Adapt website to use g3doc sources and bazel.

This adapts the merged website repository to use the image and bazel
build framework. It explicitly avoids the container_image rules provided
by bazel, opting instead to build with direct docker commands when
necessary.

The relevant build commands are incorporated into the top-level
Makefile.

BUILD

@@ -1,9 +1,48 @@
 load("//tools:defs.bzl", "build_test", "gazelle", "go_path")
+load("//website:defs.bzl", "doc")
 
 package(licenses = ["notice"])
 
 exports_files(["LICENSE"])
 
+doc(
+    name = "contributing",
+    src = "CONTRIBUTING.md",
+    category = "Project",
+    permalink = "/contributing/",
+    visibility = ["//website:__pkg__"],
+    weight = "20",
+)
+
+doc(
+    name = "security",
+    src = "SECURITY.md",
+    category = "Project",
+    permalink = "/security/",
+    visibility = ["//website:__pkg__"],
+    weight = "30",
+)
+
+doc(
+    name = "governance",
+    src = "GOVERNANCE.md",
+    category = "Project",
+    permalink = "/community/governance/",
+    subcategory = "Community",
+    visibility = ["//website:__pkg__"],
+    weight = "91",
+)
+
+doc(
+    name = "code_of_conduct",
+    src = "CODE_OF_CONDUCT.md",
+    category = "Project",
+    permalink = "/community/code_of_conduct/",
+    subcategory = "Community",
+    visibility = ["//website:__pkg__"],
+    weight = "99",
+)
+
 # The sandbox filegroup is used for sandbox-internal dependencies.
 package_group(
     name = "sandbox",

CONTRIBUTING.md

@@ -39,8 +39,8 @@ Dependencies can be added by using `go mod get`. In order to keep the
 
 All Go code should conform to the [Go style guidelines][gostyle]. C++ code
 should conform to the [Google C++ Style Guide][cppstyle] and the guidelines
-described for [tests][teststyle]. Note that code may be automatically formatted
-per the guidelines when merged.
+described for tests. Note that code may be automatically formatted per the
+guidelines when merged.
 
 As a secure runtime, we need to maintain the safety of all of code included in
 gVisor. The following rules help mitigate issues.
@@ -131,4 +131,3 @@ one above, the
 [github]: https://github.com/google/gvisor/compare
 [gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev
 [gostyle]: https://github.com/golang/go/wiki/CodeReviewComments
-[teststyle]: ./test/

Makefile

@@ -119,6 +119,38 @@ tests: ## Runs all local ptrace system call tests.
 	@$(MAKE) test OPTIONS="--test_tag_filter runsc_ptrace test/syscalls/..."
 .PHONY: tests
 
+##
+## Website & documentation helpers.
+##
+##   The website is built from repository documentation and wrappers, using
+##   using a locally-defined Docker image (see images/jekyll). The following
+##   variables may be set when using website-push:
+##     WEBSITE_IMAGE   - The name of the container image.
+##     WEBSITE_SERVICE - The backend service.
+##     WEBSITE_PROJECT - The project id to use.
+##     WEBSITE_REGION  - The region to deploy to.
+##
+WEBSITE_IMAGE   := gcr.io/gvisordev/gvisordev
+WEBSITE_SERVICE := gvisordev
+WEBSITE_PROJECT := gvisordev
+WEBSITE_REGION  := us-central1
+
+website-build: load-jekyll ## Build the site image locally.
+	@$(MAKE) run TARGETS="//website:website"
+.PHONY: website-build
+
+website-server: website-build ## Run a local server for development.
+	@docker run -i -p 8080:8080 gvisor.dev/images/website
+.PHONY: website-server
+
+website-push: website-build ## Push a new image and update the service.
+	@docker tag gvisor.dev/images/website $(WEBSITE_IMAGE) && docker push $(WEBSITE_IMAGE)
+.PHONY: website-push
+
+website-deploy: website-push ## Deploy a new version of the website.
+	@gcloud run deploy $(WEBSITE_SERVICE) --platform=managed --region=$(WEBSITE_REGION) --project=$(WEBSITE_PROJECT) --image=$(WEBSITE_IMAGE)
+.PHONY: website-push
+
 ##
 ## Development helpers and tooling.
 ##

g3doc/BUILD

@@ -0,0 +1,37 @@
+load("//website:defs.bzl", "doc")
+
+package(
+    default_visibility = ["//website:__pkg__"],
+    licenses = ["notice"],
+)
+
+doc(
+    name = "index",
+    src = "README.md",
+    permalink = "/docs/",
+    weight = "0",
+)
+
+doc(
+    name = "roadmap",
+    src = "roadmap.md",
+    category = "Project",
+    permalink = "/roadmap/",
+    weight = "10",
+)
+
+doc(
+    name = "basics",
+    src = "basics.md",
+    category = "Project",
+    permalink = "/docs/basics/",
+)
+
+doc(
+    name = "community",
+    src = "community.md",
+    category = "Project",
+    permalink = "/community/",
+    subcategory = "Community",
+    weight = "95",
+)

g3doc/README.md

@@ -1,2 +1,27 @@
-The gVisor logo files are licensed under CC BY-SA 4.0 (Creative Commons
-Attribution-ShareAlike 4.0 International).
+# What is gVisor?
+
+gVisor is a user-space kernel, written in Go, that implements a substantial
+portion of the [Linux system call interface][linux]. It provides an additional
+layer of isolation between running applications and the host operating system.
+
+gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc`
+that makes it easy to work with existing container tooling. The `runsc` runtime
+integrates with Docker and Kubernetes, making it simple to run sandboxed
+containers.
+
+gVisor takes a distinct approach to container sandboxing and makes a different
+set of technical trade-offs compared to existing sandbox technologies, thus
+providing new tools and ideas for the container security landscape.
+
+gVisor can be used with Docker, Kubernetes, or directly using `runsc`. Use the
+links below to see detailed instructions for each of them:
+
+* [Docker](./user_guide/quick_start/docker/): The quickest and easiest way to
+  get started.
+* [Kubernetes](./user_guide/quick_start/kubernetes/): Isolate Pods in your K8s
+  cluster with gVisor.
+* [OCI Quick Start](./user_guide/quick_start/oci/): Expert mode. Customize
+  gVisor for your environment.
+
+[linux]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces
+[oci]: https://www.opencontainers.org

g3doc/architecture_guide/BUILD

@@ -0,0 +1,64 @@
+load("//website:defs.bzl", "doc")
+
+package(
+    default_visibility = ["//website:__pkg__"],
+    licenses = ["notice"],
+)
+
+doc(
+    name = "index",
+    src = "README.md",
+    category = "Architecture Guide",
+    data = [
+        "Layers.png",
+        "Layers.svg",
+        "Machine-Virtualization.png",
+        "Machine-Virtualization.svg",
+        "Rule-Based-Execution.png",
+        "Rule-Based-Execution.svg",
+        "Sentry-Gofer.png",
+        "Sentry-Gofer.svg",
+    ],
+    permalink = "/docs/architecture_guide/",
+    weight = "0",
+)
+
+doc(
+    name = "platforms",
+    src = "platforms.md",
+    category = "Architecture Guide",
+    data = [
+        "Sentry-Gofer.png",
+        "Sentry-Gofer.svg",
+    ],
+    permalink = "/docs/architecture_guide/platforms/",
+    weight = "40",
+)
+
+doc(
+    name = "resources",
+    src = "resources.md",
+    category = "Architecture Guide",
+    permalink = "/docs/architecture_guide/resources/",
+    weight = "30",
+)
+
+doc(
+    name = "security",
+    src = "security.md",
+    category = "Architecture Guide",
+    data = [
+        "Layers.png",
+        "Layers.svg",
+    ],
+    permalink = "/docs/architecture_guide/security/",
+    weight = "10",
+)
+
+doc(
+    name = "performance",
+    src = "performance.md",
+    category = "Architecture Guide",
+    permalink = "/docs/architecture_guide/performance/",
+    weight = "20",
+)

g3doc/architecture_guide/README.md

@@ -1,10 +1,4 @@
----
-title: Overview
-permalink: /docs/architecture_guide/
-layout: docs
-category: Architecture Guide
-weight: 0
----
+# Overview
 
 gVisor provides a virtualized environment in order to sandbox untrusted
 containers. The system interfaces normally implemented by the host kernel are

g3doc/architecture_guide/performance.md

@@ -1,10 +1,4 @@
----
-title: Performance Guide
-permalink: /docs/architecture_guide/performance/
-layout: docs
-category: Architecture Guide
-weight: 20
----
+# Performance Guide
 
 gVisor is designed to provide a secure, virtualized environment while preserving
 key benefits of containerization, such as small fixed overheads and a dynamic

g3doc/architecture_guide/platforms.md

@@ -1,10 +1,4 @@
----
-title: Platform Guide
-permalink: /docs/architecture_guide/platforms/
-layout: docs
-category: Architecture Guide
-weight: 50
----
+# Platform Guide
 
 A gVisor sandbox consists of multiple processes when running. These processes
 collectively comprise a shared environment in which one or more containers can
@@ -19,7 +13,7 @@ Each container running in the sandbox has its own isolated instance of:
 
 * A **Gofer** which provides file system access to the container.
 
-![gVisor architecture diagram](../Sentry-Gofer.png "gVisor architecture diagram")
+![gVisor architecture diagram](Sentry-Gofer.png "gVisor architecture diagram")
 
 ## runsc
 

g3doc/architecture_guide/resources.md

@@ -0,0 +1 @@
+# Resource Model

g3doc/architecture_guide/security.md

@@ -1,10 +1,4 @@
----
-title: "Security Model"
-permalink: /docs/architecture_guide/security/
-layout: docs
-category: Architecture Guide
-weight: 10
----
+# Security Model
 
 gVisor was created in order to provide additional defense against the
 exploitation of kernel bugs by untrusted userspace code. In order to understand

g3doc/community.md

@@ -1,18 +1,9 @@
----
-title: Contributing
-layout: docs
-category: Project
-weight: 20
-permalink: /docs/community/
----
+# Participation
 
-Contributions are accepted through our [GitHub][github] repositories. See the
-[contribution guide][contributing].
+To contribute code, please read the [contributing guide](../CONTRIBUTING.md).
 
-## Governance
-
-See the project [governance][governance]. All projects are covered by our [code
-of conduct][codeofconduct].
+Please note that the [Code of Conduct](../CODE_OF_CONDUCT.md) applies to
+community forums as well as technical participation.
 
 ## Communication channels
 
@@ -23,15 +14,18 @@ The project maintains two mailing lists:
 
 We also have a [chat room hosted on Gitter][gitter-chat].
 
+We'd love to hear from you!
+
+## Community meetings
+
 The community calendar shows upcoming public meetings and opportunities to
-collaborate.
+collaborate or discuss the project. Meetings are planned and announced ahead of
+time via the [gvisor-users][gvisor-users] mailing list.
+
+These meetings are public: anyone can join.
 
 <iframe src="https://calendar.google.com/calendar/b/1/embed?showTitle=0&amp;height=600&amp;wkst=1&amp;bgcolor=%23FFFFFF&amp;src=bd6f4k210u3ukmlj9b8vl053fk%40group.calendar.google.com&amp;color=%23AB8B00&amp;ctz=America%2FLos_Angeles" style="border-width:0" width="600" height="400" frameborder="0" scrolling="no"></iframe>
 
-[contributing]: https://github.com/google/gvisor/blob/master/CONTRIBUTING.md
-[github]: https://github.com/google/gvisor
 [gitter-chat]: https://gitter.im/gvisor/community
-[governance]: https://github.com/google/gvisor/blob/master/GOVERNANCE.md
 [gvisor-dev]: https://groups.google.com/forum/#!forum/gvisor-dev
 [gvisor-users]: https://groups.google.com/forum/#!forum/gvisor-users
-[codeofconduct]: https://github.com/google/gvisor/blob/master/CODE_OF_CONDUCT.md