talos-extensions/container-runtime/gvisor/pkg.yaml

name: gvisor
variant: scratch
shell: /bin/bash
dependencies:
  - stage: base
steps:
  - sources:
      - url: https://github.com/google/gvisor/archive/{{ .GVISOR_REV }}.tar.gz
        destination: gvisor.tar.gz
        sha256: {{ .GVISOR_SHA256 }}
        sha512: {{ .GVISOR_SHA512 }}
    env:
      GOPATH: /tmp/go
    cachePaths:
      - /.cache/go-build
      - /tmp/go/pkg
  - network: default
    prepare:
      - |
        sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml        
      - |
        mkdir -p ${GOPATH}/src/github.com/google/gvisor

        tar -xzf gvisor.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/google/gvisor        
      - |
        cd ${GOPATH}/src/github.com/google/gvisor
        go mod download        
  - network: none
    build:
      - |
        cd ${GOPATH}/src/github.com/google/gvisor

        mkdir ./bin

        CGO_ENABLED=0 go build -o ./bin/runsc ./runsc

        CGO_ENABLED=0 go build -o ./bin/containerd-shim-runsc-v1 ./shim        
    install:
      - |
        mkdir -p /rootfs/usr/local/bin

        cd ${GOPATH}/src/github.com/google/gvisor

        cp ./bin/runsc /rootfs/usr/local/bin/runsc
        chmod +x /rootfs/usr/local/bin/runsc

        cp ./bin/containerd-shim-runsc-v1 /rootfs/usr/local/bin/containerd-shim-runsc-v1
        chmod +x /rootfs/usr/local/bin/containerd-shim-runsc-v1        

      - |
        mkdir -p /rootfs/etc/cri/conf.d

        cp /pkg/10-gvisor.part /pkg/runsc.toml /pkg/10-gvisor-kvm.part /pkg/runsc-kvm.toml /rootfs/etc/cri/conf.d/        
    test:
      - |
        mkdir -p /extensions-validator-rootfs
        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"        
    sbom:
      outputPath: /rootfs/usr/local/share/spdx/gvisor.spdx.json
      version: {{ .GVISOR_VERSION }}
      cpes:
        - cpe:2.3:a:google:gvisor:{{ .GVISOR_VERSION }}:*:*:*:*:*:*:*
      licenses:
        - Apache-2.0
finalize:
  - from: /rootfs
    to: /rootfs
  - from: /pkg/manifest.yaml
    to: /