scripts/docker_run

#!/usr/bin/env bash

# This script runs the provided command in the Docker container corresponding to the currently
# checked-in image id.

readonly SCRIPTS_DIR="$(dirname "$0")"
# shellcheck source=scripts/common
source "${SCRIPTS_DIR}/common"

# The directory of the workspace on the host. Normally this is just the PWD, but in Kokoro it is
# different.
HOST_WORKSPACE_DIR=''
if [[ -n ${KOKORO_HOST_ROOT_DIR:-} ]]; then
  HOST_WORKSPACE_DIR="${KOKORO_HOST_ROOT_DIR}/src/git/oak"
else
  HOST_WORKSPACE_DIR="${PWD}"
fi

docker_run_flags=(
  '--rm'
  '--env=CI'
  '--env=OAK_KVM_TESTS'
  '--env=RUST_BACKTRACE'
  '--env=RUST_LOGS'
  '--env=JUST_TIMESTAMP'
  '--env=JUST_TIMESTAMP_FORMAT'

  '--workdir=/workspace'
  '--network=host'
  '--security-opt=seccomp=unconfined'

  # BIND MOUNTS - Make host directories available in container.
  "--mount=type=bind,source=${HOST_WORKSPACE_DIR},target=/workspace"
  # The container uses the host docker daemon, so docker commands running in
  # the container actually access the host filesystem. Thus mount the /tmp
  # directory as a volume in the container so that it can access the outputs of
  # docker commands that write to /tmp.
  '--mount=type=bind,source=/tmp,target=/tmp'
  '--mount=type=bind,source=/dev/log,target=/dev/log'
  # Provide readonly access to the kernel image and kernel volumes of the host
  # to enable virt-make-fs which requires access to a kernel.
  '--mount=type=bind,source=/boot,target=/boot,ro'
  '--mount=type=bind,source=/lib/modules,target=/lib/modules,ro'

  # VOLUME MOUNTS - They do not map to host directories, but are persisted by
  # the host between runs.
  #
  # Note: src is just a "name" for volume mounts, not a host directory.
  #
  # This prevents nix from having to re-populate the cache every time you start
  # your local docker container.
  '--mount=type=volume,src=nix-store,target=/nix'
  # This prevent bazel from having to re-populate the cache every time you start
  # your local docker container.
  '--mount=type=volume,src=bazel-cache,target=/root/.cache/bazel'

  # TAP networking support
  '--device=/dev/net/tun'
)

# If the host supports KVM, allow the docker image to use it.
if [[ -e "/dev/kvm" ]]; then
  readonly HOST_KVM_GID="$(getent group kvm | cut -d: -f3)"
  docker_run_flags+=(
    "--device=/dev/kvm"
    "--env=HOST_KVM_GID=${HOST_KVM_GID}"
  )
fi

# If the host supports virtio vhost vsock, allow the docker image to use it.
if [[ -e "/dev/vhost-vsock" ]]; then
  docker_run_flags+=(
    "--device=/dev/vhost-vsock"
  )
fi

# If the host supports the vsock device, allow the docker image to use it.
if [[ -e "/dev/vsock" ]]; then
  docker_run_flags+=(
    "--device=/dev/vsock"
  )
fi

# Some CI systems (GitHub actions) do not run with an interactive TTY attached.
if [[ -n ${CI:-} ]]; then
  # When a CI environment variable is present, assume that we only have basic log output.
  docker_run_flags+=(
    # Prevent ANSI escape sequences in Nix; prevents a large amount of log noise
    # during package download.
    '--env=NO_COLOR=true'
  )
else
  # When no CI environment variable is present, assume that we have an interactive TTY.
  docker_run_flags+=(
    '--interactive'
    '--tty'
    '--env=TERM=xterm-256color'
  )
fi

# Run the provided command.
docker run "${docker_run_flags[@]}" "${DOCKER_IMAGE_REPO_DIGEST}" "$@"