This feature is flag-gated because it can increase runsc startup time by
spawning several child processes.
Testing is done via shell script rather than the usually-preferred Go Docker
API because `docker network create` installs a bunch of iptables rules, whereas
the analagous API calls do not.
PiperOrigin-RevId: 582848436
This change moves all Docker images to a standard location, and abstracts the
build process so that they can be maintained in an automated fashion. This also
allows the images to be architecture-independent.
All images will now be referred to by the test framework via the canonical
`gvisor.dev/images/<name>`, where `<name>` is a function of the path within the
source tree.
In a subsequent change, continuous integration will be added so that the images
will always be correct and available locally.
In the end, using `bazel` for Docker containers is simply not possible. Given
that we already have the need to use `make` with the base container (for
Docker), we extend this approach to get more flexibility.
This change also adds a self-documenting and powerful Makefile that is intended
to replace the collection of scripts in scripts. Canonical (self-documenting)
targets can be added here for targets that understand which images need to be
loaded and/or built.
PiperOrigin-RevId: 308322438
Andrei VaginandgVisor bot
Kevin KrakauerandgVisor bot
Adin ScannellandgVisor bot