fix: isolate container builds with shared resource limits [CI SKIP]

2026-11-02 17:31:03 +09:00
parent 9f67ee5719
commit db6d8ad8b4
8 changed files with 183 additions and 33 deletions
@@ -0,0 +1,42 @@
+#!/bin/sh
+set -eu
+
+# All clients use the same worker container on the Docker host. Limits are
+# aggregate, including builds submitted simultaneously by API and CI clients.
+docker_bin=${DOCKER_BIN:-docker}
+builder=studio-limited
+node=${builder}0
+container=buildx_buildkit_${node}
+directory=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+image=moby/buildkit@sha256:28a898719c18a33f4e8000685287fa36fd0dd9560c6440227d3a732d79bb41d8
+
+"$docker_bin" buildx version >/dev/null
+if ! "$docker_bin" buildx inspect "$builder" >/dev/null 2>&1; then
+  config_flag=--config
+  if "$docker_bin" buildx create --help | grep -q -- --buildkitd-config; then
+    config_flag=--buildkitd-config
+  fi
+  # Another caller may have registered the builder in this client config first.
+  "$docker_bin" buildx create --name "$builder" --node "$node" \
+    --driver docker-container \
+    --driver-opt "image=$image,memory=8g,memory-swap=8g,cpu-period=100000,cpu-quota=200000,network=host,restart-policy=unless-stopped" \
+    "$config_flag" "$directory/buildkitd.toml" >/dev/null \
+    || "$docker_bin" buildx inspect "$builder" >/dev/null
+fi
+
+info=$("$docker_bin" buildx inspect "$builder")
+driver=$(printf '%s\n' "$info" | awk '$1 == "Driver:" {print $2}')
+[ "$driver" = docker-container ] || { echo 'Refusing unrestricted build driver' >&2; exit 1; }
+names=$(printf '%s\n' "$info" | awk '$1 == "Name:" {print $2}')
+[ "$names" = "$(printf '%s\n%s' "$builder" "$node")" ] || {
+  echo 'Refusing unexpected builder nodes' >&2; exit 1
+}
+"$docker_bin" buildx inspect "$builder" --bootstrap >/dev/null
+limits=$("$docker_bin" inspect "$container" --format '{{.HostConfig.CpuPeriod}} {{.HostConfig.CpuQuota}} {{.HostConfig.Memory}} {{.HostConfig.MemorySwap}}')
+[ "$limits" = '100000 200000 8589934592 8589934592' ] || {
+  echo "Refusing build: unexpected worker limits: $limits" >&2
+  exit 1
+}
+echo '[limits] shared image builder: 2 CPUs, 8 GiB RAM, no swap'
+if [ "${1:-}" = --prepare-only ]; then exit 0; fi
+exec "$docker_bin" buildx build --builder "$builder" --load --progress plain "$@"