mirror of
https://github.com/trailofbits/buttercup
synced 2026-06-21 14:11:39 +00:00
Riccardo Schirone
143a59c236
Before this commit, the fuzzer dependend on clusterfuzz, which uses protobuf 3.20. Since fuzzer-bot depended on common subpackage as well and also common (and the other packages) require protobuf, we had to use protobuf 3.20 everywhere. This old dependency however means that a lot of packages can't be used in their "newer" versions, because they depend on newer protobuf versions. This commit splits the fuzzer into a separate fuzzer-runner that is executed in a separate process inside a separate venv. fuzzer-runner executes the clusterfuzz-heavy operations (e.g. fuzzing) and isolates the clusterfuzz dependency, so that the rest of the system can use newer protobuf version. * split `fuzzer-bot` in `fuzzer-runner` and `fuzzer-bot` * have a "full" optional dependency group in `common`, including `openlit` and `protobuf`, so that `fuzzer-runner` can use the lite version of `common` without bringing those heavy deps * move `FuzzConfiguration`/`BuildConfiguration` in a separate common file that doesn't require to load all protobuf files. Again, in this way other components can just depend on the `common` "lite" version and not require protobuf stuff * add `fuzzer-runner` as a separate venv inside the `fuzzer-bot` container * add `RunnerProxy` class in fuzzer package to provide an interface to interact with the fuzzer-runner binary.
69 lines
2.7 KiB
Docker
69 lines
2.7 KiB
Docker
ARG BASE_IMAGE=gcr.io/oss-fuzz-base/base-runner
|
|
|
|
FROM $BASE_IMAGE AS base-image
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.5.20 /uv /uvx /bin/
|
|
|
|
ENV UV_LINK_MODE=copy
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
ENV UV_PYTHON_DOWNLOADS=manual
|
|
|
|
RUN uv python install python3.12
|
|
|
|
FROM base-image AS runner-base
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN install -m 0755 -d /etc/apt/keyrings
|
|
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
|
RUN chmod a+r /etc/apt/keyrings/docker.asc
|
|
|
|
# Add the repository to Apt sources:
|
|
RUN echo \
|
|
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
|
|
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
|
|
tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
FROM base-image AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Install dependencies for fuzzer-bot
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=common/uv.lock,target=common/uv.lock \
|
|
--mount=type=bind,source=common/pyproject.toml,target=common/pyproject.toml \
|
|
--mount=type=bind,source=common/README.md,target=common/README.md \
|
|
--mount=type=bind,source=fuzzer/uv.lock,target=fuzzer/uv.lock \
|
|
--mount=type=bind,source=fuzzer/pyproject.toml,target=fuzzer/pyproject.toml \
|
|
--mount=type=bind,source=fuzzer_runner/uv.lock,target=fuzzer_runner/uv.lock \
|
|
--mount=type=bind,source=fuzzer_runner/pyproject.toml,target=fuzzer_runner/pyproject.toml \
|
|
cd fuzzer && uv sync --frozen --no-install-project --no-editable && cd .. \
|
|
&& cd fuzzer_runner && uv sync --frozen --no-install-project --no-editable && cd ..
|
|
|
|
ADD common /app/common
|
|
ADD fuzzer /app/fuzzer
|
|
ADD fuzzer_runner /app/fuzzer_runner
|
|
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
cd fuzzer && uv sync --frozen --no-editable
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
cd fuzzer_runner && uv sync --frozen --no-editable
|
|
|
|
FROM runner-base AS runtime
|
|
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
|
|
apt-get install -y git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder --chown=app:app /app/fuzzer/.venv /app/fuzzer/.venv
|
|
COPY --from=builder --chown=app:app /app/fuzzer_runner/.venv /app/fuzzer_runner/.venv
|
|
COPY common/container-entrypoint.sh /container-entrypoint.sh
|
|
COPY fuzzer_runner/runner.sh /app/fuzzer_runner/runner.sh
|
|
ENV PATH=/app/fuzzer/.venv/bin:$PATH
|
|
|
|
ENTRYPOINT ["/container-entrypoint.sh"]
|