[libc++][Android] Fix Android bugs in the CI Dockerfile

[rprichard]

The base of android-buildkite-builder is buildkite-builder, not android-build-base. android-build-base is only used for its /opt/android directory, so move the Docker installation step into android-buildkite-builder.

Install bzip2 for extracting ndk_platform.tar.bz2.

Add "set -e" to RUN heredocs to catch failing commands.

[llvmbot]

@llvm/pr-subscribers-libcxx

Author: Ryan Prichard (rprichard)

Changes

The base of android-buildkite-builder is buildkite-builder, not android-build-base. android-build-base is only used for its /opt/android directory, so move the Docker installation step into android-buildkite-builder.

Install bzip2 for extracting ndk_platform.tar.bz2.

Add "set -e" to RUN heredocs to catch failing commands.

---

Full diff: https://github.com/llvm/llvm-project/pull/99623.diff

2 Files Affected:

• (modified) libcxx/utils/ci/Dockerfile (+27-15)
• (modified) libcxx/utils/ci/vendor/android/run-buildbot-container (+1-1)

diff --git a/libcxx/utils/ci/Dockerfile b/libcxx/utils/ci/Dockerfile
index 9e1865ee61fdf..490bee4942e03 100644
--- a/libcxx/utils/ci/Dockerfile
+++ b/libcxx/utils/ci/Dockerfile
@@ -106,6 +106,7 @@ RUN sudo apt-get update \
 #RUN apt-get update && apt-get install -y ninja-build python3 python3-distutils python3-psutil git gdb ccache
 # TODO add ninja-build once 1.11 is available in Ubuntu, also remove the manual installation.
 RUN <<EOF
+  set -e
   wget -qO /tmp/ninja.gz https://github.com/ninja-build/ninja/releases/latest/download/ninja-linux.zip
   gunzip /tmp/ninja.gz
   chmod a+x /tmp/ninja
@@ -115,6 +116,7 @@ EOF
 
 # These two locales are not enabled by default so generate them
 RUN <<EOF
+  set -e
   printf "fr_CA ISO-8859-1\ncs_CZ ISO-8859-2" | sudo tee -a /etc/locale.gen
   sudo mkdir /usr/local/share/i1en/
   printf "fr_CA ISO-8859-1\ncs_CZ ISO-8859-2" | sudo tee -a /usr/local/share/i1en/SUPPORTED
@@ -129,6 +131,7 @@ EOF
 # 14 release branch CI uses it. The tip-of-trunk CI will never use Clang 12,
 # though.
 RUN <<EOF
+  set -e
   sudo apt-get update
   wget https://apt.llvm.org/llvm.sh -O /tmp/llvm.sh
   chmod +x /tmp/llvm.sh
@@ -142,6 +145,7 @@ EOF
 
 # Install the most recent GCC, like clang install the previous version as a transition.
 RUN <<EOF
+  set -e
   sudo git clone https://github.com/compiler-explorer/infra.git /tmp/ce-infra
   (cd /tmp/ce-infra && sudo make ce)
   sudo /tmp/ce-infra/bin/ce_install install compilers/c++/x86/gcc $GCC_LATEST_VERSION.1.0
@@ -155,13 +159,14 @@ EOF
 
 RUN <<EOF
     # Install a recent CMake
+    set -e
     wget https://github.com/Kitware/CMake/releases/download/v3.21.1/cmake-3.21.1-linux-x86_64.sh -O /tmp/install-cmake.sh
     sudo bash /tmp/install-cmake.sh --prefix=/usr --exclude-subdir --skip-license
     rm /tmp/install-cmake.sh
 EOF
 
 # ===----------------------------------------------------------------------===##
-#                       Android Buildkite Image
+#                       Android Builder Base Image
 # ===----------------------------------------------------------------------===##
 
 FROM ubuntu:jammy AS android-builder-base
@@ -170,10 +175,11 @@ ARG ANDROID_CLANG_VERSION
 ARG ANDROID_CLANG_PREBUILTS_COMMIT
 ARG ANDROID_SYSROOT_BID
 
-RUN  apt-get update && apt-get install -y curl unzip git
+RUN apt-get update && apt-get install -y curl bzip2 git unzip
 
 # Install the Android platform tools (e.g. adb) into /opt/android/sdk.
 RUN <<EOF
+  set -e
   mkdir -p /opt/android/sdk
   cd /opt/android/sdk
   curl -LO https://dl.google.com/android/repository/platform-tools-latest-linux.zip
@@ -187,6 +193,7 @@ EOF
 ENV ANDROID_CLANG_VERSION=$ANDROID_CLANG_VERSION
 ENV ANDROID_CLANG_PREBUILTS_COMMIT=$ANDROID_CLANG_PREBUILTS_COMMIT
 RUN <<EOF
+    set -e
     git clone --filter=blob:none --sparse \
         https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86 \
         /opt/android/clang
@@ -206,6 +213,7 @@ EOF
 
 ENV ANDROID_SYSROOT_BID=$ANDROID_SYSROOT_BID
 RUN <<EOF
+  set -e
   cd /opt/android
   curl -L -o ndk_platform.tar.bz2 \
       https://androidbuildinternal.googleapis.com/android/internal/build/v3/builds/${ANDROID_SYSROOT_BID}/ndk/attempts/latest/artifacts/ndk_platform.tar.bz2/url
@@ -213,19 +221,6 @@ RUN <<EOF
   rm ndk_platform.tar.bz2
 EOF
 
-# Install Docker
-RUN <<EOF
-  curl -fsSL https://get.docker.com -o /tmp/get-docker.sh
-  sh /tmp/get-docker.sh
-  rm /tmp/get-docker.sh
-
-  # Install Docker. Mark the binary setuid so it can be run without prefixing it
-  # with sudo. Adding the container user to the docker group doesn't work because
-  # /var/run/docker.sock is owned by the host's docker GID, not the container's
-  # docker GID.
-  chmod u+s /usr/bin/docker
-EOF
-
 # ===----------------------------------------------------------------------===##
 #                    Buildkite Builder Image
 # ===----------------------------------------------------------------------===##
@@ -243,6 +238,7 @@ WORKDIR /home/libcxx-builder
 # Install the Buildkite agent and dependencies. This must be done as non-root
 # for the Buildkite agent to be installed in a path where we can find it.
 RUN <<EOF
+  set -e
   cd /home/libcxx-builder
   curl -sL https://raw.githubusercontent.com/buildkite/agent/main/install.sh -o /tmp/install-agent.sh
   bash /tmp/install-agent.sh
@@ -271,6 +267,22 @@ COPY ./vendor/android/container-setup.sh /opt/android/container-setup.sh
 
 ENV PATH="/opt/android/sdk/platform-tools:${PATH}"
 
+USER root
+
+# Install Docker
+RUN <<EOF
+  set -e
+  curl -fsSL https://get.docker.com -o /tmp/get-docker.sh
+  sh /tmp/get-docker.sh
+  rm /tmp/get-docker.sh
+
+  # Install Docker. Mark the binary setuid so it can be run without prefixing it
+  # with sudo. Adding the container user to the docker group doesn't work because
+  # /var/run/docker.sock is owned by the host's docker GID, not the container's
+  # docker GID.
+  chmod u+s /usr/bin/docker
+EOF
+
 USER libcxx-builder
 WORKDIR /home/libcxx-builder
 
diff --git a/libcxx/utils/ci/vendor/android/run-buildbot-container b/libcxx/utils/ci/vendor/android/run-buildbot-container
index 4ab83194c05d5..7b5d9a4cc3fe7 100755
--- a/libcxx/utils/ci/vendor/android/run-buildbot-container
+++ b/libcxx/utils/ci/vendor/android/run-buildbot-container
@@ -27,5 +27,5 @@ if [ -S /var/run/docker.sock ]; then
     DOCKER_OPTIONS+=(--volume /var/run/docker.sock:/var/run/docker.sock)
 fi
 
-docker run "${DOCKER_OPTIONS[@]}" libcxx-builder-android \
+docker run "${DOCKER_OPTIONS[@]}" ghcr.io/libcxx/android-buildkite-builder \
     bash -c 'git config --global --add safe.directory /llvm; (/opt/android/container-setup.sh && exec bash)'

[rprichard]

FWIW: With this PR, docker compose build still fails because apt-get update fails:

E: The repository 'http://apt.llvm.org/noble llvm-toolchain-noble-16 Release' does not have a Release file.

To test the change locally, I commented out this line:

sudo /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 3)) all  # for CI transitions

LLVM 16 is available for jammy (GitHub Actions), but it isn't available for noble (BuildKite). We don't need the apt.llvm.org compilers in the Android BuildKite images, and I'm not sure if we're using the buildkite-builder Linux image anymore now that we've migrated a lot of stuff to GitHub Actions, so maybe one fix is to omit the apt.llvm.org compilers for BuildKite/noble.

(Aside: I was also unable to install LLVM 18 on jammy -- see #99453, which I worked around by commenting out my new set -e line. Maybe that's being fixed already?)

[ldionne]

I am actually rather confused by the current organization of our Dockerfiles. I personally haven't been able to run anything locally out-of-the-box since we moved to Github, but I guess that's another topic. I have a few questions / comments:

• We don't use the buildkite-builder image anymore AFAICT and we should clean that up.
• Is there a reason for keeping the Android builder image in the same Dockerfile as the Github runners?
• Is there a reason for having both Android Builder Base Image and Android Buildkite Builder Image?

[rprichard]

We don't use the buildkite-builder image anymore AFAICT and we should clean that up.

This image is the actual base of android-buildkite-builder, but they could be merged. It looks like we aren't using buildkite-builder anymore.

Is there a reason for having both Android Builder Base Image and Android Buildkite Builder Image?

#71954 created the current organization. I'm guessing it was an initial step towards migrating Android testing to GitHub Actions.

Is there a reason for keeping the Android builder image in the same Dockerfile as the Github runners?

There might be some code that ought to be shared between Android and Linux? It's unclear to me how much that is -- the CMake install step, I suppose.

I think I need to know more about how the GitHub Actions testing works, and whether it's feasible to migrate Android over to it.

[ldionne]

LGTM since this change is an improvement even though I think we could clean up further by merging the Android images.