From ef32d5f394abce00d1d75fa62c66fc40ef3ad1c8 Mon Sep 17 00:00:00 2001 From: DatCaptainHorse Date: Sat, 3 Oct 2026 20:47:21 +0300 Subject: [PATCH] fix: Remove proton leftovers --- build/Containerfile | 137 +++----------------------------------------- 1 file changed, 9 insertions(+), 128 deletions(-) diff --git a/build/Containerfile b/build/Containerfile index f87397f4..60faada5 100644 --- a/build/Containerfile +++ b/build/Containerfile @@ -28,14 +28,6 @@ # (`make build` in this directory does exactly that.) # ═══════════════════════════════════════════════════════════ - -# Declared here and not beside the stage that uses it, because an ARG a FROM -# expands has to precede the *first* FROM in the file. Anywhere else it is -# scoped to one stage instead, `FROM ${PROTON_IMAGE}` expands to nothing, and -# the build fails with "no FROM statement found" — which says nothing about -# the actual mistake. See the Proton stage below for what this is. -ARG PROTON_IMAGE=ghcr.io/nestrilabs/proton-cachyos-native-wow64:11.0-20260703 - # ─────────────────────────────────────────────────────────── # initial / builder # @@ -43,11 +35,11 @@ ARG PROTON_IMAGE=ghcr.io/nestrilabs/proton-cachyos-native-wow64:11.0-20260703 # guest was Artix, chosen for an init system this image no longer contains. # Only build artifacts leave these stages. # ─────────────────────────────────────────────────────────── -FROM docker.io/cachyos/cachyos-v3:latest AS initial +FROM docker.io/archlinux:base-devel AS initial RUN pacman -Syu --noconfirm FROM initial AS builder -RUN pacman -S --noconfirm --needed \ +RUN pacman -Syu --noconfirm --needed \ cmake meson ninja git pkgconf mold \ python python-mako python-yaml python-packaging python-ply \ bison flex \ @@ -55,7 +47,7 @@ RUN pacman -S --noconfirm --needed \ libx11 libxext libxrandr libxshmfence libxfixes libxxf86vm libxcb \ xcb-util-keysyms xorgproto \ wayland wayland-protocols \ - expat zlib-ng-compat zstd libxml2 lm_sensors \ + expat zlib zstd libxml2 lm_sensors \ llvm clang libclc spirv-tools spirv-llvm-translator glslang shader-slang \ elfutils libva libdrm directx-headers \ rustup rust-bindgen cbindgen \ @@ -84,8 +76,8 @@ ENV RUSTFLAGS="-C link-arg=-fuse-ld=mold" # ─────────────────────────────────────────────────────────── FROM builder AS mesa-build -ARG MESA_GIT=https://gitlab.freedesktop.org/nowrep/mesa.git -ARG MESA_COMMIT=49162a0ba8f3647917bc4c94d13eea6b51a1e49f +ARG MESA_GIT=https://gitlab.freedesktop.org/mesa/mesa.git +ARG MESA_COMMIT=a4a47003a194effad8cabe727f74985e9417476f ARG JOBS= # Our patches to the amdgpu native-context path, applied on top of the pinned @@ -199,7 +191,7 @@ RUN --mount=type=cache,target=/root/.cargo/registry \ FROM builder AS umu-build ARG UMU_GIT=https://github.com/Open-Wine-Components/umu-launcher.git ARG UMU_TAG=1.4.4 -RUN pacman -S --noconfirm --needed \ +RUN pacman -Syu --noconfirm --needed \ make scdoc gcc \ python-build python-hatchling python-installer python-pip \ && pacman -Scc --noconfirm @@ -210,33 +202,6 @@ RUN git clone --depth 1 --branch "${UMU_TAG}" --recurse-submodules --shallow-sub make && \ make DESTDIR=/artifacts/umu install - -# ─────────────────────────────────────────────────────────── -# Proton — pulled to be checked, not shipped -# -# Building it takes hours and it changes only when its own tag moves, so it -# has a cadence of its own and an image of its own. The published image is -# `FROM scratch` over the tree, so its root *is* the tree and there is nothing -# in it to run — only something to copy from. -# -# It is copied into the `compat_check` stage and nowhere else. A box gets its -# Proton from the host, as an image attached at run time; this is only the -# Proton this rootfs is verified against, and any other can be checked the same -# way by overriding it. -# -# Built wow64-only, which is the whole reason it is a build of ours rather -# than a released one at the time. wow64 runs 32-bit Windows code inside a -# 64-bit unix process, so a box needs no lib32 anything: no 32-bit glibc, no -# second Mesa for i686, and — the one that matters most here — no second -# capture layer, because the game is a 64-bit process and loads the 64-bit -# Vulkan loader the existing layer already sits in. Upstream Wine defaults to -# it from Proton 11, so a released build needs no more than ours does. -# -# Override to check another; the tag is a version and moves deliberately. -# ─────────────────────────────────────────────────────────── -FROM ${PROTON_IMAGE} AS proton - - # ─────────────────────────────────────────────────────────── # os-base — the Arch rootfs itself # @@ -262,7 +227,7 @@ FROM ${PROTON_IMAGE} AS proton # obscurely, and a previous attempt at this image lost two services to exactly # that. # ─────────────────────────────────────────────────────────── -FROM docker.io/cachyos/cachyos-v3:latest AS os-base +FROM docker.io/archlinux:base AS os-base # The base image ships an unsigned local keyring, so upgrading # `archlinux-keyring` runs a hook that reports `There is no secret key @@ -317,14 +282,14 @@ RUN pacman -Syu --noconfirm --needed \ dbus \ iptables iproute2 \ libglvnd libdrm libepoxy libxxf86vm libinput wayland \ - expat zlib-ng-compat llvm-libs lm_sensors elfutils libva shaderc vulkan-icd-loader \ + expat zlib llvm-libs lm_sensors elfutils libva shaderc vulkan-icd-loader \ pixman libxkbcommon xcb-util-keysyms xorg-xwayland \ pipewire pipewire-audio wireplumber opus \ python libunwind sdl2-compat \ python-xlib python-urllib3 python-pyzstd \ strace lsof less \ && rm -f /usr/share/libalpm/hooks/dbus-reload.hook \ - && pacman -Rdd --noconfirm systemd systemd-sysvcompat openssh \ + && pacman -Rdd --noconfirm systemd systemd-sysvcompat \ && pacman -Scc --noconfirm # `strace`, `lsof` and `less` are for the operator's shell (`neslet box exec`): @@ -596,95 +561,11 @@ RUN umu-run --help >/dev/null 2>&1 \ RUN ! pacman -Qq | grep -q '^lib32-' \ || { echo "a lib32 package is installed:" >&2; pacman -Qq | grep '^lib32-' >&2; exit 1; } -# ─────────────────────────────────────────────────────────── -# compat_check — does this rootfs still carry what a Proton needs? -# -# Proton is not part of the image, so what used to be checked by having it -# there is checked here, against the Proton named by PROTON_IMAGE: that every -# library its programs and Wine's core link is present, and that its entry -# point has an interpreter. A rootfs that loses one of them otherwise finds out -# as a game that starts and never draws. -# -# Not a stage anything runs. The leaf stages copy a one-line marker out of it -# so that a build cannot skip it as unused, which is also what records which -# Proton the image was verified against. -# -# Check any other Proton the same way: -# make PROTON_IMAGE= build -# where is an image whose root is a Proton tree, or a tree under -# `usr/share/steam/compatibilitytools.d//`. -# ─────────────────────────────────────────────────────────── -FROM runtime AS compat_check -ARG PROTON_IMAGE -COPY --from=proton / /opt/compat-check/ - -# The Proton root is the directory that holds `proton`, wherever the image put -# it: a tree directly, or under compatibilitytools.d as the published one does. -# Exactly one is expected, and anything else is refused -- picking the first of -# several is how the wrong Proton gets verified and the right one never is. -RUN set -eu; \ - found="$(find /opt/compat-check -maxdepth 6 -name proton -type f)"; \ - [ "$(printf '%s\n' "$found" | grep -c .)" = 1 ] \ - || { echo "expected one Proton in ${PROTON_IMAGE}, found:" >&2; echo "$found" >&2; exit 1; }; \ - dirname "$found" > /tmp/proton-root; \ - root="$(cat /tmp/proton-root)"; \ - test -x "$root/proton" || { echo "$root/proton is not executable" >&2; exit 1; }; \ - test -d "$root/files" || { echo "$root has no files/ directory" >&2; exit 1; } - -# The libraries, by the method the runtime stage documents: the programs in -# `bin/`, which resolve normally, and `ntdll.so`, which is Wine's first load and -# the one that linked the library once found missing. Each file is resolved with -# its own directory on the library path, because Wine's unix objects link each -# other by soname. -RUN root="$(cat /tmp/proton-root)"; failed=0; : > /tmp/missing-libs; \ - for f in "$root"/files/bin/* "$root"/files/lib*/wine/*-unix/ntdll.so; do \ - [ -e "$f" ] || continue; \ - libs="$(LD_LIBRARY_PATH="${f%/*}" ldd "$f" 2>/dev/null | awk '/not found/ { print $1 }')"; \ - [ -n "$libs" ] || continue; \ - failed=1; \ - printf ' %s\n' "$f" >&2; \ - printf ' %s\n' $libs >&2; \ - printf '%s\n' $libs >> /tmp/missing-libs; \ - done; \ - if [ "$failed" != 0 ]; then \ - echo "" >&2; \ - echo " every library above, once each -- this is the list to install:" >&2; \ - sort -u /tmp/missing-libs | sed 's/^/ /' >&2; \ - exit 1; \ - fi - -# An entry point that is executable is not an entry point that runs. -# -# A check that only asked `test -x` passed on an image whose compatibility tool -# was a Python script with no interpreter behind it: the kernel then fails to -# find what the shebang names, and a session got as far as launching a game and -# ended with `env: 'python3': No such file or directory`. -# -# So the entry point resolves its own interpreter. `env` is unwrapped where it -# is used, because a shebang of `#!/usr/bin/env python3` names `env` and the -# thing that is actually missing is the argument. -RUN script="$(cat /tmp/proton-root)/proton"; \ - head -c 2 "$script" | grep -q '#!' || exit 0; \ - shebang="$(head -1 "$script" | sed 's/^#!//')"; \ - interpreter="${shebang%% *}"; \ - case "$interpreter" in \ - */env) argument="${shebang#* }"; interpreter="$(command -v "${argument%% *}" || true)";; \ - esac; \ - test -n "$interpreter" && test -x "$interpreter" \ - || { echo "$script needs an interpreter the image does not have: $shebang" >&2; exit 1; } - -RUN echo "${PROTON_IMAGE}" > /compat-verified - - # ─────────────────────────────────────────────────────────── # runtime_prod — the default: `make build` # ─────────────────────────────────────────────────────────── FROM runtime AS runtime_prod -# Which Proton this image was verified against, and the reason the check stage -# is built at all. See `compat_check`. -COPY --from=compat_check /compat-verified /usr/share/nestri/compat-verified - # No console is offered by either flavour: `nesinit` spawns no getty, because # the way into a guest that will not boot is `init=/bin/bash` on the kernel # command line, which needs nothing from the image but a shell. So the locked