refactor: start using rules_distroless

.bazelrc

@@ -8,4 +8,4 @@ test:release --workspace_status_command=./private/stamp.bash --stamp
 
 # Allow external dependencies to be retried. debian snapshot is unreliable and needs retries.
 common --experimental_repository_downloader_retries=20
-common --http_timeout_scaling=2.0
+common --http_timeout_scaling=2.0

WORKSPACE

@@ -5,9 +5,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # rules_distroless setup
 http_archive(
     name = "rules_distroless",
-    sha256 = "4b6d6a4bd03431f4f680ff5f6feea0b8ccf52c0296a12818d2c9595392e45543",
-    strip_prefix = "rules_distroless-0.2.0",
-    url = "https://github.com/GoogleContainerTools/rules_distroless/releases/download/v0.2.0/rules_distroless-v0.2.0.tar.gz",
+    sha256 = "9306b5b8a296d95745d7b38be20c320db125f1b5f6fc3ad507de21c8d562b159",
+    strip_prefix = "rules_distroless-896a27f8aee503c6ea3eeae47b51a4fc84c8496a",
+    url = "https://github.com/GoogleContainerTools/rules_distroless/archive/896a27f8aee503c6ea3eeae47b51a4fc84c8496a.tar.gz",
 )
 
 load("@rules_distroless//distroless:dependencies.bzl", "distroless_dependencies")
@@ -162,11 +162,3 @@ load("@rules_rust//rust:repositories.bzl", "rust_register_toolchains", "rust_rep
 rust_repositories(edition = "2021")
 
 rust_register_toolchains()
-
-# rules_docker setup.
-# NOTE: this ruleset is almost unused and replaced by rules_oci completely expect a few helper macros that'll be hosted on distroless-tools.
-http_archive(
-    name = "io_bazel_rules_docker",
-    sha256 = "b1e80761a8a8243d03ebca8845e9cc1ba6c82ce7c5179ce2b295cd36f7e394bf",
-    urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.25.0/rules_docker-v0.25.0.tar.gz"],
-)

base/BUILD

@@ -1,102 +1,9 @@
-load(":base.bzl", "NONROOT", "distro_components")
+load(":base.bzl", "base_images")
 load(":distro.bzl", "DISTROS")
-load("@rules_pkg//:pkg.bzl", "pkg_tar")
-load("@io_bazel_rules_docker//contrib:group.bzl", "group_entry", "group_file")
-load("@io_bazel_rules_docker//contrib:passwd.bzl", "passwd_entry", "passwd_tar")
 
 package(default_visibility = ["//visibility:public"])
 
-NOBODY = 65534
-
-# Create /etc/passwd with the root user
-passwd_entry(
-    name = "root_user",
-    gid = 0,
-    home = "/root",
-    info = "root",
-    shell = "/sbin/nologin",
-    uid = 0,
-    username = "root",
-)
-
-passwd_entry(
-    name = "nobody_user",
-    create_home = False,
-    gid = NOBODY,
-    home = "/nonexistent",
-    info = "nobody",
-    shell = "/sbin/nologin",
-    uid = NOBODY,
-    username = "nobody",
-)
-
-passwd_entry(
-    name = "nonroot_user",
-    gid = NONROOT,
-    home = "/home/nonroot",
-    info = "nonroot",
-    shell = "/sbin/nologin",
-    uid = NONROOT,
-    username = "nonroot",
-)
-
-passwd_tar(
-    name = "passwd",
-    entries = [
-        ":root_user",
-        ":nobody_user",
-        ":nonroot_user",
-    ],
-    passwd_file_pkg_dir = "etc",
-)
-
-# Create /etc/group with the root, tty, and staff groups
-group_entry(
-    name = "root_group",
-    gid = 0,
-    groupname = "root",
-)
-
-group_entry(
-    name = "nobody_group",
-    gid = NOBODY,
-    groupname = "nobody",
-)
-
-group_entry(
-    name = "nonroot_group",
-    gid = NONROOT,
-    groupname = "nonroot",
-)
-
-group_entry(
-    name = "tty_group",
-    gid = 5,
-    groupname = "tty",
-)
-
-group_entry(
-    name = "staff_group",
-    gid = 50,
-    groupname = "staff",
-)
-
-group_file(
-    name = "group",
-    entries = [
-        ":root_group",
-        ":nobody_group",
-        ":tty_group",
-        ":staff_group",
-        ":nonroot_group",
-    ],
-)
-
-pkg_tar(
-    name = "group_tar",
-    srcs = [":group"],
-    mode = "0644",
-    package_dir = "etc",
-)
-
-[distro_components(distro) for distro in DISTROS]
+[
+    base_images(distro = distro)
+    for distro in DISTROS
+]

base/base.bzl

@@ -5,19 +5,17 @@ load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_image_index")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
 load("//:checksums.bzl", "ARCHITECTURES", "VARIANTS")
-load("//cacerts:cacerts.bzl", "cacerts")
+load("//common:variables.bzl", "NONROOT")
+load("//private/util:deb.bzl", "deb")
 
-NONROOT = 65532
+USER_VARIANTS = [("root", 0, "/"), ("nonroot", NONROOT, "/home/nonroot")]
 
-def deb_file(arch, distro, package):
-    return "@{arch}_{distro}_{package}//:data".format(arch = arch, distro = distro, package = package)
+def base_images(distro):
+    """Replicate everything for all distroless suffixes
 
-def deb_pkg(arch, distro, package):
-    return "@{arch}_{distro}_{package}".format(arch = arch, distro = distro, package = package)
-
-# Replicate everything for all distroless suffixes
-def distro_components(distro):
-    USER_VARIANTS = [("root", 0, "/"), ("nonroot", NONROOT, "/home/nonroot")]
+    Args:
+        distro: name of the distribution
+    """
 
     # loop for multi-arch images
     for (user, _, _) in USER_VARIANTS:
@@ -70,11 +68,6 @@ def distro_components(distro):
         )
 
     for arch in ARCHITECTURES:
-        cacerts(
-            name = "cacerts_" + arch + "_" + distro,
-            deb = deb_file(arch, distro, "ca-certificates"),
-        )
-
         for (user, uid, workdir) in USER_VARIANTS:
             oci_image(
                 name = "static_" + user + "_" + arch + "_" + distro,
@@ -86,20 +79,19 @@ def distro_components(distro):
                     "SSL_CERT_FILE": "/etc/ssl/certs/ca-certificates.crt",
                 },
                 tars = [
-                    deb_pkg(arch, distro, "base-files"),
-                    deb_pkg(arch, distro, "netbase"),
-                    deb_pkg(arch, distro, "tzdata"),
-                    ":passwd",
-                    ":group_tar",
-
+                    deb.package(arch, distro, "base-files"),
+                    deb.package(arch, distro, "netbase"),
+                    deb.package(arch, distro, "tzdata"),
+                    "//common:rootfs",
+                    "//common:passwd",
+                    "//common:home",
+                    "//common:group",
                     # Create /tmp, too many things assume it exists.
                     # tmp.tar has a /tmp with the correct permissions 01777
-                    # A tar is needed because at the moment there is no way to create a
-                    # directory with specific permissions.
-                    ":tmp.tar",
+                    "//common:tmp",
                     ":nsswitch.tar",
-                    "//os_release:os_release_" + distro + ".tar",
-                    ":cacerts_" + arch + "_" + distro + ".tar",
+                    "//common:os_release_" + distro,
+                    "//common:cacerts_" + distro + "_" + arch,
                 ],
                 user = "%d" % uid,
                 workdir = workdir,
@@ -112,7 +104,7 @@ def distro_components(distro):
                 name = "base_nossl_" + user + "_" + arch + "_" + distro,
                 base = ":static_" + user + "_" + arch + "_" + distro,
                 tars = [
-                    deb_pkg(arch, distro, "libc6"),
+                    deb.package(arch, distro, "libc6"),
                 ],
             )
 
@@ -131,10 +123,10 @@ def distro_components(distro):
                 name = "base_" + user + "_" + arch + "_" + distro,
                 base = ":static_" + user + "_" + arch + "_" + distro,
                 tars = [
-                    deb_pkg(arch, distro, "libc6"),
+                    deb.package(arch, distro, "libc6"),
                 ] + [
-                    deb_pkg(arch, distro, deb)
-                    for deb in BASE_DISTRO_DEBS[distro]
+                    deb.package(arch, distro, pkg)
+                    for pkg in BASE_DISTRO_DEBS[distro]
                 ],
             )