fix(keploy-ci): start-docker asks each daemon with curl; one Go patch (1.27.2) in every image

.github/workflows/docker-build.yml

@@ -16,6 +16,57 @@ on:
   workflow_dispatch:
 
 jobs:
+  # ── One Go patch in every image that ships Go (no build needed) ────
+  # A Go build cache is keyed by the toolchain that wrote it: lanes on two
+  # patches that share one cache split it, each rebuilding what the other
+  # cached. keploy-ci's GO_VERSION (an X.Y.Z, with go.dev's SHA-256 for each
+  # tarball) is the patch; go-build and golint must be FROM that patch's
+  # golang image by digest (a bare golang:1.27-bookworm floats to each new
+  # patch), and ebpf-objects must fetch and check that patch's tarball. The
+  # builds below then run each image's go and compare.
+  go-patch:
+    name: One Go patch in every image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Every Dockerfile that ships Go names keploy-ci's GO_VERSION
+        run: |
+          set -eu
+          rc=0
+          bad() { echo "::error file=$1::$2"; rc=1; }
+          want="$(sed -n 's/^ARG GO_VERSION=//p' keploy-ci/Dockerfile)"
+          printf '%s\n' "$want" | grep -qxE '[0-9]+\.[0-9]+\.[0-9]+' \
+            || bad keploy-ci/Dockerfile "GO_VERSION='$want' is not one X.Y.Z patch"
+          for a in AMD64 ARM64; do
+            grep -qxE "ARG GO_SHA256_$a=[0-9a-f]{64}" keploy-ci/Dockerfile \
+              || bad keploy-ci/Dockerfile "no ARG GO_SHA256_$a=<go.dev's SHA-256 of go$want.linux-$(echo $a | tr A-Z a-z).tar.gz>"
+          done
+          grep -qF 'sha256sum -c' keploy-ci/Dockerfile || bad keploy-ci/Dockerfile "the Go tarball is not checked against GO_SHA256_*"
+          v="$(printf '%s' "$want" | sed 's/\./\\./g')"
+          for f in keploy-ci-go-build/Dockerfile keploy-ci-golint/Dockerfile; do
+            from="$(grep -m1 '^FROM ' "$f")"
+            printf '%s\n' "$from" | grep -qxE "FROM golang:$v-bookworm@sha256:[0-9a-f]{64}" \
+              || bad "$f" "'$from': want FROM golang:$want-bookworm@sha256:<its index digest>"
+          done
+          f=keploy-ci-ebpf-objects/Dockerfile
+          grep -qF "https://go.dev/dl/go$want.linux-amd64.tar.gz" "$f" || bad "$f" "does not fetch go$want.linux-amd64.tar.gz"
+          grep -qE '^ADD --checksum=sha256:[0-9a-f]{64} ' "$f" || bad "$f" "its Go tarball is not ADDed with --checksum"
+          grep -qF "go version | grep -qF 'go$want linux/amd64'" "$f" || bad "$f" "its build does not check go version is go$want"
+          # No other Go named in any instruction (comments aside): another
+          # golang image (by tag, digest or variable), a Go tarball (binary or
+          # source) of another version written out, from any host, Debian's
+          # golang packages, or a GOTOOLCHAIN that names a toolchain, quoted
+          # or not. A tarball named through a variable (keploy-ci's
+          # go${GO_VERSION}) is the runtime check's to catch.
+          others="$(cat keploy-ci*/Dockerfile | grep -v '^[[:space:]]*#' \
+            | grep -oE 'golang[:@][^[:space:]]*|/go[0-9][0-9.]*[0-9]\.(linux-[a-z0-9]+|src)|golang-go|golang-[0-9.]+-go|GOTOOLCHAIN=["'"'"']?go[^[:space:]"'"'"']*' \
+            | grep -vxE "golang:$v-bookworm@sha256:[0-9a-f]{64}|/go$v\.linux-amd64" | sort -u || true)"
+          [ -z "$others" ] || bad . "other Go named: $others"
+          [ "$rc" = 0 ] && echo "every image that ships Go names go$want"
+          exit "$rc"
+
   # ── Stage 0: the minio-cache helper and the s3.sh client it speaks through
   # are duplicated per build context (Docker cannot COPY outside a context).
   # Drift between copies is how the ILM rule-spam regression shipped, so fail
@@ -152,9 +203,11 @@ jobs:
           - context: ./keploy-ci
             tag-prefix: ''
             arch: amd64
+            go: true
           - context: ./keploy-ci
             tag-prefix: ''
             arch: arm64
+            go: true
           - context: ./keploy-ci-slim
             tag-prefix: 'slim-'
             arch: amd64
@@ -170,9 +223,11 @@ jobs:
           - context: ./keploy-ci-golint
             tag-prefix: 'golint-'
             arch: amd64
+            go: true
           - context: ./keploy-ci-golint
             tag-prefix: 'golint-'
             arch: arm64
+            go: true
           - context: ./keploy-ci-awscli
             tag-prefix: 'awscli-'
             arch: amd64
@@ -189,6 +244,7 @@ jobs:
           - context: ./keploy-ci-go-build
             tag-prefix: 'go-build-'
             arch: amd64
+            go: true
 
     steps:
       - name: Checkout repository
@@ -207,8 +263,19 @@ jobs:
           context: ${{ matrix.context }}
           platforms: linux/${{ matrix.arch }}
           push: false
+          load: ${{ matrix.go || false }}
           tags: keploy-ci:${{ matrix.tag-prefix }}ci-${{ matrix.arch }}
 
+      - name: Its go is keploy-ci's GO_VERSION
+        if: matrix.go
+        run: |
+          set -eu
+          want="go$(sed -n 's/^ARG GO_VERSION=//p' keploy-ci/Dockerfile)"
+          got="$(docker run --rm --platform "linux/${{ matrix.arch }}" --entrypoint go \
+            "keploy-ci:${{ matrix.tag-prefix }}ci-${{ matrix.arch }}" env GOVERSION)"
+          echo "keploy-ci declares $want; ${{ matrix.tag-prefix || 'base' }} (${{ matrix.arch }}) runs $got"
+          [ "$got" = "$want" ] || { echo "::error::${{ matrix.tag-prefix || 'base' }} ships $got, not $want"; exit 1; }
+
   # ── A tier-1 image no other image needs, in a job of its own ────────
   # As in publish.yml: derived-images needs base-images, so a leg there that
   # fails (this one fetches from snapshot.ubuntu.com and go.dev) would skip
@@ -224,6 +291,7 @@ jobs:
           - context: ./keploy-ci-ebpf-objects
             tag-prefix: 'ebpf-objects-'
             arch: amd64
+            go: true
 
     steps:
       - name: Checkout repository
@@ -238,8 +306,19 @@ jobs:
           context: ${{ matrix.context }}
           platforms: linux/${{ matrix.arch }}
           push: false
+          load: ${{ matrix.go || false }}
           tags: keploy-ci:${{ matrix.tag-prefix }}ci-${{ matrix.arch }}
 
+      - name: Its go is keploy-ci's GO_VERSION
+        if: matrix.go
+        run: |
+          set -eu
+          want="go$(sed -n 's/^ARG GO_VERSION=//p' keploy-ci/Dockerfile)"
+          got="$(docker run --rm --platform "linux/${{ matrix.arch }}" --entrypoint go \
+            "keploy-ci:${{ matrix.tag-prefix }}ci-${{ matrix.arch }}" env GOVERSION)"
+          echo "keploy-ci declares $want; ${{ matrix.tag-prefix || 'base' }} (${{ matrix.arch }}) runs $got"
+          [ "$got" = "$want" ] || { echo "::error::${{ matrix.tag-prefix || 'base' }} ships $got, not $want"; exit 1; }
+
   # ── Stage 2: images that derive FROM keploy-ci ─────────────────────
   # Exercise the BASE_TAG threading that publish.yml relies on.
   #

README.md

@@ -11,8 +11,9 @@ A Docker-in-Docker image with Go and common CI dependencies for running Keploy t
 **Features:**
 - Based on `debian:trixie-slim`, with Docker Engine 29.1 from Docker's apt
   repository (dockerd, docker CLI, buildx, compose, containerd)
-- Go 1.27.0; no C toolchain (Linux builds use `CGO_ENABLED=0`; Windows
-  cross-compiles use `keploy-ci-go-build`)
+- Go 1.27.2, the one Go patch of every image here that has Go; no C
+  toolchain (Linux builds use `CGO_ENABLED=0`; Windows cross-compiles use
+  `keploy-ci-go-build`)
 - Common CI utilities (bash, curl, git, jq, sudo, zstd, etc.); no MinIO client
   (see below)
 - Helper script `start-docker` to start Docker daemon inside containers
@@ -64,7 +65,7 @@ mirror to install it.
 **Contents:** Ubuntu 22.04 (by index digest), `clang-14` and `llvm-14`
 1:14.0.0-1ubuntu1.1, `libbpf-dev` 1:0.5.0-1ubuntu22.04.1, `linux-libc-dev`,
 `libc6-dev` and their arm64 cross packages, `git`, `ca-certificates`, and Go
-1.27.1 (`GOTOOLCHAIN=local`). Every package installed comes from one
+1.27.2 (`GOTOOLCHAIN=local`). Every package installed comes from one
 snapshot.ubuntu.com snapshot and the recipe's packages are pinned with
 `=version`, so a rebuild resolves the same versions or fails; Go is checked
 against its SHA-256. amd64 only: the snapshot service does not serve

keploy-ci-ebpf-objects/Dockerfile

@@ -1,7 +1,7 @@
 # keploy-ci-ebpf-objects: the toolchain keploy/ebpf's committed BPF objects are
 # built with (the recipe in its compile.sh header: Ubuntu 22.04, clang-14 and
 # llvm-14, libbpf-dev 0.5.0, the native and arm64 cross kernel and libc
-# headers, Go 1.27.1, git), pinned, so that its objects-reproducible lane
+# headers, Go 1.27.2, git), pinned, so that its objects-reproducible lane
 # rebuilds every committed object without apt or a Go download.
 # Used by: keploy/ebpf .woodpecker/objects-reproducible.yml, by digest.
 #
@@ -31,8 +31,8 @@
 # pinned the same way.
 FROM ubuntu@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956 AS go
 
-ADD --checksum=sha256:63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 \
-    https://go.dev/dl/go1.27.1.linux-amd64.tar.gz /tmp/go.tgz
+ADD --checksum=sha256:ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 \
+    https://go.dev/dl/go1.27.2.linux-amd64.tar.gz /tmp/go.tgz
 RUN tar -C /usr/local -xzf /tmp/go.tgz
 
 FROM ubuntu@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956
@@ -90,7 +90,7 @@ ENV PATH=/usr/local/go/bin:$PATH GOTOOLCHAIN=local
 # target with compile.sh's include paths, from the kernel and libbpf headers,
 # and strip it.
 RUN set -eux; \
-    go version | grep -qF 'go1.27.1 linux/amd64'; \
+    go version | grep -qF 'go1.27.2 linux/amd64'; \
     printf '#include <linux/bpf.h>\n#include <linux/types.h>\n#include <asm/types.h>\n#include <bpf/bpf_helpers.h>\nSEC("tracepoint/x") int probe(void *ctx) { return 0; }\nchar LICENSE[] SEC("license") = "GPL";\n' > /tmp/probe.c; \
     clang -target bpf -O2 -g -D__x86_64__ -I/usr/include/x86_64-linux-gnu -c /tmp/probe.c -o /tmp/probe-x86.o; \
     clang -target bpf -O2 -g -D__aarch64__ -I/usr/aarch64-linux-gnu/include -I/usr/include/aarch64-linux-gnu -c /tmp/probe.c -o /tmp/probe-arm64.o; \

keploy-ci-go-build/Dockerfile

@@ -1,6 +1,8 @@
 # keploy-ci-go-build: Go + MinGW cross-compilers
 # Used by: go-test.yml download-and-build, prepare-and-run.yml build-and-upload-keploy
-FROM golang:1.27-bookworm
+# By digest: golang:1.27-bookworm floats to each new patch, and this image's Go
+# must be the patch every CI image ships (keploy-ci/Dockerfile's GO_VERSION).
+FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
 
 RUN set -eux; \
     apt-get update; \

keploy-ci-golint/Dockerfile

@@ -2,7 +2,9 @@
 # the other Linux architecture's cross compiler that enterprise's cgo typecheck
 # needs (see below).
 # Used by: golangci-lint.yml
-FROM golang:1.27-bookworm
+# By digest: golang:1.27-bookworm floats to each new patch, and this image's Go
+# must be the patch every CI image ships (keploy-ci/Dockerfile's GO_VERSION).
+FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
 
 # The C toolchain pieces enterprise's lint needs for its cgo, which the
 # typecheck runs (cgo code is type-checked from what cgo generates):

keploy-ci/Dockerfile

@@ -6,7 +6,15 @@
 # Linux binaries with CGO_ENABLED=0.
 FROM debian:trixie-slim
 
-ARG GO_VERSION=1.27.0
+# One Go patch in every CI image that ships Go: this one (and every image FROM
+# it), go-build, golint and ebpf-objects. A Go build cache is keyed by the
+# toolchain that wrote it, so a cache shared across lanes on different patches
+# splits, each lane rebuilding what the other cached. docker-build.yml holds
+# them to one. GO_SHA256_* are go.dev's SHA-256 of each release tarball
+# (https://go.dev/dl/?mode=json), checked before it is unpacked.
+ARG GO_VERSION=1.27.2
+ARG GO_SHA256_AMD64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
+ARG GO_SHA256_ARM64=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8
 # Keep Docker "major.minor" aligned with the latest stable release.
 ARG DOCKER_MAJOR_MINOR=29.1
 # Provided automatically by BuildKit/buildx; fallback to dpkg when unset.
@@ -79,6 +87,8 @@ RUN set -eux; \
         *) echo "Unsupported architecture: $ARCH"; exit 1 ;; \
     esac; \
     curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tgz; \
+    case "$ARCH" in amd64) sum="$GO_SHA256_AMD64" ;; arm64) sum="$GO_SHA256_ARM64" ;; esac; \
+    echo "$sum  /tmp/go.tgz" | sha256sum -c -; \
     rm -rf /usr/local/go; \
     tar -C /usr/local -xzf /tmp/go.tgz; \
     rm -f /tmp/go.tgz