mirror of
https://github.com/milvus-io/milvus.git
synced 2026-07-21 02:05:41 +00:00
Li LiuandGitHub
c819a2c5e1
## What - Upgrade the root, pkg, client, test, and telemetry example modules from Go 1.26.4 to Go 1.26.5. - Upgrade CPU/GPU builder Dockerfiles, macOS CI Go setup, KRTE build arg, rpm setup, meta-migration builder, and go-client test image to Go 1.26.5. - Point CPU and GPU builder consumption in `.env` to the successful build-env tag `20260714-c135601`. ## Why - Latest direct Trivy scan of `milvusdb/milvus:master-20260711-1993feae-amd64` reports CVE-2026-39822 in Go stdlib 1.26.4, fixed in 1.26.5. - The normal daily image scan is currently blocked through Jenkins `milvus_scan_image_daily` #540 with `exec format error`; last successful scan is #508 from 2026-06-10, so this was verified by direct image scan. ## Image coverage - Go toolchain fixes are shared by all Milvus runtime images; no per-OS runtime Dockerfile package change is required. - Builder definitions are updated for CPU ubuntu22.04, ubuntu20.04, ubuntu24.04, amazonlinux2023, rockylinux9 and GPU ubuntu22.04, ubuntu20.04. - No runtime image variant is deliberately skipped; this is not an OS-package CVE. ## Verification - `go.dev/dl/?mode=json&include=all` confirms go1.26.5 is stable and linux amd64/arm64 tarballs exist. - `go env GOTOOLCHAIN GOVERSION` selects `auto` / `go1.26.5` after the module update. - `go list -m` succeeds for root, pkg, client, tests/go_client, and both telemetry examples. - `cd pkg && go test -tags dynamic,test -gcflags="all=-N -l" -count=1 ./util/typeutil` passes after rebasing onto the latest upstream master. - Jenkins build-env #40 succeeded and published builder tag `20260714-c135601`; `.env` now selects that tag for CPU and GPU CI builds. - A repo-wide audit found no remaining Go 1.26.4 toolchain pins. Note: full root `go mod tidy` is not included because this checkout has a root-owned `deployments/docker/dev/volumes/etcd/member` directory that makes `go mod tidy` fail with permission errors; `go mod tidy -e` subsequently OOMed locally. No go.sum changes were produced by the successful module tidies. Generated by autonomous CVE maintenance. --------- Signed-off-by: Li Liu <li.liu@zilliz.com>
64 lines
2.7 KiB
Docker
64 lines
2.7 KiB
Docker
# Copyright (C) 2019-2022 Zilliz. All rights reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed under the License
|
|
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
|
|
# or implied. See the License for the specific language governing permissions and limitations under the License.
|
|
|
|
FROM ubuntu:focal-20220426
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends wget curl ca-certificates gnupg2 \
|
|
g++ gcc gfortran gdb gdbserver ninja-build git make ccache libssl-dev zlib1g-dev zip unzip \
|
|
clang-format-12 clang-tidy-12 lcov libtool m4 autoconf automake python3 python3-pip \
|
|
pkg-config uuid-dev libaio-dev software-properties-common && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata && \
|
|
ln -sf /usr/share/zoneinfo/Etc/UTC /etc/localtime && \
|
|
echo "Etc/UTC" > /etc/timezone && \
|
|
apt-get remove --purge -y && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Upgrade GCC to 11 (focal default is 9, which folly 2024.08.12.00 rejects)
|
|
RUN add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
|
|
apt-get update && apt-get install -y gcc-11 g++-11 && \
|
|
cd /usr/bin && \
|
|
unlink gcc && ln -s gcc-11 gcc && \
|
|
unlink g++ && ln -s g++-11 g++ && \
|
|
unlink gcov && ln -s gcov-11 gcov && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN pip3 install conan==2.25.1
|
|
|
|
RUN echo "target arch $TARGETARCH"
|
|
RUN wget -qO- "https://cmake.org/files/v3.27/cmake-3.27.5-linux-`uname -m`.tar.gz" | tar --strip-components=1 -xz -C /usr/local
|
|
|
|
# Install Go
|
|
ENV GOPATH /go
|
|
ENV GOROOT /usr/local/go
|
|
ENV GO111MODULE on
|
|
ENV PATH $GOPATH/bin:$GOROOT/bin:$PATH
|
|
RUN mkdir -p /usr/local/go && wget -qO- "https://go.dev/dl/go1.26.5.linux-$TARGETARCH.tar.gz" | tar --strip-components=1 -xz -C /usr/local/go && \
|
|
mkdir -p "$GOPATH/src" "$GOPATH/bin" && \
|
|
go clean --modcache && \
|
|
chmod -R 777 "$GOPATH" && chmod -R a+w $(go env GOTOOLDIR)
|
|
|
|
# refer: https://code.visualstudio.com/docs/remote/containers-advanced#_avoiding-extension-reinstalls-on-container-rebuild
|
|
RUN mkdir -p /home/milvus/.vscode-server/extensions \
|
|
/home/milvus/.vscode-server-insiders/extensions \
|
|
&& chmod -R 777 /home/milvus
|
|
|
|
COPY --chown=0:0 build/docker/builder/entrypoint.sh /
|
|
|
|
RUN curl https://sh.rustup.rs -sSf | \
|
|
sh -s -- --default-toolchain=1.92 -y
|
|
|
|
ENV PATH=/root/.cargo/bin:$PATH
|
|
|
|
ENTRYPOINT [ "/entrypoint.sh" ]
|
|
CMD ["tail", "-f", "/dev/null"]
|