.dockerignore excludes .git, so util/genbuild.sh finds no repository inside
the container and emits "// No build information available", which
clientversion.cpp renders as the "-unk" suffix. Every binary produced by
./build.sh --linux-compat therefore self-reports "v1.2.0-unk" and cannot be
traced to a commit -- including release artifacts, since this build path is
part of the v1.2.0 tag.
Pre-generating src/obj/build.h does not survive (genbuild rewrites it when the
content differs), and simply un-ignoring .git does not help a linked worktree,
whose .git is a file pointing outside the build context.
So build.sh computes the version on the host, mirroring genbuild.sh rule for
rule -- the nearest tag only when HEAD is that tag and the tree is clean,
otherwise v<VERSION>-<short sha> with a -dirty suffix -- and passes it through
a BUILD_DESC build-arg that Dockerfile.compat exports as DRAGONX_BUILD_DESC.
genbuild.sh honours that variable when set and is otherwise untouched; with
git metadata present it emits a byte-identical build.h.
Every added git call is guarded with || true because build.sh runs under
set -eu -o pipefail: a source tarball, a host without git, or a branch whose
only reachable tags are lightweight (v1.0.1-v1.0.3 are lightweight; v1.1.0 is
the first annotated one) would otherwise abort the build with no diagnostic.
Those cases now degrade to the previous "-unk" behaviour with a warning.
A direct "docker build -f Dockerfile.compat" passes no BUILD_DESC and still
produces -unk; the Dockerfile now says so loudly rather than silently.
Binaries built on Ubuntu 22.04 require GLIBC_2.34 and GLIBCXX_3.4.30 and will not
start on Ubuntu 20.04 -- which is four of our five seeds, and an unknown share of
users. The binary the fleet actually runs today needs only GLIBC_2.29, so it was
built somewhere older; seed 176 has since been upgraded to 22.04 and now produces
binaries it is the only seed able to run.
--linux-compat and Dockerfile.compat already solved this (6d56ad854) but were
undocumented outside the build script and pinned to one base image. Parameterise
the base via ARG BASE_IMAGE (default unchanged, so --linux-compat behaves exactly
as before) and document the whole path.
doc/build-containers.md is written to be executed by a person or an agent starting
from a machine with nothing installed: why the glibc direction matters, with the
measured numbers; what already exists in the repo so nobody writes a second build
system; prerequisites and honest cost (~15GB, 4GB RAM, 1-2h per base because
depends/ builds boost, BDB, wolfssl and rust from source); one-target and
multi-target recipes; which base to pick and why 20.04 is the recommended floor
while 18.04 needs verifying (GCC 7 against -std=c++17); a mandatory verification
step with the exact objdump/readelf commands and the expected ceilings; and the
traps.
The traps are the part worth having written down: ETXTBSY when installing over a
running daemon (cp fails even after the process exits -- stage and rename, then
sha256-verify before starting); never touching configure.ac in a configured tree,
because the mtime alone triggers a reconfigure that dies on libdb_cxx; never
blind-touching a path that may not exist, which silently creates stray empty files;
RandomX needing ARCH=default or it emits AVX-512 that SIGILLs the fleet; build-win.sh
silently discarding every argument; and macOS being uncontainerisable because
depends/ has no darwin cross path at all.
Also records that full static linking is NOT the answer here: the daemon resolves
node1..node5.dragonx.is via getaddrinfo, and static glibc pushes that through NSS,
which dlopens libnss_dns at runtime and reintroduces the dependency it was meant to
remove.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Build release binaries inside an Ubuntu 20.04 Docker container
to produce executables with lower GLIBC requirements, compatible
with older Linux distributions.
- Add Dockerfile.compat (Ubuntu 20.04 base, full depends rebuild)
- Add .dockerignore to exclude host build artifacts from context
- Add --linux-compat flag to build.sh with Docker build/extract/package
- Strip binaries inside container to avoid root ownership issues
