mirror of
https://github.com/nestriness/nestri.git
synced 2026-11-03 22:22:39 +02:00
fix: Remove proton leftovers
This commit is contained in:
DatCaptainHorse
+9
-128
@@ -28,14 +28,6 @@
|
||||
# (`make build` in this directory does exactly that.)
|
||||
# ═══════════════════════════════════════════════════════════
|
||||
|
||||
|
||||
# Declared here and not beside the stage that uses it, because an ARG a FROM
|
||||
# expands has to precede the *first* FROM in the file. Anywhere else it is
|
||||
# scoped to one stage instead, `FROM ${PROTON_IMAGE}` expands to nothing, and
|
||||
# the build fails with "no FROM statement found" — which says nothing about
|
||||
# the actual mistake. See the Proton stage below for what this is.
|
||||
ARG PROTON_IMAGE=ghcr.io/nestrilabs/proton-cachyos-native-wow64:11.0-20260703
|
||||
|
||||
# ───────────────────────────────────────────────────────────
|
||||
# initial / builder
|
||||
#
|
||||
@@ -43,11 +35,11 @@ ARG PROTON_IMAGE=ghcr.io/nestrilabs/proton-cachyos-native-wow64:11.0-20260703
|
||||
# guest was Artix, chosen for an init system this image no longer contains.
|
||||
# Only build artifacts leave these stages.
|
||||
# ───────────────────────────────────────────────────────────
|
||||
FROM docker.io/cachyos/cachyos-v3:latest AS initial
|
||||
FROM docker.io/archlinux:base-devel AS initial
|
||||
RUN pacman -Syu --noconfirm
|
||||
|
||||
FROM initial AS builder
|
||||
RUN pacman -S --noconfirm --needed \
|
||||
RUN pacman -Syu --noconfirm --needed \
|
||||
cmake meson ninja git pkgconf mold \
|
||||
python python-mako python-yaml python-packaging python-ply \
|
||||
bison flex \
|
||||
@@ -55,7 +47,7 @@ RUN pacman -S --noconfirm --needed \
|
||||
libx11 libxext libxrandr libxshmfence libxfixes libxxf86vm libxcb \
|
||||
xcb-util-keysyms xorgproto \
|
||||
wayland wayland-protocols \
|
||||
expat zlib-ng-compat zstd libxml2 lm_sensors \
|
||||
expat zlib zstd libxml2 lm_sensors \
|
||||
llvm clang libclc spirv-tools spirv-llvm-translator glslang shader-slang \
|
||||
elfutils libva libdrm directx-headers \
|
||||
rustup rust-bindgen cbindgen \
|
||||
@@ -84,8 +76,8 @@ ENV RUSTFLAGS="-C link-arg=-fuse-ld=mold"
|
||||
# ───────────────────────────────────────────────────────────
|
||||
FROM builder AS mesa-build
|
||||
|
||||
ARG MESA_GIT=https://gitlab.freedesktop.org/nowrep/mesa.git
|
||||
ARG MESA_COMMIT=49162a0ba8f3647917bc4c94d13eea6b51a1e49f
|
||||
ARG MESA_GIT=https://gitlab.freedesktop.org/mesa/mesa.git
|
||||
ARG MESA_COMMIT=a4a47003a194effad8cabe727f74985e9417476f
|
||||
ARG JOBS=
|
||||
|
||||
# Our patches to the amdgpu native-context path, applied on top of the pinned
|
||||
@@ -199,7 +191,7 @@ RUN --mount=type=cache,target=/root/.cargo/registry \
|
||||
FROM builder AS umu-build
|
||||
ARG UMU_GIT=https://github.com/Open-Wine-Components/umu-launcher.git
|
||||
ARG UMU_TAG=1.4.4
|
||||
RUN pacman -S --noconfirm --needed \
|
||||
RUN pacman -Syu --noconfirm --needed \
|
||||
make scdoc gcc \
|
||||
python-build python-hatchling python-installer python-pip \
|
||||
&& pacman -Scc --noconfirm
|
||||
@@ -210,33 +202,6 @@ RUN git clone --depth 1 --branch "${UMU_TAG}" --recurse-submodules --shallow-sub
|
||||
make && \
|
||||
make DESTDIR=/artifacts/umu install
|
||||
|
||||
|
||||
# ───────────────────────────────────────────────────────────
|
||||
# Proton — pulled to be checked, not shipped
|
||||
#
|
||||
# Building it takes hours and it changes only when its own tag moves, so it
|
||||
# has a cadence of its own and an image of its own. The published image is
|
||||
# `FROM scratch` over the tree, so its root *is* the tree and there is nothing
|
||||
# in it to run — only something to copy from.
|
||||
#
|
||||
# It is copied into the `compat_check` stage and nowhere else. A box gets its
|
||||
# Proton from the host, as an image attached at run time; this is only the
|
||||
# Proton this rootfs is verified against, and any other can be checked the same
|
||||
# way by overriding it.
|
||||
#
|
||||
# Built wow64-only, which is the whole reason it is a build of ours rather
|
||||
# than a released one at the time. wow64 runs 32-bit Windows code inside a
|
||||
# 64-bit unix process, so a box needs no lib32 anything: no 32-bit glibc, no
|
||||
# second Mesa for i686, and — the one that matters most here — no second
|
||||
# capture layer, because the game is a 64-bit process and loads the 64-bit
|
||||
# Vulkan loader the existing layer already sits in. Upstream Wine defaults to
|
||||
# it from Proton 11, so a released build needs no more than ours does.
|
||||
#
|
||||
# Override to check another; the tag is a version and moves deliberately.
|
||||
# ───────────────────────────────────────────────────────────
|
||||
FROM ${PROTON_IMAGE} AS proton
|
||||
|
||||
|
||||
# ───────────────────────────────────────────────────────────
|
||||
# os-base — the Arch rootfs itself
|
||||
#
|
||||
@@ -262,7 +227,7 @@ FROM ${PROTON_IMAGE} AS proton
|
||||
# obscurely, and a previous attempt at this image lost two services to exactly
|
||||
# that.
|
||||
# ───────────────────────────────────────────────────────────
|
||||
FROM docker.io/cachyos/cachyos-v3:latest AS os-base
|
||||
FROM docker.io/archlinux:base AS os-base
|
||||
|
||||
# The base image ships an unsigned local keyring, so upgrading
|
||||
# `archlinux-keyring` runs a hook that reports `There is no secret key
|
||||
@@ -317,14 +282,14 @@ RUN pacman -Syu --noconfirm --needed \
|
||||
dbus \
|
||||
iptables iproute2 \
|
||||
libglvnd libdrm libepoxy libxxf86vm libinput wayland \
|
||||
expat zlib-ng-compat llvm-libs lm_sensors elfutils libva shaderc vulkan-icd-loader \
|
||||
expat zlib llvm-libs lm_sensors elfutils libva shaderc vulkan-icd-loader \
|
||||
pixman libxkbcommon xcb-util-keysyms xorg-xwayland \
|
||||
pipewire pipewire-audio wireplumber opus \
|
||||
python libunwind sdl2-compat \
|
||||
python-xlib python-urllib3 python-pyzstd \
|
||||
strace lsof less \
|
||||
&& rm -f /usr/share/libalpm/hooks/dbus-reload.hook \
|
||||
&& pacman -Rdd --noconfirm systemd systemd-sysvcompat openssh \
|
||||
&& pacman -Rdd --noconfirm systemd systemd-sysvcompat \
|
||||
&& pacman -Scc --noconfirm
|
||||
|
||||
# `strace`, `lsof` and `less` are for the operator's shell (`neslet box exec`):
|
||||
@@ -596,95 +561,11 @@ RUN umu-run --help >/dev/null 2>&1 \
|
||||
RUN ! pacman -Qq | grep -q '^lib32-' \
|
||||
|| { echo "a lib32 package is installed:" >&2; pacman -Qq | grep '^lib32-' >&2; exit 1; }
|
||||
|
||||
# ───────────────────────────────────────────────────────────
|
||||
# compat_check — does this rootfs still carry what a Proton needs?
|
||||
#
|
||||
# Proton is not part of the image, so what used to be checked by having it
|
||||
# there is checked here, against the Proton named by PROTON_IMAGE: that every
|
||||
# library its programs and Wine's core link is present, and that its entry
|
||||
# point has an interpreter. A rootfs that loses one of them otherwise finds out
|
||||
# as a game that starts and never draws.
|
||||
#
|
||||
# Not a stage anything runs. The leaf stages copy a one-line marker out of it
|
||||
# so that a build cannot skip it as unused, which is also what records which
|
||||
# Proton the image was verified against.
|
||||
#
|
||||
# Check any other Proton the same way:
|
||||
# make PROTON_IMAGE=<ref> build
|
||||
# where <ref> is an image whose root is a Proton tree, or a tree under
|
||||
# `usr/share/steam/compatibilitytools.d/<name>/`.
|
||||
# ───────────────────────────────────────────────────────────
|
||||
FROM runtime AS compat_check
|
||||
ARG PROTON_IMAGE
|
||||
COPY --from=proton / /opt/compat-check/
|
||||
|
||||
# The Proton root is the directory that holds `proton`, wherever the image put
|
||||
# it: a tree directly, or under compatibilitytools.d as the published one does.
|
||||
# Exactly one is expected, and anything else is refused -- picking the first of
|
||||
# several is how the wrong Proton gets verified and the right one never is.
|
||||
RUN set -eu; \
|
||||
found="$(find /opt/compat-check -maxdepth 6 -name proton -type f)"; \
|
||||
[ "$(printf '%s\n' "$found" | grep -c .)" = 1 ] \
|
||||
|| { echo "expected one Proton in ${PROTON_IMAGE}, found:" >&2; echo "$found" >&2; exit 1; }; \
|
||||
dirname "$found" > /tmp/proton-root; \
|
||||
root="$(cat /tmp/proton-root)"; \
|
||||
test -x "$root/proton" || { echo "$root/proton is not executable" >&2; exit 1; }; \
|
||||
test -d "$root/files" || { echo "$root has no files/ directory" >&2; exit 1; }
|
||||
|
||||
# The libraries, by the method the runtime stage documents: the programs in
|
||||
# `bin/`, which resolve normally, and `ntdll.so`, which is Wine's first load and
|
||||
# the one that linked the library once found missing. Each file is resolved with
|
||||
# its own directory on the library path, because Wine's unix objects link each
|
||||
# other by soname.
|
||||
RUN root="$(cat /tmp/proton-root)"; failed=0; : > /tmp/missing-libs; \
|
||||
for f in "$root"/files/bin/* "$root"/files/lib*/wine/*-unix/ntdll.so; do \
|
||||
[ -e "$f" ] || continue; \
|
||||
libs="$(LD_LIBRARY_PATH="${f%/*}" ldd "$f" 2>/dev/null | awk '/not found/ { print $1 }')"; \
|
||||
[ -n "$libs" ] || continue; \
|
||||
failed=1; \
|
||||
printf ' %s\n' "$f" >&2; \
|
||||
printf ' %s\n' $libs >&2; \
|
||||
printf '%s\n' $libs >> /tmp/missing-libs; \
|
||||
done; \
|
||||
if [ "$failed" != 0 ]; then \
|
||||
echo "" >&2; \
|
||||
echo " every library above, once each -- this is the list to install:" >&2; \
|
||||
sort -u /tmp/missing-libs | sed 's/^/ /' >&2; \
|
||||
exit 1; \
|
||||
fi
|
||||
|
||||
# An entry point that is executable is not an entry point that runs.
|
||||
#
|
||||
# A check that only asked `test -x` passed on an image whose compatibility tool
|
||||
# was a Python script with no interpreter behind it: the kernel then fails to
|
||||
# find what the shebang names, and a session got as far as launching a game and
|
||||
# ended with `env: 'python3': No such file or directory`.
|
||||
#
|
||||
# So the entry point resolves its own interpreter. `env` is unwrapped where it
|
||||
# is used, because a shebang of `#!/usr/bin/env python3` names `env` and the
|
||||
# thing that is actually missing is the argument.
|
||||
RUN script="$(cat /tmp/proton-root)/proton"; \
|
||||
head -c 2 "$script" | grep -q '#!' || exit 0; \
|
||||
shebang="$(head -1 "$script" | sed 's/^#!//')"; \
|
||||
interpreter="${shebang%% *}"; \
|
||||
case "$interpreter" in \
|
||||
*/env) argument="${shebang#* }"; interpreter="$(command -v "${argument%% *}" || true)";; \
|
||||
esac; \
|
||||
test -n "$interpreter" && test -x "$interpreter" \
|
||||
|| { echo "$script needs an interpreter the image does not have: $shebang" >&2; exit 1; }
|
||||
|
||||
RUN echo "${PROTON_IMAGE}" > /compat-verified
|
||||
|
||||
|
||||
# ───────────────────────────────────────────────────────────
|
||||
# runtime_prod — the default: `make build`
|
||||
# ───────────────────────────────────────────────────────────
|
||||
FROM runtime AS runtime_prod
|
||||
|
||||
# Which Proton this image was verified against, and the reason the check stage
|
||||
# is built at all. See `compat_check`.
|
||||
COPY --from=compat_check /compat-verified /usr/share/nestri/compat-verified
|
||||
|
||||
# No console is offered by either flavour: `nesinit` spawns no getty, because
|
||||
# the way into a guest that will not boot is `init=/bin/bash` on the kernel
|
||||
# command line, which needs nothing from the image but a shell. So the locked
|
||||
|
||||
Reference in New Issue
Block a user