.github/workflows/build-push.yml

+name: build-push
+
+on:
+  schedule:
+    - cron: "30 */6 * * *"
+  push:
+    branches:
+    - master  
+  pull_request:
+    branches:
+    - master
+  workflow_dispatch:
+    inputs:
+      EDM4EIC_VERSION:
+        required: false
+        default: ''
+        type: string
+      EICRECON_VERSION:
+        required: false
+        default: ''
+        type: string
+      JUGGLER_VERSION:
+        required: false
+        default: ''
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+env:
+  ## Default versions are specified in packages.yaml but can be overridden
+  ## note: nightly builds will always use the master/main branch
+  EDM4EIC_VERSION: ${{ inputs.EDM4EIC_VERSION }}
+  EICRECON_VERSION: ${{ inputs.EICRECON_VERSION }}
+  JUGGLER_VERSION: ${{ inputs.JUGGLER_VERSION }}
+
+  ## Dockerhub registry
+  DH_REGISTRY: docker.io
+  DH_REGISTRY_USER: eicweb
+  DH_PUSH: 0
+  ## GitHub registry
+  GH_REGISTRY: ghcr.io
+  GH_REGISTRY_USER: eic
+  GH_PUSH: 1
+
+  ## Number of jobs to start during container builds
+  JOBS: 4
+
+  ## Internal tag used for the CI
+  INTERNAL_TAG: pipeline-${{ github.run_id }}
+
+jobs:
+  base:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+        - BASE_IMAGE: debian:stable-slim
+          BUILD_IMAGE: debian_stable_base
+          PLATFORM: linux/amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64,linux/arm64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.DH_REGISTRY }}/${{ env.DH_REGISTRY_USER }}/${{ matrix.BUILD_IMAGE }},enable=${{ env.DH_PUSH != 0 }}
+            name=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/${{ matrix.BUILD_IMAGE }},enable=${{ env.GH_PUSH != 0 }}
+          tags: |
+            ${{ env.INTERNAL_TAG }}
+            type=schedule
+            type=ref,prefix=unstable-pr-,event=pr
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: ${{ env.DH_PUSH == '1' }}
+        with:
+          registry: ${{ env.DH_REGISTRY }}
+          username: ${{ env.DH_REGISTRY_USER }}
+          password: ${{ secrets.DH_EICWEB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ env.GH_PUSH == '1' }}
+        with:
+          registry: ${{ env.GH_REGISTRY }}
+          username: ${{ secrets.GHCR_REGISTRY_USER }}
+          password: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: containers/debian/base.Dockerfile
+          context: containers/debian
+          platforms: ${{ matrix.PLATFORM }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            BASE_IMAGE=${{ matrix.BASE_IMAGE }}
+            BUILD_IMAGE=${{ matrix.BUILD_IMAGE }}
+          cache-from: type=gha,scope=${{ github.workflow }}
+          cache-to: type=gha,mode=max,scope=${{ github.workflow }}
+
+  dev:
+    runs-on: ubuntu-latest
+    needs: base
+    strategy:
+      matrix:
+        include:
+        - BUILDER_IMAGE: debian_stable_base
+          RUNTIME_IMAGE: debian_stable_base
+          BUILD_IMAGE: dev
+          PLATFORM: linux/amd64
+          ENV: dev
+    steps:
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@v1.3.1
+        with:
+          android: true
+          dotnet: true
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Load spack version and cherry-picks
+        id: spack
+        shell: bash
+        run: |
+          source spack.sh
+          echo "orgrepo=${SPACK_ORGREPO}" | tee -a $GITHUB_OUTPUT
+          echo "version=${SPACK_VERSION}" | tee -a $GITHUB_OUTPUT
+          echo "cherrypicks=${SPACK_CHERRYPICKS//$'\n'/ }" | tee -a $GITHUB_OUTPUT
+          echo "cherrypicks_files=${SPACK_CHERRYPICKS_FILES//$'\n'/ }" | tee -a $GITHUB_OUTPUT
+      - name: Load key4hep-spack version
+        id: key4hep-spack
+        run: |
+          source key4hep-spack.sh
+          echo "orgrepo=${KEY4HEPSPACK_ORGREPO}" | tee -a $GITHUB_OUTPUT
+          echo "version=${KEY4HEPSPACK_VERSION}" | tee -a $GITHUB_OUTPUT
+      - name: Load eic-spack version
+        id: eic-spack
+        run: |
+          source eic-spack.sh
+          echo "orgrepo=${EICSPACK_ORGREPO}" | tee -a $GITHUB_OUTPUT
+          echo "version=${EICSPACK_VERSION}" | tee -a $GITHUB_OUTPUT
+      - name: Load secrets into mirrors.yaml
+        id: mirrors
+        run: |
+          source spack.sh
+          export SPACK_VERSION
+          export CI_REGISTRY=ghcr.io
+          export CI_PROJECT_PATH=eic
+          export CI_REGISTRY_USER=${{ secrets.GHCR_REGISTRY_USER }}
+          export CI_REGISTRY_PASSWORD=${{ secrets.GHCR_REGISTRY_TOKEN }}
+          export GITHUB_REGISTRY_USER=${{ secrets.GHCR_REGISTRY_USER }}
+          export GITHUB_REGISTRY_TOKEN=${{ secrets.GHCR_REGISTRY_TOKEN }}
+          export S3RW_ACCESS_KEY=${{ secrets.S3RW_ACCESS_KEY }}
+          export S3RW_SECRET_KEY=${{ secrets.S3RW_SECRET_KEY }}
+          cat mirrors.yaml.in | envsubst > mirrors.yaml
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.DH_REGISTRY }}/${{ env.DH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.DH_PUSH != 0 }}
+            name=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.GH_PUSH != 0 }}
+          tags: |
+            ${{ env.INTERNAL_TAG }}
+            type=schedule,pattern={{date 'YYYY-MM-DD'}}
+            type=ref,prefix=unstable-pr-,event=pr
+            type=match,pattern=^v(\d+\.\d+\.\d+-.*)$,group=1
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: ${{ env.DH_PUSH == '1' }}
+        with:
+          registry: ${{ env.DH_REGISTRY }}
+          username: ${{ env.DH_REGISTRY_USER }}
+          password: ${{ secrets.DH_EICWEB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ env.GH_PUSH == '1' }}
+        with:
+          registry: ${{ env.GH_REGISTRY }}
+          username: ${{ secrets.GHCR_REGISTRY_USER }}
+          password: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: containers/jug/dev.Dockerfile
+          context: containers/jug
+          build-contexts: |
+            spack-environment=spack-environment
+          secret-files: |
+            mirrors=mirrors.yaml
+          platforms: ${{ matrix.PLATFORM }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            DOCKER_REGISTRY=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/
+            BUILDER_IMAGE=${{ matrix.BUILDER_IMAGE }}
+            RUNTIME_IMAGE=${{ matrix.RUNTIME_IMAGE }}
+            BUILD_IMAGE=eic_${{ matrix.BUILD_IMAGE }}
+            INTERNAL_TAG=${{ env.INTERNAL_TAG }}
+            SPACK_ORGREPO=${{ steps.spack.outputs.orgrepo }}
+            SPACK_VERSION=${{ steps.spack.outputs.version }}
+            SPACK_CHERRYPICKS=${{ steps.spack.outputs.cherrypicks }}
+            SPACK_CHERRYPICKS_FILES=${{ steps.spack.outputs.cherrypicks_files }}
+            KEY4HEPSPACK_ORGREPO=${{ steps.eic-spack.outputs.orgrepo }}
+            KEY4HEPSPACK_VERSION=${{ steps.eic-spack.outputs.version }}
+            EICSPACK_ORGREPO=${{ steps.eic-spack.outputs.orgrepo }}
+            EICSPACK_VERSION=${{ steps.eic-spack.outputs.version }}
+            KEY4HEPSPACK_ORGREPO=${{ steps.key4hep-spack.outputs.orgrepo }}
+            KEY4HEPSPACK_VERSION=${{ steps.key4hep-spack.outputs.version }}
+            S3_ACCESS_KEY=${{ secrets.S3_ACCESS_KEY }}
+            S3_SECRET_KEY=${{ secrets.S3_SECRET_KEY }}
+            jobs=${{ env.JOBS }}
+          cache-from: type=gha,scope=${{ github.workflow }}
+          cache-to: type=gha,mode=max,scope=${{ github.workflow }}
+
+  xl:
+    runs-on: ubuntu-latest
+    needs: dev
+    strategy:
+      matrix:
+        include:
+        - BASE_IMAGE: dev
+          BUILD_IMAGE: xl
+          PLATFORM: linux/amd64
+    steps:
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@v1.3.1
+        with:
+          android: true
+          dotnet: true
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.DH_REGISTRY }}/${{ env.DH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.DH_PUSH != 0 }}
+            name=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.GH_PUSH != 0 }}
+          tags: |
+            ${{ env.INTERNAL_TAG }}
+            type=schedule,pattern={{date 'YYYY-MM-DD'}}
+            type=ref,prefix=unstable-pr-,event=pr
+            type=match,pattern=^v(\d+\.\d+\.\d+-.*)$,group=1
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: ${{ env.DH_PUSH == '1' }}
+        with:
+          registry: ${{ env.DH_REGISTRY }}
+          username: ${{ env.DH_REGISTRY_USER }}
+          password: ${{ secrets.DH_EICWEB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ env.GH_PUSH == '1' }}
+        with:
+          registry: ${{ env.GH_REGISTRY }}
+          username: ${{ secrets.GHCR_REGISTRY_USER }}
+          password: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: containers/jug/xl.Dockerfile
+          context: containers/jug
+          build-contexts: |
+            detectors=.
+          platforms: ${{ matrix.PLATFORM }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            DOCKER_REGISTRY=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/
+            BASE_IMAGE=eic_${{ matrix.BASE_IMAGE }}
+            BUILD_IMAGE=eic_${{ matrix.BUILD_IMAGE }}
+            INTERNAL_TAG=${{ env.INTERNAL_TAG }}
+            jobs=${{ env.JOBS }}
+          cache-from: type=gha,scope=${{ github.workflow }}
+          cache-to: type=gha,mode=max,scope=${{ github.workflow }}

.github/workflows/mirror.yaml

+name: Mirror and Trigger EICweb
+
+on:
+  delete:
+  push:
+  workflow_dispatch:
+
+concurrency:
+  group: mirror
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Mirror and Trigger EICweb
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Push to EICweb
+      uses: eic/gitlab-sync@master
+      with:
+        url: https://eicweb.phy.anl.gov/containers/eic_container.git/
+        token: ${{ secrets.GITLAB_TOKEN }}
+        username: ${{ secrets.GITLAB_USERNAME }}
+        ciskip: true
+    - name: Trigger EICweb
+      if: ${{ github.event_name != 'delete' }}
+      uses: eic/trigger-gitlab-ci@v3
+      with:
+        url: https://eicweb.phy.anl.gov
+        project_id: 290
+        token: ${{ secrets.EICWEB_EIC_CONTAINER_TRIGGER }}
+        ref_name: ${{ github.event.pull_request.head.ref || github.ref }}
+        variables: |
+          GITHUB_REPOSITORY=${{ github.repository }}
+          GITHUB_SHA=${{ github.event.pull_request.head.sha || github.sha }}
+          GITHUB_PR=${{ github.event.pull_request.number }}
+          PIPELINE_NAME_CONTAINER=${{ github.repository }}: ${{ github.event.pull_request.title || github.ref_name }}

.gitignore

@@ -19,4 +19,7 @@ BUILD
 debug
 DEBUG
 
+#gitlab-ci-local
+.gitlab-ci-local/
+
 .nfs*

.gitlab-ci-local-env

+PRIVILEGED=1
+CONCURRENCY=1
+ULIMIT=8000:16000
+VOLUME=certs:/certs/client
+VARIABLE="DOCKER_TLS_CERTDIR=/certs"

README.md

-EIC software container
-============================================
+EIC Software Environment Container
+==================================
 
-Simple Installation
-------------
+## Installation Instructions 
 
-*The environment has been tested on linux (requires singularity v3+) and MacOS (requires
-docker)*
+For installation instructions of `eic-shell`, see https://github.com/eic/eic-shell.
 
-Please follow the steps below to setup and run the container in your environment.
+## Updating a package
 
-1. Create a local directory that you want to work in, e.g `$HOME/eic`, and go into this
-   directory.
-```bash
-mkdir $HOME/eic
-cd $HOME/eic
-```
+### An individual package is updated on spack package repository along with a spack version upgrade
+This situation just requires modifying the eic-shell [yaml](https://eicweb.phy.anl.gov/containers/eic_container/-/blob/master/spack-environment/packages.yaml?ref_type=heads) file.
 
-2. Execute the following line in your terminal to setup your environment in this directory
-   to install the latest stable container
-```bash
-curl https://eicweb.phy.anl.gov/containers/eic_container/-/raw/master/install.sh | bash
-```
+#### An individual package is updated on spack package repository after a spack version upgrade
 
-3. You can now load your development environment by executing the `eic-shell` script that
-   is in your top-level working directory.
-```bash
-eic-shell
-```
+This circumstance requires special cherry pick.
 
-4. Within your development environment (`eic-shell`), you can install software to the
-   internal `$ATHENA_PREFIX`
+Example:
+https://eicweb.phy.anl.gov/containers/eic_container/-/merge_requests/879/diffs
 
-Singularity Container setup for Development Usage
--------------
-**Note: this container download script is meant for expert usage. If it is unclear to you
-why you would want to do this, you are probably looking for the simple `jug_xl` installation
-above.**
-
-You can use the same install scripts to setup other container setups, including `jug_dev`
-(the main development container). Note that for `jug_dev` there is no nighlty release, and
-the appropriate version (tag) would be `testing`.  To setup the `jug_dev:testing` environment, do
-```bash
-curl https://eicweb.phy.anl.gov/containers/eic_container/-/raw/master/install.sh | bash -s -- -c jug_dev -v testing
-```
-
-Included software:
-------------------
-  - Included software (for the exact versions, check the file [spack.yaml](spack.yaml) or use the command `eic-info` inside the container):
-    - gcc
-    - madx
-    - cmake
-    - fmt cxxstd=17
-    - spdlog
-    - nlohmann-json
-    - heppdt
-    - clhep cxxstd=17
-    - eigen
-    - python
-    - py-numpy
-    - py-pip
-    - pkg-config
-    - xrootd cxxstd=17 +python
-    - root cxxstd=17 
-          +fftw +fortran +gdml +http +mlp +pythia8 
-          +root7 +tmva +vc +xrootd +ssl 
-          ^mesa swr=none +opengl -llvm -osmesa
-    - pythia8 +fastjet
-    - fastjet
-    - hepmc3 +python +rootio 
-    - stow
-    - cairo +fc+ft+X+pdf+gobject
-    - podio
-    - geant4 cxxstd=17 +opengl +vecgeom +x11 +qt +threads ^qt +opengl
-    - dd4hep +geant4 +assimp +hepmc3 +ipo +lcio
-    - acts +dd4hep +digitization +identification +json +tgeo +ipo +examples +fatras +geant4
-    - genfit
-    - gaudi
-    - dawn
-    - dawncut
-    - opencascade
-    - emacs toolkit=athena
-    - imagemagick
-    - igprof
-  - The singularity build exports the following applications:
-    - eic-shell: a development shell in the image
-
-Using the docker container for your CI purposes
------------------------------------------------
-
-**These instructions are old and need updating. In general we recommend using
-`eicweb/juggler:latest` for most CI usages. This image is functionally identical to
-`jug_xl:nightly`**
-
-The docker containers are publicly accessible from
-[Dockerhub](https://hub.docker.com/u/eicweb). You probably want to use the default
-`jug_xl` container. Relevant versions are:
- - `eicweb/jug_xl:nightly`: nightly release, with latest detector and reconstruction
-   version. This is probably what you want to use unless you are dispatching a large
-   simulation/reconstruciton job
- - `eicweb/jug_xl:3.0-stable`: latest stable release, what you want to use for large
-   simulation jobs (for reproducibility). Please coordinate with the software group to
-   ensure all desired software changes are present in this container.
-
-1. To load the container environment in your run scripts, you have to do nothing special.  
-   The environment is already setup with good defaults, so you can use all the programs 
-   in the container as usual and assume everything needed to run the included software 
-   is already setup.  
-
-2. If using this container as a basis for a new container, you can direction access 
-   the full container environment from a docker `RUN` shell command with no further
-   action needed. For the most optimal experience, you can install your software to
-   `/usr/local` to fully integrate with the existing environment. (Note that, internally,
-   `/usr/local` is a symlink to `/opt/view`).
+In this example, the spack package xrootd had the latest version 5.6.9 which was put in after a spack version upgrade. We had to modify the eic-shell [spack.sh](https://eicweb.phy.anl.gov/containers/eic_container/-/blob/master/spack-environment/packages.yaml?ref_type=heads) file to include the commit hash of the version update from the main [spack](https://github.com/spack/spack/commits/develop/var/spack/repos/builtin/packages/xrootd/package.py) package repository in addition to modifying the eic-shell [yaml](https://eicweb.phy.anl.gov/containers/eic_container/-/blob/master/spack-environment/packages.yaml?ref_type=heads) file.  
 

VERSION

-4.0.0

containers.yaml

-base:
-  debian:
-    develop: amd64/debian:testing-20211220-slim
-    runtime: amd64/debian:testing-20211220-slim
-    Dockerfile: containers/base/Dockerfile.in
-  oneapi:
-    develop: intel/oneapi-hpckit:2022.1.2-devel-ubuntu18.04
-    runtime: intel/oneapi-runtime:2022.1.2-devel-ubuntu18.04
-    Dockerfile: containers/base/Dockerfile.in
-  cuda:
-    develop: nvidia/cuda:11.6.0-devel-ubuntu18.04
-    runtime: nvidia/cuda:11.6.0-runtime-ubuntu18.04
-    Dockerfile: containers/base/Dockerfile.in
-jug:
-  jug_dev:
-    Dockerfile: containers/jug/dev.Dockerfile
-  jug_xl:
-    Dockerfile: containers/jug/xl.Dockerfile

containers/cuda/Dockerfile

-#syntax=docker/dockerfile:1.2
-
-# Minimal container based on Intel oneAPI for up-to-date packages. 
-# Very lightweight container with a minimal build environment (LOL)
-
-FROM  nvidia/cuda:11.6.0-devel-ubuntu18.04
-LABEL maintainer="Wouter Deconinck <wouter.deconinck@umanitoba.ca"      \
-      name="cuda_base"                                                \
-      march="amd64"
-
-COPY bashrc /root/.bashrc
-
-ENV CLICOLOR_FORCE=1                                                    \
-    LANGUAGE=en_US.UTF-8                                                \
-    LANG=en_US.UTF-8                                                    \
-    LC_ALL=en_US.UTF-8
-
-## Install additional packages. Remove the auto-cleanup functionality
-## for docker, as we're using the new buildkit cache instead.
-## We also install gitlab-runner, from the buster package (as bullseye is not available atm)
-## TODO: libyaml-cpp-dev is a dependency for afterburner. We can probably remove
-##       this once afterburner is added to spack
-RUN --mount=type=cache,target=/var/cache/apt                            \
-    rm -f /etc/apt/apt.conf.d/docker-clean                              \
- && ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime          \
- && echo "US/Eastern" > /etc/timezone                                   \
- && apt-get -yqq update                                                 \
- && apt-get -yqq upgrade                                                \
- && apt-get -yqq install --no-install-recommends                        \
-        bc                                                              \
-        ca-certificates                                                 \
-        clang-format                                                    \
-        clang-tidy                                                      \
-        curl                                                            \
-        file                                                            \
-        build-essential                                                 \
-        gdb                                                             \
-        ghostscript                                                     \
-        git                                                             \
-        gnupg2                                                          \
-        gv                                                              \
-        iproute2                                                        \
-        iputils-ping                                                    \
-        iputils-tracepath                                               \
-        less                                                            \
-        libcbor-xs-perl                                                 \
-        libjson-xs-perl                                                 \
-        libyaml-cpp-dev                                                 \
-        locales                                                         \
-        lua-posix                                                       \
-        make                                                            \
-        nano                                                            \
-        openssh-client                                                  \
-        parallel                                                        \
-        poppler-utils                                                   \
-        time                                                            \
-        unzip                                                           \
-        valgrind                                                        \
-        vim-nox                                                         \
-        wget                                                            \
- && localedef -i en_US -f UTF-8 en_US.UTF-8                             \
- && gcc --version                                                       \
- && curl -L                                                             \
-    "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" \
-    | bash                                                              \
- && sed -i "s/bookworm/buster/"                                         \
-           /etc/apt/sources.list.d/runner_gitlab-runner.list            \
- && apt-get -yqq update                                                 \
- && apt-get -yqq install --no-install-recommends                        \
-        gitlab-runner                                                   \
- && apt-get -yqq autoremove                                             \
- && rm -rf /var/lib/apt/lists/*                                         

containers/cuda/bashrc

-#!/bin/bash
-iatest=$(expr index "$-" i)
-
-#######################################################
-# SOURCED ALIAS'S AND SCRIPTS BY zachbrowne.me
-#######################################################
-
-# Source global definitions
-if [ -f /etc/bashrc ]; then
-	 . /etc/bashrc
-fi
-
-# Enable bash programmable completion features in interactive shells
-if [ -f /usr/share/bash-completion/bash_completion ]; then
-	. /usr/share/bash-completion/bash_completion
-elif [ -f /etc/bash_completion ]; then
-	. /etc/bash_completion
-fi
-
-#######################################################
-# EXPORTS
-#######################################################
-
-# Disable the bell
-if [[ $iatest > 0 ]]; then bind "set bell-style visible"; fi
-
-# Expand the history size
-export HISTFILESIZE=10000
-export HISTSIZE=500
-
-# Don't put duplicate lines in the history and do not add lines that start with a space
-export HISTCONTROL=erasedups:ignoredups:ignorespace
-
-# Check the window size after each command and, if necessary, update the values of LINES and COLUMNS
-shopt -s checkwinsize
-
-# Causes bash to append to history instead of overwriting it so if you start a new terminal, you have old session history
-shopt -s histappend
-PROMPT_COMMAND='history -a'
-
-# Allow ctrl-S for history navigation (with ctrl-R)
-stty -ixon
-
-# Ignore case on auto-completion
-# Note: bind used instead of sticking these in .inputrc
-if [[ $iatest > 0 ]]; then bind "set completion-ignore-case on"; fi
-
-# Show auto-completion list automatically, without double tab
-if [[ $iatest > 0 ]]; then bind "set show-all-if-ambiguous On"; fi
-
-# Set the default editor
-export EDITOR=vim
-export VISUAL=vim
-alias pico='edit'
-alias spico='sedit'
-alias nano='edit'
-alias snano='sedit'
-
-# To have colors for ls and all grep commands such as grep, egrep and zgrep
-export CLICOLOR=1
-export LS_COLORS='no=00:fi=00:di=00;34:ln=01;36:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.gz=01;31:*.bz2=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.avi=01;35:*.fli=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.ogg=01;35:*.mp3=01;35:*.wav=01;35:*.xml=00;31:'
-#export GREP_OPTIONS='--color=auto' #deprecated
-#alias grep="/usr/bin/grep $GREP_OPTIONS"
-#unset GREP_OPTIONS
-
-# Color for manpages in less makes manpages a little easier to read
-export LESS_TERMCAP_mb=$'\E[01;31m'
-export LESS_TERMCAP_md=$'\E[01;31m'
-export LESS_TERMCAP_me=$'\E[0m'
-export LESS_TERMCAP_se=$'\E[0m'
-export LESS_TERMCAP_so=$'\E[01;44;33m'
-export LESS_TERMCAP_ue=$'\E[0m'
-export LESS_TERMCAP_us=$'\E[01;32m'
-
-#######################################################
-# GENERAL ALIAS'S
-#######################################################
-
-# Alias's to modified commands
-alias cp='cp -i'
-alias mv='mv -i'
-alias rm='rm -iv'
-alias mkdir='mkdir -p'
-alias ps='ps auxf'
-alias ping='ping -c 10'
-alias less='less -R'
-alias cls='clear'
-alias apt-get='apt-get'
-alias multitail='multitail --no-repeat -c'
-alias freshclam='freshclam'
-alias vi='vim'
-alias vis='vim "+set si"'
-
-# Change directory aliases
-alias home='cd ~'
-alias cd..='cd ..'
-alias ..='cd ..'
-alias ...='cd ../..'
-alias ....='cd ../../..'
-alias .....='cd ../../../..'
-
-# cd into the old directory
-alias bd='cd "$OLDPWD"'
-
-# Remove a directory and all files
-alias rmd='/bin/rm  --recursive --force --verbose '
-
-# Alias's for multiple directory listing commands
-alias la='ls -Alh' # show hidden files
-alias ls='ls -aFh --color=always' # add colors and file type extensions
-alias lx='ls -lXBh' # sort by extension
-alias lk='ls -lSrh' # sort by size
-alias lc='ls -lcrh' # sort by change time
-alias lu='ls -lurh' # sort by access time
-alias lr='ls -lRh' # recursive ls
-alias lt='ls -ltrh' # sort by date
-alias lm='ls -alh |more' # pipe through 'more'
-alias lw='ls -xAh' # wide listing format
-alias ll='ls -Fls' # long listing format
-alias labc='ls -lap' #alphabetical sort
-alias lf="ls -l | egrep -v '^d'" # files only
-alias ldir="ls -l | egrep '^d'" # directories only
-
-# alias chmod commands
-alias mx='chmod a+x'
-alias 000='chmod -R 000'
-alias 644='chmod -R 644'
-alias 666='chmod -R 666'
-alias 755='chmod -R 755'
-alias 777='chmod -R 777'
-
-# Search command line history
-alias h="history | grep "
-
-# Search running processes
-alias p="ps aux | grep "
-alias topcpu="/bin/ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10"
-
-# Search files in the current folder
-alias f="find . | grep "
-
-# Count all files (recursively) in the current folder
-alias countfiles="for t in files links directories; do echo \`find . -type \${t:0:1} | wc -l\` \$t; done 2> /dev/null"
-
-# To see if a command is aliased, a file, or a built-in command
-alias checkcommand="type -t"
-
-# Show all logs in /var/log
-alias logs="sudo find /var/log -type f -exec file {} \; | grep 'text' | cut -d' ' -f1 | sed -e's/:$//g' | grep -v '[0-9]$' | xargs tail -f"
-
-# SHA1
-alias sha1='openssl sha1'
-
-#######################################################
-# SPECIAL FUNCTIONS
-#######################################################
-
-# Extracts any archive(s) (if unp isn't installed)
-extract () {
-	for archive in $*; do
-		if [ -f $archive ] ; then
-			case $archive in
-				*.tar.bz2)   tar xvjf $archive    ;;
-				*.tar.gz)    tar xvzf $archive    ;;
-				*.bz2)       bunzip2 $archive     ;;
-				*.rar)       rar x $archive       ;;
-				*.gz)        gunzip $archive      ;;
-				*.tar)       tar xvf $archive     ;;
-				*.tbz2)      tar xvjf $archive    ;;
-				*.tgz)       tar xvzf $archive    ;;
-				*.zip)       unzip $archive       ;;
-				*.Z)         uncompress $archive  ;;
-				*.7z)        7z x $archive        ;;
-				*)           echo "don't know how to extract '$archive'..." ;;
-			esac
-		else
-			echo "'$archive' is not a valid file!"
-		fi
-	done
-}
-
-# Searches for text in all files in the current folder
-ftext ()
-{
-	# -i case-insensitive
-	# -I ignore binary files
-	# -H causes filename to be printed
-	# -r recursive search
-	# -n causes line number to be printed
-	# optional: -F treat search term as a literal, not a regular expression
-	# optional: -l only print filenames and not the matching lines ex. grep -irl "$1" *
-	grep -iIHrn --color=always "$1" . | less -r
-}
-
-# Copy file with a progress bar
-cpp()
-{
-	set -e
-	strace -q -ewrite cp -- "${1}" "${2}" 2>&1 \
-	| awk '{
-	count += $NF
-	if (count % 10 == 0) {
-		percent = count / total_size * 100
-		printf "%3d%% [", percent
-		for (i=0;i<=percent;i++)
-			printf "="
-			printf ">"
-			for (i=percent;i<100;i++)
-				printf " "
-				printf "]\r"
-			}
-		}
-	END { print "" }' total_size=$(stat -c '%s' "${1}") count=0
-}
-
-# Copy and go to the directory
-cpg ()
-{
-	if [ -d "$2" ];then
-		cp $1 $2 && cd $2
-	else
-		cp $1 $2
-	fi
-}
-
-# Move and go to the directory
-mvg ()
-{
-	if [ -d "$2" ];then
-		mv $1 $2 && cd $2
-	else
-		mv $1 $2
-	fi
-}
-
-# Create and go to the directory
-mkdirg ()
-{
-	mkdir -p $1
-	cd $1
-}
-
-# Goes up a specified number of directories  (i.e. up 4)
-up ()
-{
-	local d=""
-	limit=$1
-	for ((i=1 ; i <= limit ; i++))
-		do
-			d=$d/..
-		done
-	d=$(echo $d | sed 's/^\///')
-	if [ -z "$d" ]; then
-		d=..
-	fi
-	cd $d
-}
-
-#Automatically do an ls after each cd
-# cd ()
-# {
-# 	if [ -n "$1" ]; then
-# 		builtin cd "$@" && ls
-# 	else
-# 		builtin cd ~ && ls
-# 	fi
-# }
-
-# Returns the last 2 fields of the working directory
-pwdtail ()
-{
-	pwd|awk -F/ '{nlast = NF -1;print $nlast"/"$NF}'
-}
-
-# Show the current version of the operating system
-ver ()
-{
-	local dtype
-	dtype=$(distribution)
-
-	if [ $dtype == "redhat" ]; then
-		if [ -s /etc/redhat-release ]; then
-			cat /etc/redhat-release && uname -a
-		else
-			cat /etc/issue && uname -a
-		fi
-	elif [ $dtype == "suse" ]; then
-		cat /etc/SuSE-release
-	elif [ $dtype == "debian" ]; then
-		lsb_release -a
-		# sudo cat /etc/issue && sudo cat /etc/issue.net && sudo cat /etc/lsb_release && sudo cat /etc/os-release # Linux Mint option 2
-	elif [ $dtype == "gentoo" ]; then
-		cat /etc/gentoo-release
-	elif [ $dtype == "mandriva" ]; then
-		cat /etc/mandriva-release
-	elif [ $dtype == "slackware" ]; then
-		cat /etc/slackware-version
-	else
-		if [ -s /etc/issue ]; then
-			cat /etc/issue
-		else
-			echo "Error: Unknown distribution"
-			exit 1
-		fi
-	fi
-}
-
-# For some reason, rot13 pops up everywhere
-rot13 () {
-	if [ $# -eq 0 ]; then
-		tr '[a-m][n-z][A-M][N-Z]' '[n-z][a-m][N-Z][A-M]'
-	else
-		echo $* | tr '[a-m][n-z][A-M][N-Z]' '[n-z][a-m][N-Z][A-M]'
-	fi
-}
-
-# Trim leading and trailing spaces (for scripts)
-trim()
-{
-	local var=$@
-	var="${var#"${var%%[![:space:]]*}"}"  # remove leading whitespace characters
-	var="${var%"${var##*[![:space:]]}"}"  # remove trailing whitespace characters
-	echo -n "$var"
-}
-
-#######################################################
-# Set the ultimate amazing command prompt
-#######################################################
-
-alias cpu="grep 'cpu ' /proc/stat | awk '{usage=(\$2+\$4)*100/(\$2+\$4+\$5)} END {print usage}' | awk '{printf(\"%.1f\n\", \$1)}'"
-function __setprompt
-{
-	local LAST_COMMAND=$? # Must come first!
-
-	# Define colors
-	local LIGHTGRAY="\033[0;37m"
-	local WHITE="\033[1;37m"
-	local BLACK="\033[0;30m"
-	local DARKGRAY="\033[1;30m"
-	local RED="\033[0;31m"
-	local LIGHTRED="\033[1;31m"
-	local GREEN="\033[0;32m"
-	local LIGHTGREEN="\033[1;32m"
-	local BROWN="\033[0;33m"
-	local YELLOW="\033[1;33m"
-	local BLUE="\033[0;34m"
-	local LIGHTBLUE="\033[1;34m"
-	local MAGENTA="\033[0;35m"
-	local LIGHTMAGENTA="\033[1;35m"
-	local CYAN="\033[0;36m"
-	local LIGHTCYAN="\033[1;36m"
-	local NOCOLOR="\033[0m"
-
-	# Show error exit code if there is one
-	if [[ $LAST_COMMAND != 0 ]]; then
-		# PS1="\[${RED}\](\[${LIGHTRED}\]ERROR\[${RED}\])-(\[${LIGHTRED}\]Exit Code \[${WHITE}\]${LAST_COMMAND}\[${RED}\])-(\[${LIGHTRED}\]"
-		PS1="\[${DARKGRAY}\](\[${LIGHTRED}\]ERROR\[${DARKGRAY}\])-(\[${RED}\]Exit Code \[${LIGHTRED}\]${LAST_COMMAND}\[${DARKGRAY}\])-(\[${RED}\]"
-		if [[ $LAST_COMMAND == 1 ]]; then
-			PS1+="General error"
-		elif [ $LAST_COMMAND == 2 ]; then
-			PS1+="Missing keyword, command, or permission problem"
-		elif [ $LAST_COMMAND == 126 ]; then
-			PS1+="Permission problem or command is not an executable"
-		elif [ $LAST_COMMAND == 127 ]; then
-			PS1+="Command not found"
-		elif [ $LAST_COMMAND == 128 ]; then
-			PS1+="Invalid argument to exit"
-		elif [ $LAST_COMMAND == 129 ]; then
-			PS1+="Fatal error signal 1"
-		elif [ $LAST_COMMAND == 130 ]; then
-			PS1+="Script terminated by Control-C"
-		elif [ $LAST_COMMAND == 131 ]; then
-			PS1+="Fatal error signal 3"
-		elif [ $LAST_COMMAND == 132 ]; then
-			PS1+="Fatal error signal 4"
-		elif [ $LAST_COMMAND == 133 ]; then
-			PS1+="Fatal error signal 5"
-		elif [ $LAST_COMMAND == 134 ]; then
-			PS1+="Fatal error signal 6"
-		elif [ $LAST_COMMAND == 135 ]; then
-			PS1+="Fatal error signal 7"
-		elif [ $LAST_COMMAND == 136 ]; then
-			PS1+="Fatal error signal 8"
-		elif [ $LAST_COMMAND == 137 ]; then
-			PS1+="Fatal error signal 9"
-		elif [ $LAST_COMMAND -gt 255 ]; then
-			PS1+="Exit status out of range"
-		else
-			PS1+="Unknown error code"
-		fi
-		PS1+="\[${DARKGRAY}\])\[${NOCOLOR}\]\n"
-	else
-		PS1=""
-	fi
-
-	# Date
-	PS1+="\[${DARKGRAY}\](\[${CYAN}\]\$(date +%a) $(date +%b-'%-m')" # Date
-	PS1+="${BLUE} $(date +'%-I':%M:%S%P)\[${DARKGRAY}\])-" # Time
-
-	# CPU
-	PS1+="(\[${MAGENTA}\]CPU $(cpu)%"
-
-	# Jobs
-	PS1+="\[${DARKGRAY}\]:\[${MAGENTA}\]\j"
-
-	# Network Connections (for a server - comment out for non-server)
-	PS1+="\[${DARKGRAY}\]:\[${MAGENTA}\]Net $(awk 'END {print NR}' /proc/net/tcp)"
-
-	PS1+="\[${DARKGRAY}\])-"
-
-	# User and server
-	local SSH_IP=`echo $SSH_CLIENT | awk '{ print $1 }'`
-	local SSH2_IP=`echo $SSH2_CLIENT | awk '{ print $1 }'`
-	if [ $SSH2_IP ] || [ $SSH_IP ] ; then
-		PS1+="(\[${RED}\]\u@\h"
-	else
-		PS1+="(\[${RED}\]\u"
-	fi
-
-	# Current directory
-	PS1+="\[${DARKGRAY}\]:\[${BROWN}\]\w\[${DARKGRAY}\])-"
-
-	# Total size of files in current directory
-	PS1+="(\[${GREEN}\]$(/bin/ls -lah | /bin/grep -m 1 total | /bin/sed 's/total //')\[${DARKGRAY}\]:"
-
-	# Number of files
-	PS1+="\[${GREEN}\]\$(/bin/ls -A -1 | /usr/bin/wc -l)\[${DARKGRAY}\])"
-
-	# Skip to the next line
-	PS1+="\n"
-
-  # singularity?
-  if [ -e /environment ] ; then
-      PS1+="singularity"
-  fi
-
-	if [[ $EUID -ne 0 ]]; then
-		PS1+="\[${GREEN}\]>\[${NOCOLOR}\] " # Normal user
-	else
-		PS1+="\[${RED}\]>\[${NOCOLOR}\] " # Root user
-	fi
-
-	# PS2 is used to continue a command using the \ character
-	PS2="\[${DARKGRAY}\]>\[${NOCOLOR}\] "
-
-	# PS3 is used to enter a number choice in a script
-	PS3='Please enter a number from above list: '
-
-	# PS4 is used for tracing a script in debug mode
-	PS4='\[${DARKGRAY}\]+\[${NOCOLOR}\] '
-}
-PROMPT_COMMAND='__setprompt'

containers/debian/Dockerfile

-#syntax=docker/dockerfile:1.2
+#syntax=docker/dockerfile:1.8
+#check=error=true
+ARG BASE_IMAGE="amd64/debian:stable-slim"
+ARG BUILD_IMAGE="debian_stable_base"
 
-# Minimal container based on Debian Testing for up-to-date packages. 
-# Very lightweight container with a minimal build environment
+# Minimal container based on Debian base systems for up-to-date packages. 
+FROM ${BASE_IMAGE}
+ARG TARGETPLATFORM
 
-FROM  amd64/debian:testing-20211220-slim
-LABEL maintainer="Sylvester Joosten <sjoosten@anl.gov>" \
-      name="debian_base" \
-      march="amd64"
+# Open Container Initiative labels (no heredoc support)
+LABEL \
+org.opencontainers.image.vendor="Electron-Ion Collider" \
+org.opencontainers.image.authors="Electron-Ion Collider Software Working Groups <eic-software-l-owner@lists.bnl.gov>" \
+org.opencontainers.image.url="https://github.com/eic/containers" \
+org.opencontainers.image.source="https://github.com/eic/containers" \
+org.opencontainers.image.documentation="https://eic.github.io" \
+org.opencontainers.image.license="GPL-3.0-or-later"
+LABEL org.opencontainers.image.title="Electron-Ion Collider base image ($TARGETPLATFORM)"
 
 COPY bashrc /root/.bashrc
 
+## With heredocs for multi-line scripts, we want to fail on error and the print failing line.
+## Ref: https://docs.docker.com/engine/reference/builder/#example-running-a-multi-line-script
+SHELL ["bash", "-ex", "-c"]
+
 ENV CLICOLOR_FORCE=1                                                    \
     LANGUAGE=en_US.UTF-8                                                \
     LANG=en_US.UTF-8                                                    \
@@ -17,27 +30,21 @@ ENV CLICOLOR_FORCE=1                                                    \
 
 ## Install additional packages. Remove the auto-cleanup functionality
 ## for docker, as we're using the new buildkit cache instead.
-## We also install gitlab-runner, from the buster package (as bullseye is not available atm)
-## TODO: libyaml-cpp-dev is a dependency for afterburner. We can probably remove
-##       this once afterburner is added to spack
-RUN --mount=type=cache,target=/var/cache/apt                            \
-    rm -f /etc/apt/apt.conf.d/docker-clean                              \
- && ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime          \
- && echo "US/Eastern" > /etc/timezone                                   \
- && apt-get -yqq update                                                 \
- && apt-get -yqq upgrade                                                \
- && apt-get -yqq install --no-install-recommends                        \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked <<EOF
+rm -f /etc/apt/apt.conf.d/docker-clean
+ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime
+echo "US/Eastern" > /etc/timezone
+apt-get -yqq update
+apt-get -yqq install --no-install-recommends                            \
         bc                                                              \
+        bzip2                                                           \
         ca-certificates                                                 \
-        clang-format                                                    \
-        clang-tidy                                                      \
+        ccache                                                          \
         curl                                                            \
         file                                                            \
-        build-essential                                                 \
-        g++-11                                                          \
-        gcc-11                                                          \
+        gawk                                                            \
         gdb                                                             \
-        gfortran-11                                                     \
         ghostscript                                                     \
         git                                                             \
         gnupg2                                                          \
@@ -46,35 +53,183 @@ RUN --mount=type=cache,target=/var/cache/apt                            \
         iputils-ping                                                    \
         iputils-tracepath                                               \
         less                                                            \
+        libc6-dbg                                                       \
         libcbor-xs-perl                                                 \
+        libegl-dev                                                      \
         libjson-xs-perl                                                 \
-        libyaml-cpp-dev                                                 \
+        libgl-dev                                                       \
+        libglew-dev                                                     \
+        libglx-dev                                                      \
+        libopengl-dev                                                   \
         locales                                                         \
         lua-posix                                                       \
         make                                                            \
+        moreutils                                                       \
         nano                                                            \
         openssh-client                                                  \
         parallel                                                        \
+        patch                                                           \
         poppler-utils                                                   \
         time                                                            \
         unzip                                                           \
-        valgrind                                                        \
         vim-nox                                                         \
-        wget                                                            \
- && localedef -i en_US -f UTF-8 en_US.UTF-8                             \
- && update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 100  \
- && update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-11 100  \
- && update-alternatives --install /usr/bin/gfortran gfortran            \
-                                  /usr/bin/gfortran-11 100              \
- && gcc --version                                                       \
- && curl -L                                                             \
-    "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" \
-    | bash                                                              \
- && sed -i "s/bookworm/buster/"                                         \
-           /etc/apt/sources.list.d/runner_gitlab-runner.list            \
- && apt-get -yqq update                                                 \
- && apt-get -yqq install --no-install-recommends                        \
-        gitlab-runner                                                   \
- && apt-get -yqq autoremove                                             \
- && rm -rf /var/lib/apt/lists/*                                         
+        wget
+apt-get -yqq autoremove
+localedef -i en_US -f UTF-8 en_US.UTF-8
+EOF
+
+# Install updated compilers, with support for multiple base images
+## Ubuntu: latest gcc from toolchain ppa, latest stable clang
+## Debian: default gcc with distribution, latest stable clang
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked <<EOF
+. /etc/os-release
+mkdir -p /etc/apt/source.list.d
+# GCC and CLANG version and repository
+case ${ID} in
+  debian)
+    case ${VERSION_CODENAME} in
+      bookworm) GCC="-12" ; CLANG="-18" ;;
+      trixie) GCC="-14" ; CLANG="-19" ;;
+      *) echo "Unsupported VERSION_CODENAME=${VERSION_CODENAME}" ; exit 1 ;;
+    esac ;;
+  ubuntu)
+    echo "deb http://ppa.launchpad.net/ubuntu-toolchain-r/ppa/ubuntu/${VERSION_CODENAME} main" > /etc/apt/source.list.d/ubuntu-toolchain.list
+    case ${VERSION_CODENAME} in
+      focal) GCC="-10" ; CLANG="-16" ;;
+      jammy) GCC="-12" ; CLANG="-16" ;;
+      noble) GCC="-13" ; CLANG="-17" ;;
+      *) echo "Unsupported VERSION_CODENAME=${VERSION_CODENAME}" ; exit 1 ;;
+    esac ;;
+  *) echo "Unsupported ID=${ID}" ; exit 1 ;;
+esac
+# Clang repository
+curl -s https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+if [ ${VERSION_CODENAME} = trixie ] ; then
+  echo "deb http://apt.llvm.org/unstable llvm-toolchain${CLANG} main" > /etc/apt/sources.list.d/llvm.list
+else
+  echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME}${CLANG} main" > /etc/apt/sources.list.d/llvm.list
+fi
+# Install packages
+apt-get -yqq update
+apt-get -yqq install cpp${GCC} gcc${GCC} g++${GCC} gfortran${GCC}
+apt-get -yqq install clang${CLANG} clang-tidy${CLANG} clang-format${CLANG} libclang${CLANG}-dev
+apt-get -yqq autoremove
+# Remove symlinks loop in nvidia/cuda:12.5.1-devel-ubuntu24.04
+rm -f /usr/bin/cpp /etc/alternatives/cpp
+# Ensure alternatives without version tags
+update-alternatives --install /usr/bin/cpp cpp /usr/bin/cpp${GCC} 100
+update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc${GCC} 100
+update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++${GCC} 100
+update-alternatives --install /usr/bin/gfortran gfortran /usr/bin/gfortran${GCC} 100
+update-alternatives --install /usr/bin/clang clang /usr/bin/clang${CLANG} 100
+update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++${CLANG} 100
+update-alternatives --install /usr/bin/clang-format clang-format /usr/bin/clang-format${CLANG} 100
+update-alternatives --install /usr/bin/clang-format-diff clang-format-diff /usr/bin/clang-format-diff${CLANG} 100
+update-alternatives --install /usr/bin/clang-tidy-diff clang-tidy-diff /usr/bin/clang-tidy-diff${CLANG}.py 100
+update-alternatives --install /usr/bin/run-clang-tidy run-clang-tidy /usr/bin/run-clang-tidy${CLANG}.py 100
+update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config${CLANG} 100
+# Default to gcc
+update-alternatives --install /usr/bin/cc  cc  /usr/bin/gcc 100
+update-alternatives --install /usr/bin/c++ c++ /usr/bin/g++ 100
+# Check versions
+gcc --version
+clang --version
+EOF
+
+## Install some extra spack dependencies
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=apt-${TARGETPLATFORM} \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked,id=apt-lists-${TARGETPLATFORM} <<EOF
+rm -f /etc/apt/apt.conf.d/docker-clean
+apt-get -yqq update
+apt-get -yqq install --no-install-recommends                            \
+        jq                                                              \
+        python3                                                         \
+        python3-dev                                                     \
+        python3-boto3                                                   \
+        python-is-python3
+EOF
+
+## Setup spack
+ENV SPACK_ROOT=/opt/spack
+ARG SPACK_ORGREPO="spack/spack"
+ARG SPACK_VERSION="releases/latest"
+ENV SPACK_PYTHON=/usr/bin/python3
+ARG SPACK_CHERRYPICKS=""
+ARG SPACK_CHERRYPICKS_FILES=""
+ADD https://api.github.com/repos/${SPACK_ORGREPO}/commits/${SPACK_VERSION} /tmp/spack.json
+RUN <<EOF
+git config --global user.email "gitlab@eicweb.phy.anl.gov"
+git config --global user.name "EIC Container Build Service"
+git config --global advice.detachedHead false
+git config --global gc.autoDetach false
+git config --global merge.directoryRenames true
+git clone --filter=tree:0 https://github.com/${SPACK_ORGREPO}.git ${SPACK_ROOT}
+git -C ${SPACK_ROOT} remote add packages https://github.com/${SPACK_ORGREPO}-packages.git
+git -C ${SPACK_ROOT} fetch packages
+git -C ${SPACK_ROOT} checkout ${SPACK_VERSION}
+if [ -n "${SPACK_CHERRYPICKS}" ] ; then
+  SPACK_CHERRYPICKS=$(git -C ${SPACK_ROOT} rev-list --topo-order ${SPACK_CHERRYPICKS} | grep -m $(echo ${SPACK_CHERRYPICKS} | wc -w)  "${SPACK_CHERRYPICKS}" | tac)
+  eval "declare -A SPACK_CHERRYPICKS_FILES_ARRAY=(${SPACK_CHERRYPICKS_FILES})"
+  for hash in ${SPACK_CHERRYPICKS} ; do
+    if [ -n "${SPACK_CHERRYPICKS_FILES_ARRAY[${hash}]+found}" ] ; then
+      git -C ${SPACK_ROOT} show ${hash} -- ${SPACK_CHERRYPICKS_FILES_ARRAY[${hash}]//,/ } | patch -p1 -d ${SPACK_ROOT}
+      git -C ${SPACK_ROOT} commit --all --message "$(git -C ${SPACK_ROOT} show --no-patch --pretty=format:%s ${hash})"
+    else
+      git -C ${SPACK_ROOT} cherry-pick ${hash}
+    fi
+  done
+fi
+git -C $SPACK_ROOT gc --prune=all --aggressive
+sed -i 's/timeout=60/timeout=None/' $SPACK_ROOT/lib/spack/spack/stage.py
+ln -s $SPACK_ROOT/share/spack/docker/entrypoint.bash /usr/bin/docker-shell
+ln -s $SPACK_ROOT/share/spack/docker/entrypoint.bash /usr/bin/interactive-shell
+ln -s $SPACK_ROOT/share/spack/docker/entrypoint.bash /usr/bin/spack-env
+EOF
+
+## Use spack entrypoint. NOTE: Requires `set -ex` in all multi-line scripts!
+SHELL ["docker-shell"]
+
+## Setup build configuration
+ARG jobs=1
+RUN <<EOF
+set -e
+declare -A target=(["linux/amd64"]="x86_64_v2" ["linux/arm64"]="aarch64")
+target=${target[${TARGETPLATFORM}]}
+spack config --scope site add "packages:all:require:[target=${target}]"
+spack config --scope site add "packages:all:target:[${target}]"
+spack config blame packages
+spack config --scope user add "config:suppress_gpg_warnings:true"
+spack config --scope user add "config:build_jobs:${jobs}"
+spack config --scope user add "config:db_lock_timeout:${jobs}00"
+spack config --scope user add "config:source_cache:/var/cache/spack"
+spack config --scope user add "config:install_tree:root:/opt/software"
+spack config --scope user add "config:ccache:true"
+spack config blame config
+spack compiler find --scope site
+spack config blame compilers
+EOF
+
+## Setup buildcache mirrors
+## - this always adds the read-only mirror to the container
+## - the write-enabled mirror is provided later as a secret mount
+RUN --mount=type=cache,target=/var/cache/spack <<EOF
+set -e
+spack mirror add --scope site --signed spack-${SPACK_VERSION} https://binaries.spack.io/${SPACK_VERSION}
+spack mirror add --scope site --unsigned ghcr-${SPACK_VERSION} oci://ghcr.io/eic/spack-${SPACK_VERSION}
+spack mirror list
+EOF
+
+## Setup key4hep-spack
+ENV KEY4HEPSPACK_ROOT=${SPACK_ROOT}/var/spack/repos/key4hep-spack
+ARG KEY4HEPSPACK_ORGREPO="key4hep/key4hep-spack"
+ARG KEY4HEPSPACK_VERSION="main"
+ADD https://github.com/${KEY4HEPSPACK_ORGREPO}.git#${KEY4HEPSPACK_VERSION} ${KEY4HEPSPACK_ROOT}
+RUN spack repo add --scope site "${KEY4HEPSPACK_ROOT}"
 
+## Setup eic-spack
+ENV EICSPACK_ROOT=${SPACK_ROOT}/var/spack/repos/eic-spack
+ARG EICSPACK_ORGREPO="eic/eic-spack"
+ARG EICSPACK_VERSION="develop"
+ADD https://github.com/${EICSPACK_ORGREPO}.git#${EICSPACK_VERSION} ${EICSPACK_ROOT}
+RUN spack repo add --scope site "${EICSPACK_ROOT}"

containers/debian/README.md

+To build the container in this directory:
+
+```
+docker buildx build -f Dockerfile .
+```

containers/debian/bashrc

@@ -394,7 +394,7 @@ function __setprompt
 	fi
 
 	# Date
-	PS1+="\[${DARKGRAY}\](\[${CYAN}\]\$(date +%a) $(date +%b-'%-m')" # Date
+	PS1+="\[${DARKGRAY}\](\[${CYAN}\]\$(date +%a) $(date +%b-'%-d')" # Date
 	PS1+="${BLUE} $(date +'%-I':%M:%S%P)\[${DARKGRAY}\])-" # Time
 
 	# CPU

containers/eic/Dockerfile

+#syntax=docker/dockerfile:1.10
+#check=error=true
+ARG DOCKER_REGISTRY="eicweb/"
+ARG BUILDER_IMAGE="debian_stable_base"
+ARG RUNTIME_IMAGE="debian_stable_base"
+ARG INTERNAL_TAG="master"
+
+##
+## This docker build follows two tracks, in order to ensure that we build all packages
+## in a builder image, but install them in a runtime image, while at the same time
+## avoiding a expensive filesystem copy operation at the end that breaks layering.
+##
+## The build is split in an infrequently-changing default environment, upon which
+## an environment with custom versions (e.g. individual commits) is layered. The
+## custom environment will change frequently but layers will be smaller, allowing
+## for easier deployment with smaller delta layers.
+##
+## The separation in a builder and runtime image is particularly relevant to end up with
+## lightweight images for expensive build dependencies, such as for example CUDA.
+##
+## builder track                         runtime track
+## ----------------------------------------------------------------------
+## builder_image                         runtime_image
+## builder_concretization_default   
+## builder_installation_default     ->   runtime_concretization_default  (copy spack.lock)
+##                                 \->   runtime_installation_default    (from buildcache)
+## builder_concretization_custom
+## builder_installation_custom      ->   runtime_concretization_custom   (copy spack.lock)
+##                                 \->   runtime_installation_custom     (from buildcache)
+##
+
+
+## ========================================================================================
+## builder_concretization_default
+## - builder base with concretization of default versions
+## ========================================================================================
+FROM ${DOCKER_REGISTRY}${BUILDER_IMAGE}:${INTERNAL_TAG} AS builder_concretization_default
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build concretization image (default configuration, $TARGETPLATFORM)"
+
+## Copy our default environment
+COPY --from=spack-environment . /opt/spack-environment/
+ARG ENV=xl
+ENV SPACK_ENV=/opt/spack-environment/${ENV}
+
+# Concretization (default environment)
+RUN <<EOF
+echo -e "\n  view: false" >> ${SPACK_ENV}/spack.yaml
+spack env activate --dir ${SPACK_ENV}
+spack external find --not-buildable --scope env:${SPACK_ENV} --path /usr/local/cuda/bin cuda
+spack external find --not-buildable --scope env:${SPACK_ENV} llvm
+spack concretize --force
+EOF
+
+
+## ========================================================================================
+## builder_installation_default
+## - builder base with installation of default versions
+## ========================================================================================
+FROM builder_concretization_default AS builder_installation_default
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build installation image (default configuration, $TARGETPLATFORM)"
+
+# Installation (default environment)
+RUN --mount=type=cache,target=/ccache,id=ccache-${TARGETPLATFORM}              \
+    --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    --mount=type=secret,id=CI_REGISTRY_USER,env=CI_REGISTRY_USER        \
+    --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
+    --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
+    --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    <<EOF
+set -e
+export CCACHE_DIR=/ccache
+mkdir -p /var/cache/spack/blobs/sha256/
+find /var/cache/spack/blobs/sha256/ -ignore_readdir_race -atime +7 -delete
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV}
+ccache --show-stats
+ccache --zero-stats
+EOF
+
+
+## ========================================================================================
+## runtime_concretization_default
+## - runtime base with concretization of default versions (taken from equivalent builder)
+## ========================================================================================
+FROM ${DOCKER_REGISTRY}${RUNTIME_IMAGE}:${INTERNAL_TAG} AS runtime_concretization_default
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime concretization image (default configuration, $TARGETPLATFORM)"
+
+## Copy our default environment
+COPY --from=spack-environment . /opt/spack-environment/
+ARG ENV=xl
+ENV SPACK_ENV=/opt/spack-environment/${ENV}
+
+RUN echo -e "\n  view: false" >> ${SPACK_ENV}/spack.yaml
+
+COPY --from=builder_installation_default \
+  /opt/spack-environment/${ENV}/spack.* \
+  /opt/spack-environment/${ENV}/
+
+
+## ========================================================================================
+## runtime_installation_default
+## - runtime base with installation of default versions (buildcache populated by builder)
+## ========================================================================================
+FROM runtime_concretization_default AS runtime_installation_default
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime installation image (default configuration, $TARGETPLATFORM)"
+
+# Installation (default environment, from buildcache)
+RUN --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    --mount=type=secret,id=CI_REGISTRY_USER,env=CI_REGISTRY_USER        \
+    --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
+    --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
+    --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    <<EOF
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV} SPACK_INSTALL_FLAGS="--use-buildcache only"
+spack gc --yes-to-all
+EOF
+
+
+## ========================================================================================
+## builder_concretization_custom
+## - builder base with concretization of custom versions
+## ========================================================================================
+FROM builder_installation_default AS builder_concretization_custom
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build concretization image (custom configuration, $TARGETPLATFORM)"
+
+## 2. Setup our environment with custom versions (on top of cached layer)
+## Note: these default versions are just the very first commit.
+ARG EDM4EIC_VERSION="8aeb507f93a93257c99985efbce0ec1371e0b331"
+ARG EICRECON_VERSION="28108da4a1e8919a05dfdb5f11e114800a2cbe96"
+ARG EPIC_VERSION="c1827f05430b2051df8a0b421db1cbab87165e0b"
+ARG JUGGLER_VERSION="df87bf1f8643afa8e80bece9d36d6dc26dfe8132"
+ADD https://api.github.com/repos/eic/edm4eic/commits/${EDM4EIC_VERSION} /tmp/edm4eic.json
+ADD https://api.github.com/repos/eic/eicrecon/commits/${EICRECON_VERSION} /tmp/eicrecon.json
+ADD https://api.github.com/repos/eic/epic/commits/${EPIC_VERSION} /tmp/epic.json
+ADD https://api.github.com/repos/eic/juggler/commits/${JUGGLER_VERSION} /tmp/juggler.json
+
+# Concretization (custom environment)
+RUN <<EOF
+spack env activate --dir ${SPACK_ENV}
+if [ "${EDM4EIC_VERSION}" != "8aeb507f93a93257c99985efbce0ec1371e0b331" ] ; then
+  export EDM4EIC_VERSION=$(jq -r .sha /tmp/edm4eic.json)
+  sed -i "/# EDM4EIC_VERSION$/ s/@[^' ]*/@git.${EDM4EIC_VERSION}=main/" /opt/spack-environment/packages.yaml
+  spack deconcretize -y --all edm4eic
+fi
+if [ "${EICRECON_VERSION}" != "28108da4a1e8919a05dfdb5f11e114800a2cbe96" ] ; then
+  export EICRECON_VERSION=$(jq -r .sha /tmp/eicrecon.json)
+  sed -i "/# EICRECON_VERSION$/ s/@[^' ]*/@git.${EICRECON_VERSION}=main/" /opt/spack-environment/packages.yaml
+  spack deconcretize -y --all eicrecon
+fi
+if [ "${EPIC_VERSION}" != "c1827f05430b2051df8a0b421db1cbab87165e0b" ] ; then
+  export EPIC_VERSION=$(jq -r .sha /tmp/epic.json)
+  sed -i "/# EPIC_VERSION$/ s/epic\s/epic@git.${EPIC_VERSION}=main /" /opt/spack-environment/${ENV}/spack.yaml
+  sed -i "/# EPIC_VERSION$/ s/epic@main\s/epic@git.${EPIC_VERSION}=main /" /opt/spack-environment/${ENV}/spack.yaml
+  spack deconcretize -y --all epic
+fi
+if [ "${JUGGLER_VERSION}" != "df87bf1f8643afa8e80bece9d36d6dc26dfe8132" ] ; then
+  export JUGGLER_VERSION=$(jq -r .sha /tmp/juggler.json)
+  sed -i "/# JUGGLER_VERSION$/ s/@[^' ]*/@git.${JUGGLER_VERSION}=main/" /opt/spack-environment/packages.yaml
+  spack deconcretize -y --all juggler
+fi
+spack concretize --force
+EOF
+
+
+## ========================================================================================
+## builder_installation_custom
+## - builder base with installation of custom versions
+## ========================================================================================
+FROM builder_concretization_custom AS builder_installation_custom
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build installation image (custom configuration, $TARGETPLATFORM)"
+
+# Installation (custom environment)
+RUN --mount=type=cache,target=/ccache,id=ccache-${TARGETPLATFORM}              \
+    --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    --mount=type=secret,id=CI_REGISTRY_USER,env=CI_REGISTRY_USER        \
+    --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
+    --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
+    --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    <<EOF
+set -e
+export CCACHE_DIR=/ccache
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV}
+spack gc --yes-to-all
+spack find --long --no-groups \
+| sed -e '1,/Installed packages/d;s/\([^@]*\).*/\1/g' \
+| uniq -D -f1 | grep -v -w -e "\(epic\|py-pip\|py-cython\)" \
+| tee /tmp/duplicates.txt
+if [ -s /tmp/duplicates.txt ] ; then
+  echo "Duplicate packages found"
+  cat /tmp/duplicates.txt | while read hash spec ; do spack spec --long /${hash} ; done
+  exit 1
+fi
+ccache --show-stats
+ccache --zero-stats
+EOF
+
+
+## ========================================================================================
+## runtime_concretization_custom
+## - runtime base with concretization of custom versions (taken from equivalent builder)
+## ========================================================================================
+FROM runtime_installation_default AS runtime_concretization_custom
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime concretization image (custom configuration, $TARGETPLATFORM)"
+
+COPY --from=builder_installation_custom \
+  /opt/spack-environment/${ENV}/spack.* \
+  /opt/spack-environment/${ENV}/
+COPY --from=builder_installation_custom \
+  /opt/spack-environment/packages.yaml \
+  /opt/spack-environment/
+
+
+## ========================================================================================
+## runtime_installation_custom
+## - runtime base with installation of custom versions (buildcache populated by builder)
+## ========================================================================================
+FROM runtime_concretization_custom AS runtime_installation_custom
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime installation image (custom configuration, $TARGETPLATFORM)"
+
+# Installation (default environment, from buildcache)
+RUN --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    <<EOF
+set -e
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV} SPACK_INSTALL_FLAGS="--use-buildcache only"
+spack gc --yes-to-all
+spack find --long --no-groups \
+| sed -e '1,/Installed packages/d;s/\([^@]*\).*/\1/g' \
+| uniq -D -f1 | grep -v -w -e "\(epic\|py-pip\|py-cython\)" \
+| tee /tmp/duplicates.txt
+if [ -s /tmp/duplicates.txt ] ; then
+  echo "Duplicate packages found"
+  cat /tmp/duplicates.txt | while read hash spec ; do spack spec --long /${hash} ; done
+  exit 1
+fi
+EOF
+
+
+## ========================================================================================
+## final image, based on runtime_installation_custom
+## ========================================================================================
+FROM runtime_installation_custom
+ARG TARGETPLATFORM
+
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime installation image (custom configuration, $TARGETPLATFORM)"
+
+## Create views at /opt/local and /opt/detector
+RUN <<EOF
+set -e
+rm -rf /opt/local
+sed -i -e '/view: false/d' ${SPACK_ENV}/spack.yaml
+cat /opt/spack-environment/view.yaml >> ${SPACK_ENV}/spack.yaml
+spack -e ${SPACK_ENV} env view regenerate /opt/local
+spack -e ${SPACK_ENV} env view regenerate /opt/detector
+# ensure /opt/local is the view, not a symlink
+rm -rf /opt/local /opt/detector
+LOCAL_PREFIX_PATH=$(realpath $(ls /opt/._local/ | tail -n1))
+mv /opt/._local/${LOCAL_PREFIX_PATH} /opt/local
+ln -s /opt/local /opt/._local/${LOCAL_PREFIX_PATH}
+DETECTOR_PREFIX_PATH=$(realpath $(ls /opt/._detector/ | tail -n1))
+mv /opt/._detector/${DETECTOR_PREFIX_PATH} /opt/detector
+ln -s /opt/detector /opt/._detector/${DETECTOR_PREFIX_PATH}
+EOF
+
+## Place cvmfs catalogs
+RUN <<EOF
+set -e
+touch ${SPACK_ROOT}/.cvmfscatalog
+touch /opt/software/.cvmfscatalog
+find /opt/software -mindepth 2 -maxdepth 3 -type d -exec touch {}/.cvmfscatalog \;
+touch /opt/local/.cvmfscatalog
+EOF
+
+## Store environment
+RUN <<EOF
+set -e
+spack env activate --sh --dir ${SPACK_ENV} > /etc/profile.d/z10_spack_environment.sh
+EOF
+
+## Fixup /opt/detector/epic-git.fcf90937193c983c0af2acf1251e01f2e2c3a259_main
+RUN <<EOF
+set -e
+shopt -s nullglob
+cd /opt/detector
+for detector in epic-git.*_* ; do
+  ln -s ${detector} epic-${detector/*_/}
+done
+EOF
+
+## Fill jug_info
+RUN <<EOF
+set -e
+spack debug report | sed "s/^/ - /" | sed "s/\* \*\*//" | sed "s/\*\*//" >> /etc/jug_info
+spack find --no-groups --long --variants | sed "s/^/ - /" >> /etc/jug_info
+spack graph --dot > /opt/spack-environment/env.dot
+EOF
+
+## Copy custom content
+COPY eic-shell /opt/local/bin/eic-shell
+COPY eic-info /opt/local/bin/eic-info
+COPY entrypoint.sh /opt/local/sbin/entrypoint.sh
+COPY eic-env.sh /etc/eic-env.sh
+COPY profile.d/* /etc/profile.d
+COPY singularity.d /.singularity.d
+
+## set ROOT TFile forward compatibility
+RUN sed --in-place --follow-symlinks 's/# \(TFile.v630forwardCompatibility:\) no/\1 yes/' /opt/local/etc/root/system.rootrc
+
+## Setup ld.so.conf with what could go in LD_LIBRARY_PATH (but lower priority)
+## Ref: https://man7.org/linux/man-pages/man8/ld.so.8.html
+COPY <<EOF /etc/ld.so.conf.d/eic-shell.conf
+/opt/local/lib/root
+EOF
+RUN ldconfig
+
+## set the local spack configuration
+ENV SPACK_DISABLE_LOCAL_CONFIG="true"
+RUN <<EOF
+set -e
+spack config --scope site add "config:install_tree:root:~/spack"
+spack config --scope site add "config:source_cache:~/.spack/cache"
+spack config --scope site add "config:binary_index_root:~/.spack"
+spack config --scope site add "config:environments_root:~/.spack/env"
+spack config --scope site add "config:suppress_gpg_warnings:true"
+spack config blame config
+spack config --scope site add "upstreams:eic-shell:install_tree:/opt/software"
+spack config blame upstreams
+EOF
+
+## Install benchmarks into the container
+ARG BENCHMARK_COM_VERSION="master"
+ARG BENCHMARK_DET_VERSION="master"
+ARG BENCHMARK_REC_VERSION="master"
+ARG BENCHMARK_PHY_VERSION="master"
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/common_bench.git#${BENCHMARK_COM_VERSION} /opt/benchmarks/common_bench
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/detector_benchmarks.git#${BENCHMARK_DET_VERSION} /opt/benchmarks/detector_benchmarks
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/reconstruction_benchmarks.git#${BENCHMARK_REC_VERSION} /opt/benchmarks/reconstruction_benchmarks
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/physics_benchmarks.git#${BENCHMARK_PHY_VERSION} /opt/benchmarks/physics_benchmarks
+RUN <<EOF
+ln -sf ../common_bench /opt/benchmarks/detector_benchmarks/.local
+ln -sf ../common_bench /opt/benchmarks/reconstruction_benchmarks/.local
+ln -sf ../common_bench /opt/benchmarks/physics_benchmarks/.local
+EOF
+
+## Install campaigns into the container
+ARG CAMPAIGNS_HEPMC3_VERSION="main"
+ARG CAMPAIGNS_CONDOR_VERSION="main"
+ARG CAMPAIGNS_SLURM_VERSION="main"
+ADD https://github.com/eic/simulation_campaign_hepmc3.git#${CAMPAIGNS_HEPMC3_VERSION} /opt/campaigns/hepmc3
+ADD https://github.com/eic/job_submission_condor.git#${CAMPAIGNS_CONDOR_VERSION} /opt/campaigns/condor
+ADD https://github.com/eic/job_submission_slurm.git#${CAMPAIGNS_SLURM_VERSION} /opt/campaigns/slurm
+
+## make sure we have the entrypoints setup correctly
+ENTRYPOINT ["/opt/local/sbin/entrypoint.sh"]
+CMD ["bash", "--rcfile", "/etc/profile", "-l"]
+USER 0
+WORKDIR /
+SHELL ["/opt/local/bin/eic-shell"]
+
+## rucio config (unprivileged read-only account)
+COPY <<EOF /opt/rucio/etc/rucio.cfg
+[client]
+rucio_host = https://rucio-server.jlab.org:443
+auth_host = https://rucio-server.jlab.org:443
+auth_type = userpass
+username = eicread
+password = eicread
+
+[policy]
+package = eic_rucio_policy_package
+extract_scope = eic
+lfn2pfn_algorithm_default = eic
+EOF
+
+## eic-news
+COPY --chmod=0755 eic-news /opt/local/bin/eic-news
+
+## set the container version
+ARG EIC_CONTAINER_VERSION=1
+RUN echo -e "\n - jug_dev: ${EIC_CONTAINER_VERSION}" >> /etc/jug_info
+
+## Hotfix for misbehaving OSG nodes
+RUN mkdir /hadoop /localscratch

containers/eic/README.md

+To build the container in this directory:
+
+```
+docker buildx build -f Dockerfile --build-context spack-environment=../../spack-environment .
+```

containers/jug/eic-env.sh → containers/eic/eic-env.sh

@@ -27,7 +27,7 @@ if [ -f /etc/jug_info ]; then
     esac
     ps1_preamble="${container}${sigil}> "
     export PS1_SIGIL=${sigil}
-    unset ${sigil}
+    unset sigil
   fi
   unset version
   unset container
@@ -36,6 +36,21 @@ export PS1=${ps1_preamble}'\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\
 export LS_COLORS='rs=0:di=01;34:ln=01;36:mh=00:pi=40;33'
 unset ps1_preamble
 
+## unset CURL_CA_BUNDLE and SSL_CERT_FILE if not accessible
+## inside container: this addresses certain HPC systems where
+## CURL_CA_BUNDLE and SSL_CERT_FILE are customized to point
+## to paths that do not exist inside this container
+if [ ! -r ${CURL_CA_BUNDLE:-/} ]; then
+  unset CURL_CA_BUNDLE
+fi
+if [ ! -r ${SSL_CERT_FILE:-/} ]; then
+  unset SSL_CERT_FILE
+fi
+
+## set CLING_STANDARD_PCH and CPPYY_API_PATH to `none` for cppyy
+export CLING_STANDARD_PCH='none'
+export CPPYY_API_PATH='none'
+
 ## redefine ls and less as functions, as this is something we
 ## can import into our plain bash --norc --noprofile session
 ## (aliases cannot be transferred to a child shell)

containers/eic/eic-news

+#!/bin/bash
+
+news=$HOME/.eic-news
+hints=$HOME/.eic-hints
+
+# run only if stdin and sterr, when not hushlogin, and when opt-in
+if [[ -t 0 && -t 2 && ! -f $HOME/.hushlogin && -f $news ]] ; then
+  # ensure hints file exists (atime or mtime not checked)
+  touch $hints
+
+  # check if interactive shell (sourced) or else (eic-news explicitly invoked)
+  if [[ $- == *i* ]] ; then
+    # when sourced: print news at most once an hour
+    if [[ -z $(find $news -atime +1) ]] ; then
+      cat $news
+      echo
+      cat $hints | shuf | head -n1
+      echo
+      echo 'More news with `eic-news`; you can disable `eic-news` by creating `$HOME/.hushlogin`'
+    fi
+  else
+    # when invoked: print always
+    cat $news
+    echo
+    cat $hints | shuf | head -n1
+  fi
+
+  # update news at most once a day
+  if [[ -z $(find $news -mtime +24) ]] ; then
+    (&>/dev/null curl --silent --connect-timeout 5 --location https://eic.github.io/motd/index.html --output $news &)
+  fi
+
+  # update hints at most once a day
+  if [[ -z $(find $hints -mtime +24) ]] ; then
+    (&>/dev/null curl --silent --connect-timeout 5 --location https://eic.github.io/motd/hints.html --output $hints &)
+  fi
+fi