bsdtar -xzf toybox-${TOYBOX_VERSION}.tar.gz && \
    rm toybox-${TOYBOX_VERSION}.tar.gz && \
    mv /opt/toybox-${TOYBOX_VERSION} /opt/toybox

WORKDIR /opt/toybox

SHELL [ "/bin/sh", "-c" ]

# Copy the Toybox configuration file
COPY toybox_dot_config .config

# Copy the pre-stage tools
COPY cmd-scout.bash /usr/bin/cmd-scout.bash
COPY cmd-trebuchet.bash /usr/bin/cmd-trebuchet.bash
COPY mkroot.bash /usr/bin/mkroot.bash

RUN chmod 555 /usr/bin/cmd-scout.bash && \
    chmod 555 /usr/bin/cmd-trebuchet.bash && \
    chmod 555 /usr/bin/mkroot.bash

# Force-disable optional libraries/features that cause probe failures
RUN if [ -f .config ]; then \
      sed -i \
      -e 's/^CONFIG_SELINUX=.*/CONFIG_SELINUX=n/' \
      -e 's/^CONFIG_ICONV=.*/CONFIG_ICONV=n/' \
      -e 's/^CONFIG_TOYBOX_ICONV=.*/CONFIG_TOYBOX_ICONV=n/' \
      -e 's/^CONFIG_LIBZ=.*/CONFIG_LIBZ=n/' \
      -e 's/^CONFIG_LZ4=.*/CONFIG_LZ4=n/' \
      -e 's/^CONFIG_CRYPTO=.*/CONFIG_CRYPTO=n/' \
      -e 's/^CONFIG_TOYBOX_LIBCRYPTO=.*/CONFIG_TOYBOX_LIBCRYPTO=n/' \
      -e 's/^CONFIG_SELINUX=.*/CONFIG_SELINUX=n/' \
      -e 's/^CONFIG_TOYBOX_SELINUX=.*/CONFIG_TOYBOX_SELINUX=n/' \
      -e 's/^CONFIG_FEATURE_PING=.*/CONFIG_FEATURE_PING=n/' \
      -e 's/^CONFIG_GZIP=.*/CONFIG_GZIP=n/' \
      -e 's/^CONFIG_GUNZIP=.*/CONFIG_GUNZIP=n/' \
      -e 's/^CONFIG_PING=.*/CONFIG_PING=n/' \
      .config || true ; \
    else \
      make defconfig; \
    fi

RUN rm -rf generated flags.* || true && make oldconfig || true

# build with clang and lld
RUN make V=1 CC=clang CFLAGS="-fno-math-errno -fstrict-aliasing -fPIC -fno-common" AR=llvm-ar LINUX="${LINUX}" LDFLAGS="-fmerge-constants ${LDFLAGS}" toybox root && \
    mkdir -p /output/usr/bin /output/etc /output/lib && \
    make install PREFIX=/usr DESTDIR=/output

ENV HOST_TOOLCHAIN_PATH="/opt/toybox/root/host/fs"
ENV PREFIX="/usr"
RUN mkdir /output/fs
ENV DESTDIR="/output/fs"

# Minimal etc
RUN /usr/bin/mkroot.bash && \
    printf "root:x:0:0:root:/root:/bin/sh\n" > "${DESTDIR}"/etc/passwd && \
    printf "/dev/sda / ext4 defaults 0 1\n" > "${DESTDIR}"/etc/fstab && \
    printf "# List of acceptable shells for chpass(1).\n\n/bin/sh\n/bin/bash\n" > "${DESTDIR}"/etc/shells && \
    touch -d "${MITL_DATE_EPOCH}" "${DESTDIR}"/etc/* || true;

# Copy musl runtime artifacts from builder:
# - dynamic loader (ld-musl-*.so.1)
# - libmusl shared object(s) (libc.so.*)
# - crt*.o (for static linking if needed)
# - headers
COPY --from=musl-builder ${MUSL_PREFIX}/lib "${DESTDIR}"/lib
COPY --from=musl-builder ${MUSL_PREFIX}/include "${DESTDIR}"/usr/include

RUN find "${DESTDIR}"/lib -type f -name "*.so" -exec touch -d "${MITL_DATE_EPOCH}" {} + || true; \
    find "${DESTDIR}"/lib -type f -name "*.o" -exec touch -d "${MITL_DATE_EPOCH}" {} + || true; \
    find "${DESTDIR}"/lib -type f -name "*.a" -exec touch -d "${MITL_DATE_EPOCH}" {} + || true; \
    find "${DESTDIR}"/usr/include -type f -exec touch -d "${MITL_DATE_EPOCH}" {} + || true;

# Some systems expect /lib64 -> /lib for x86_64. Create symlink if appropriate (unsupported by musl).
RUN set -eux; \
    if [ "$(uname -m)" = "x86_64" ]; then \
      [ -d "${DESTDIR}"/lib64 ] || ln -s /lib "${DESTDIR}"/lib64; \
    fi

# Ensure loader has canonical name (example: /lib/ld-musl-x86_64.so.1)
RUN set -eux \
    && ln -fns /lib/libc.so "${DESTDIR}/lib/${MUSL_LDLIB}" \
    && ln -fns "/lib/${MUSL_LDLIB}" "${DESTDIR}/lib/ld-musl.so.1"

# Stage 3: Copy over featherHash (0BSD Licensed)
FROM --platform="linux/${TARGETARCH}" ghcr.io/reactive-firewall/featherhash-shasum:master AS mitl-featherhash

# Stage 4: Copy over CinderBool (0BSD Licensed)
FROM --platform="linux/${TARGETARCH}" ghcr.io/reactive-firewall/cinder-bool:master AS mitl-cinderbool

# Stage 5: Create the final image
# shellcheck disable=SC2154
FROM --platform="linux/${TARGETARCH}" scratch AS mitl-bootstrap

# set inherited values
LABEL version="0.9"
LABEL maintainer="mitl-maintainers@users.noreply.github.com"
LABEL org.opencontainers.image.title="MITL-bootstrap"
LABEL org.opencontainers.image.description="Custom Bootstrap MITL image with toybox installed."
LABEL org.opencontainers.image.vendor="individual"
LABEL org.opencontainers.image.licenses="MIT"
LABEL org.opencontainers.image.authors="mitl-maintainers@users.noreply.github.com"


# Copy built files
COPY --from=builder /output/fs /

# Ensure toybox is reachable at /bin/toybox (symlink if needed)
COPY --from=builder /output/fs/usr/bin/toybox /bin/toybox

# Ensure sha256sum is reachable at /bin/sha256sum
COPY --from=mitl-featherhash /bin/sha256sum /bin/sha256sum
# Ensure sha384sum is reachable at /bin/sha384sum
COPY --from=mitl-featherhash /bin/sha384sum /bin/sha384sum
# Ensure sha512sum is reachable at /bin/sha512sum
COPY --from=mitl-featherhash /bin/sha512sum /bin/sha512sum

# Ensure true is reachable at /bin/true
COPY --from=mitl-cinderbool /bin/yes /bin/yes
COPY --from=mitl-cinderbool /bin/true /bin/true

# Ensure false is reachable at /bin/false
COPY --from=mitl-cinderbool /bin/no /bin/no
COPY --from=mitl-cinderbool /bin/false /bin/false

SHELL [ "/bin/bash", "--norc", "-c" ]

# Set the entry point to Toybox
ENTRYPOINT ["/usr/bin/toybox"]
# Set the default path to a reasonable value
ENV PATH='/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/libexec'
# musl libc checks TZ
# format is
# [SUS/POSIX](https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_03)
# Set TZ to UTC
ENV TZ='UTC+0'
# Set PS1 to something
ENV PS1="(\A \u@\h \W) > "
# Set bash to toybox bash
ENV BASH='/bin/bash'
ENV HOSTNAME="MITL-bootstrap"
CMD [ "/bin/bash", "--norc", "-c", "'exec -a bash /bin/bash -i'" ]