Compare revisions

57088b95 · 431965d1 · b1b7de0d · 6a741cf8 · d9558804 · 3a547bc6
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
+name: build-push
+on:
+  schedule:
+    - cron: "30 */6 * * *"
+  push:
+    branches:
+    - master  
+  pull_request:
+    branches:
+    - master
+  workflow_dispatch:
+    inputs:
+      EDM4EIC_VERSION:
+        required: false
+        default: ''
+        type: string
+      EICRECON_VERSION:
+        required: false
+        default: ''
+        type: string
+      JUGGLER_VERSION:
+        required: false
+        default: ''
+        type: string
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+env:
+  ## Default versions are specified in packages.yaml but can be overridden
+  ## note: nightly builds will always use the master/main branch
+  EDM4EIC_VERSION: ${{ inputs.EDM4EIC_VERSION }}
+  EICRECON_VERSION: ${{ inputs.EICRECON_VERSION }}
+  JUGGLER_VERSION: ${{ inputs.JUGGLER_VERSION }}
+  ## Dockerhub registry
+  DH_REGISTRY: docker.io
+  DH_REGISTRY_USER: eicweb
+  DH_PUSH: 0
+  ## GitHub registry
+  GH_REGISTRY: ghcr.io
+  GH_REGISTRY_USER: eic
+  GH_PUSH: 1
+  ## Number of jobs to start during container builds
+  JOBS: 4
+  ## Internal tag used for the CI
+  INTERNAL_TAG: pipeline-${{ github.run_id }}
+jobs:
+  base:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+        - BASE_IMAGE: debian:stable-slim
+          BUILD_IMAGE: debian_stable_base
+          PLATFORM: linux/amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64,linux/arm64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.DH_REGISTRY }}/${{ env.DH_REGISTRY_USER }}/${{ matrix.BUILD_IMAGE }},enable=${{ env.DH_PUSH != 0 }}
+            name=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/${{ matrix.BUILD_IMAGE }},enable=${{ env.GH_PUSH != 0 }}
+          tags: |
+            ${{ env.INTERNAL_TAG }}
+            type=schedule
+            type=ref,prefix=unstable-pr-,event=pr
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: ${{ env.DH_PUSH == '1' }}
+        with:
+          registry: ${{ env.DH_REGISTRY }}
+          username: ${{ env.DH_REGISTRY_USER }}
+          password: ${{ secrets.DH_EICWEB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ env.GH_PUSH == '1' }}
+        with:
+          registry: ${{ env.GH_REGISTRY }}
+          username: ${{ secrets.GHCR_REGISTRY_USER }}
+          password: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: containers/debian/base.Dockerfile
+          context: containers/debian
+          platforms: ${{ matrix.PLATFORM }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            BASE_IMAGE=${{ matrix.BASE_IMAGE }}
+            BUILD_IMAGE=${{ matrix.BUILD_IMAGE }}
+          cache-from: type=gha,scope=${{ github.workflow }}
+          cache-to: type=gha,mode=max,scope=${{ github.workflow }}
+  dev:
+    runs-on: ubuntu-latest
+    needs: base
+    strategy:
+      matrix:
+        include:
+        - BUILDER_IMAGE: debian_stable_base
+          RUNTIME_IMAGE: debian_stable_base
+          BUILD_IMAGE: dev
+          PLATFORM: linux/amd64
+          ENV: dev
+    steps:
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@v1.3.1
+        with:
+          android: true
+          dotnet: true
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Load spack version and cherry-picks
+        id: spack
+        shell: bash
+        run: |
+          source spack.sh
+          echo "orgrepo=${SPACK_ORGREPO}" | tee -a $GITHUB_OUTPUT
+          echo "version=${SPACK_VERSION}" | tee -a $GITHUB_OUTPUT
+          echo "cherrypicks=${SPACK_CHERRYPICKS//$'\n'/ }" | tee -a $GITHUB_OUTPUT
+          echo "cherrypicks_files=${SPACK_CHERRYPICKS_FILES//$'\n'/ }" | tee -a $GITHUB_OUTPUT
+      - name: Load key4hep-spack version
+        id: key4hep-spack
+        run: |
+          source key4hep-spack.sh
+          echo "orgrepo=${KEY4HEPSPACK_ORGREPO}" | tee -a $GITHUB_OUTPUT
+          echo "version=${KEY4HEPSPACK_VERSION}" | tee -a $GITHUB_OUTPUT
+      - name: Load eic-spack version
+        id: eic-spack
+        run: |
+          source eic-spack.sh
+          echo "orgrepo=${EICSPACK_ORGREPO}" | tee -a $GITHUB_OUTPUT
+          echo "version=${EICSPACK_VERSION}" | tee -a $GITHUB_OUTPUT
+      - name: Load secrets into mirrors.yaml
+        id: mirrors
+        run: |
+          source spack.sh
+          export SPACK_VERSION
+          export CI_REGISTRY=ghcr.io
+          export CI_PROJECT_PATH=eic
+          export CI_REGISTRY_USER=${{ secrets.GHCR_REGISTRY_USER }}
+          export CI_REGISTRY_PASSWORD=${{ secrets.GHCR_REGISTRY_TOKEN }}
+          export GITHUB_REGISTRY_USER=${{ secrets.GHCR_REGISTRY_USER }}
+          export GITHUB_REGISTRY_TOKEN=${{ secrets.GHCR_REGISTRY_TOKEN }}
+          export S3RW_ACCESS_KEY=${{ secrets.S3RW_ACCESS_KEY }}
+          export S3RW_SECRET_KEY=${{ secrets.S3RW_SECRET_KEY }}
+          cat mirrors.yaml.in | envsubst > mirrors.yaml
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.DH_REGISTRY }}/${{ env.DH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.DH_PUSH != 0 }}
+            name=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.GH_PUSH != 0 }}
+          tags: |
+            ${{ env.INTERNAL_TAG }}
+            type=schedule,pattern={{date 'YYYY-MM-DD'}}
+            type=ref,prefix=unstable-pr-,event=pr
+            type=match,pattern=^v(\d+\.\d+\.\d+-.*)$,group=1
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: ${{ env.DH_PUSH == '1' }}
+        with:
+          registry: ${{ env.DH_REGISTRY }}
+          username: ${{ env.DH_REGISTRY_USER }}
+          password: ${{ secrets.DH_EICWEB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ env.GH_PUSH == '1' }}
+        with:
+          registry: ${{ env.GH_REGISTRY }}
+          username: ${{ secrets.GHCR_REGISTRY_USER }}
+          password: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: containers/jug/dev.Dockerfile
+          context: containers/jug
+          build-contexts: |
+            spack-environment=spack-environment
+          secret-files: |
+            mirrors=mirrors.yaml
+          platforms: ${{ matrix.PLATFORM }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            DOCKER_REGISTRY=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/
+            BUILDER_IMAGE=${{ matrix.BUILDER_IMAGE }}
+            RUNTIME_IMAGE=${{ matrix.RUNTIME_IMAGE }}
+            BUILD_IMAGE=eic_${{ matrix.BUILD_IMAGE }}
+            INTERNAL_TAG=${{ env.INTERNAL_TAG }}
+            SPACK_ORGREPO=${{ steps.spack.outputs.orgrepo }}
+            SPACK_VERSION=${{ steps.spack.outputs.version }}
+            SPACK_CHERRYPICKS=${{ steps.spack.outputs.cherrypicks }}
+            SPACK_CHERRYPICKS_FILES=${{ steps.spack.outputs.cherrypicks_files }}
+            KEY4HEPSPACK_ORGREPO=${{ steps.eic-spack.outputs.orgrepo }}
+            KEY4HEPSPACK_VERSION=${{ steps.eic-spack.outputs.version }}
+            EICSPACK_ORGREPO=${{ steps.eic-spack.outputs.orgrepo }}
+            EICSPACK_VERSION=${{ steps.eic-spack.outputs.version }}
+            KEY4HEPSPACK_ORGREPO=${{ steps.key4hep-spack.outputs.orgrepo }}
+            KEY4HEPSPACK_VERSION=${{ steps.key4hep-spack.outputs.version }}
+            S3_ACCESS_KEY=${{ secrets.S3_ACCESS_KEY }}
+            S3_SECRET_KEY=${{ secrets.S3_SECRET_KEY }}
+            jobs=${{ env.JOBS }}
+          cache-from: type=gha,scope=${{ github.workflow }}
+          cache-to: type=gha,mode=max,scope=${{ github.workflow }}
+  xl:
+    runs-on: ubuntu-latest
+    needs: dev
+    strategy:
+      matrix:
+        include:
+        - BASE_IMAGE: dev
+          BUILD_IMAGE: xl
+          PLATFORM: linux/amd64
+    steps:
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@v1.3.1
+        with:
+          android: true
+          dotnet: true
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: linux/amd64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.DH_REGISTRY }}/${{ env.DH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.DH_PUSH != 0 }}
+            name=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/eic_${{ matrix.BUILD_IMAGE }},enable=${{ env.GH_PUSH != 0 }}
+          tags: |
+            ${{ env.INTERNAL_TAG }}
+            type=schedule,pattern={{date 'YYYY-MM-DD'}}
+            type=ref,prefix=unstable-pr-,event=pr
+            type=match,pattern=^v(\d+\.\d+\.\d+-.*)$,group=1
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: ${{ env.DH_PUSH == '1' }}
+        with:
+          registry: ${{ env.DH_REGISTRY }}
+          username: ${{ env.DH_REGISTRY_USER }}
+          password: ${{ secrets.DH_EICWEB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ env.GH_PUSH == '1' }}
+        with:
+          registry: ${{ env.GH_REGISTRY }}
+          username: ${{ secrets.GHCR_REGISTRY_USER }}
+          password: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          file: containers/jug/xl.Dockerfile
+          context: containers/jug
+          build-contexts: |
+            detectors=.
+          platforms: ${{ matrix.PLATFORM }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            DOCKER_REGISTRY=${{ env.GH_REGISTRY }}/${{ env.GH_REGISTRY_USER }}/
+            BASE_IMAGE=eic_${{ matrix.BASE_IMAGE }}
+            BUILD_IMAGE=eic_${{ matrix.BUILD_IMAGE }}
+            INTERNAL_TAG=${{ env.INTERNAL_TAG }}
+            jobs=${{ env.JOBS }}
+          cache-from: type=gha,scope=${{ github.workflow }}
+          cache-to: type=gha,mode=max,scope=${{ github.workflow }}
--- a/.github/workflows/mirror.yaml
+++ b/.github/workflows/mirror.yaml
+name: Mirror and Trigger EICweb
+on:
+  delete:
+  push:
+  workflow_dispatch:
+concurrency:
+  group: mirror
+  cancel-in-progress: false
+jobs:
+  build:
+    name: Mirror and Trigger EICweb
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Push to EICweb
+      uses: eic/gitlab-sync@master
+      with:
+        url: https://eicweb.phy.anl.gov/containers/eic_container.git/
+        token: ${{ secrets.GITLAB_TOKEN }}
+        username: ${{ secrets.GITLAB_USERNAME }}
+        ciskip: true
+    - name: Trigger EICweb
+      if: ${{ github.event_name != 'delete' }}
+      uses: eic/trigger-gitlab-ci@v3
+      with:
+        url: https://eicweb.phy.anl.gov
+        project_id: 290
+        token: ${{ secrets.EICWEB_EIC_CONTAINER_TRIGGER }}
+        ref_name: ${{ github.event.pull_request.head.ref || github.ref }}
+        variables: |
+          GITHUB_REPOSITORY=${{ github.repository }}
+          GITHUB_SHA=${{ github.event.pull_request.head.sha || github.sha }}
+          GITHUB_PR=${{ github.event.pull_request.number }}
+          PIPELINE_NAME_CONTAINER=${{ github.repository }}: ${{ github.event.pull_request.title || github.ref_name }}
--- a/.gitignore
+++ b/.gitignore
+# install.sh products
+eic-shell
+local/
 # vim 
 ~*
 *.swp
@@ -14,3 +18,8 @@ build
 BUILD
 debug
 DEBUG
+#gitlab-ci-local
+.gitlab-ci-local/
+.nfs*
--- a/.gitlab-ci-local-env
+++ b/.gitlab-ci-local-env
+PRIVILEGED=1
+CONCURRENCY=1
+ULIMIT=8000:16000
+VOLUME=certs:/certs/client
+VARIABLE="DOCKER_TLS_CERTDIR=/certs"
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
--- a/README.md
+++ b/README.md
-EIC software container
+EIC Software Environment Container
-============================================
+==================================
-Installation
+## Installation Instructions 
------------
-1. Clone the repository and go into the directory
+For installation instructions of `eic-shell`, see https://github.com/eic/eic-shell.
-```bash
-git clone https://eicweb.phy.anl.gov/containers/eic_container.git
-cd eic_container
-```
-2. Run the install script `install.py` to install to your `<PREFIX>` of choice 
+## Updating a package
-   (e.g. $HOME/local/opt/eic_container_1.0.4). By default the
-   modeuefile will be installed to `$PREFIX/../../etc/modulefiles`. 
-   You can use the `-v` flag to select the version you want to install, or omit the 
-   flag if you want to install the master build. The recommended stable 
-   release version is `v2.8.0`.
-```bash
-./install.py -v 2.8.0 <PREFIX>
-```
-   Available flags:
+### An individual package is updated on spack package repository along with a spack version upgrade
-```bash
+This situation just requires modifying the eic-shell [yaml](https://eicweb.phy.anl.gov/containers/eic_container/-/blob/master/spack-environment/packages.yaml?ref_type=heads) file.
-  -v VERSION, --version VERSION 
-                        (opt.) project version. Default: current version (in repo).
-  -b BIND_PATHS, --bind-path BIND_PATHS
-                        (opt.) extra bind paths for singularity.
-  -m MODULE_PATH, --module-path MODULE_PATH
-                        (opt.) Root module path where you want to install a
-                        modulefile. D: <prefix>/../../etc/modulefiles
-  -l, --local           Local install, will not install the modulefiles (you will have
-                        to run the launcher scripts from their relative paths).
-  -f, --force           Force-overwrite already downloaded container with the same name.
-```
+#### An individual package is updated on spack package repository after a spack version upgrade
-3. To use the container in installed mode, you can load the modulefile, 
+This circumstance requires special cherry pick.
-   and then use the included apps as if they are native apps on your system!
-```bash
-module load eic_container
-```
-4. To use the container in local mode, you can install the container with the `-l` flag,
+Example:
-   and then use the runscripts (under `$PREFIX/bin`) manually.
+https://eicweb.phy.anl.gov/containers/eic_container/-/merge_requests/879/diffs
-```bash
-./install.py $PREFIX -l
-...
-$PREFIX/bin/eic-shell
-```
-4. (Advanced) If you need to add additional bind directives for the internal singularity container,
+In this example, the spack package xrootd had the latest version 5.6.9 which was put in after a spack version upgrade. We had to modify the eic-shell [spack.sh](https://eicweb.phy.anl.gov/containers/eic_container/-/blob/master/spack-environment/packages.yaml?ref_type=heads) file to include the commit hash of the version update from the main [spack](https://github.com/spack/spack/commits/develop/var/spack/repos/builtin/packages/xrootd/package.py) package repository in addition to modifying the eic-shell [yaml](https://eicweb.phy.anl.gov/containers/eic_container/-/blob/master/spack-environment/packages.yaml?ref_type=heads) file.  
-   you can add them with the `-b` flag. Run `./install.py -h` to see a list of all
-   supported options.
-Usage
-----
-### A. Running the singularity development environment with modulefiles
-1. Add the installed modulefile to your module path, e.g.,
-```bash
-module use <prefix>/../../etc/modulefiles
-```
-2. Load the eic container
-```bash
-module load eic_container
-```
-3. To start a shell in the container environment, do
-```bash
-eic-shell
-```
-### B. Running the singularity development locally (without modulefiles)
-1. This is assuming you installed with the `-l` flag to a prefix `$PREFIX`:
-```bash
-./install.py $PREFIX
-```
-2. To start a shell in the container environment, do
-```bash
-$PREFIX/bin/eic-shell
-```
-### C. Using the docker container for your CI purposes
-1. To load the container environment in your run scripts, you have to do nothing special.  
-   The environment is already setup with good defaults, so you can use all the programs 
-   in the container as usual and assume everything needed to run the included software 
-   is already setup.  
-2. If using this container as a basis for a new container, you can direction access 
-   the full container environment from a docker `RUN` shell command with no further
-   action needed. For the most optimal experience, you can install your software to
-   `/usr/local` to fully integrate with the existing environment. (Note that, internally,
-   `/usr/local` is a symlink to `/opt/view`).
-Included software:
------------------
-  - Included software:
-    - gcc@10.2.1
-    - cmake@3.20.0
-    - fmt@7.1.2
-    - spdlog@1.8.1
-    - nlohmann-json
-    - heppdt@3.04.01
-    - clhep@2.4.4.0
-    - eigen@3.3.9
-    - python@3.7.8 with pip, numpy, pyyaml, pyafp,  matplotlib, ipython, scipy
-    - xrootd@5.1.0
-    - root@6.22.08
-    - pythia8@8303
-    - hepmc3@3.2.2 +python +rootio
-    - stow@2.3.1
-    - podio@0.13
-    - geant4@10.7.1
-    - dd4hep@1.16.1
-    - acts@5.00.0
-    - gaudi@34.0
-    - dawn@3.91a
-    - dawncut@1.54a
-    - opencascade
-  - The singularity build exports the following applications:
-    - eic_shell: a development shell in the image
-    - container_dev: same as EIC shell
-    - ipython
--- a/VERSION
+++ b/VERSION
-2.8.0
--- a/containers/build_and_deploy.yml.in
+++ b/containers/build_and_deploy.yml.in
-image: eicweb.phy.anl.gov:4567/containers/image_recipes/ubuntu_dind:latest
-stages:
-  - build
-  - config
-  - package
-## variables:
-##   - TARGET_XXX: docker build target (including cache modifier) 
-##     (stable, stable-cached, unstable, unstable-cached)
-##   - TAG: main docker tag to be used internally 
-##     (e.g. 2.5-stable/unstable/<version>)
-##   - PUBLISH: docker publish directives
-variables:
-  TARGET_BUILDER: @TARGET_BUILDER@
-  TARGET_RELEASE: @TARGET_RELEASE@
-  TAG: @TAG@
-  PUBLISH: "@PUBLISH@"
-default:
-  tags:
-    - silicon
-builder:
-  stage: build
-  script:
-    - cp -r gitlab-ci/docker/* containers/builder
-    - cp -r spack containers/builder/np-spack
-    - cd containers/builder
-    - head Dockerfile
-    - make login
-    - echo "Creating builder image for $TARGET_BUILDER"
-    - make $TARGET_BUILDER
-    - echo "Publishing image $PUBLISH"
-    - make $PUBLISH
-config:
-  image: eicweb.phy.anl.gov:4567/containers/eic_container/eic_builder:$TAG
-  stage: config
-  needs: ["builder"]
-  script:
-    - bash containers/release/configure_dockerfile.sh $TAG
-  artifacts:
-    paths:
-      - config
-release:
-  stage: package
-  needs: ["config"]
-  script:
-    - cp -r gitlab-ci/docker/* containers/release
-    - cp config/Dockerfile containers/release/Dockerfile
-    - cp config/eic-env.sh containers/release/eic-env.sh
-    - cd containers/release
-    - make login
-    - echo "Creating release image for $TARGET_RELEASE"
-    - make $TARGET_RELEASE
-    - echo "Publishing image $PUBLISH"
-    - make $PUBLISH
-  artifacts:
-    paths:
-      - config
--- a/containers/builder/Dockerfile
+++ b/containers/builder/Dockerfile
-# Builder with Argonne EIC software
-#
-FROM eicweb.phy.anl.gov:4567/containers/image_recipes/debian_spack:snapshot-20210408
-LABEL maintainer="Sylvester Joosten <sjoosten@anl.gov>" \
-      name="eic_builder" \
-      group="eic_builder" \
-      march="native" \
-      basedist="debian" \
-      base="debian"
-ENV DOCKERFILE_BASE=debian            \
-    DOCKERFILE_DISTRO=debian          \
-    DOCKERFILE_DISTRO_VERSION=20210408-testing \
-    SPACK_ROOT=/opt/spack             \
-    DEBIAN_FRONTEND=noninteractive    \
-    CURRENTLY_BUILDING_DOCKER_IMAGE=1 \
-    container=docker
-## install ghostview/ghostscript needed by some of the tools
-RUN apt-get -yqq update \
- && apt-get -yqq install --no-install-recommends \
-        ghostscript \
-        gv \
- && rm -rf /var/lib/apt/lists/*
-## Setup our environment definition
-COPY spack.yaml /opt/spack-environment/spack.yaml
-## Ensure an up-to-date custom package list
-## TODO: We should just remove this from the upstream container
-##       and only initialize the custom packages here for more
-##       transparency
-RUN rm -rf $SPACK_ROOT/np-spack \
- && echo "repos:" > $SPACK_ROOT/etc/spack/repos.yaml \
- && echo " - $SPACK_ROOT/np-spack" >> $SPACK_ROOT/etc/spack/repos.yaml
-COPY np-spack $SPACK_ROOT/np-spack
-## Install the software, no garbage collection at this stage
-## as this is a raw builder image
-RUN cd /opt/spack-environment \
- && spack env activate . \
- && spack install -j64 \
- && spack clean -a
-## Install additional python packages
-RUN cd /opt/spack-environment && spack env activate . \
- && pip install --trusted-host pypi.org \
-                --trusted-host files.pythonhosted.org \
-                --no-cache-dir \
-        ipython matplotlib scipy yapf
-# Modifications to the environment that are necessary to run
-# Also make sure we keep the /lib/x86_65-linux-gnu in our PATH
-RUN cd /opt/spack-environment \
- && spack env activate --sh -d . > /etc/profile.d/z10_spack_environment.sh \
- && sed -i "s?LD_LIBRARY_PATH=?&/lib/x86_64-linux-gnu:?" /etc/profile.d/z10_spack_environment.sh
-# Add some extra environment variables
-# Somehow PODIO env isn't automatically set, 
-# and Gaudi likes BINARY_TAG to be set
-RUN cd /opt/spack-environment \
- && spack env activate . \
- && export PODIO=`spack find -p podio | grep software | awk '{print $2}'` \
- && echo "export PODIO=${PODIO};" >> /etc/profile.d/z10_spack_environment.sh \
- && echo "export BINARY_TAG=x86_64-linux-gcc9-opt" >> /etc/profile.d/z10_spack_environment.sh
-## make sure we have the entrypoints setup correctly
-ENTRYPOINT []
-CMD ["bash", "--rcfile", "/etc/profile", "-l"]
-USER 0
-WORKDIR /
--- a/containers/builder/config.env
+++ b/containers/builder/config.env
-REG_HOST  ?= eicweb.phy.anl.gov
-REG_PORT  ?= 4567
-REG_NAME  ?= $(REG_HOST):$(REG_PORT)
-REG_URL   ?= https://$(REG_HOST)
-APP_NAME     = eic_builder
-REPO_NAME    = eic_builder
-GL_GROUP     = eic_container
-GL_REG_GROUP = containers/eic_container
-GL_REG_NAME  = $(REG_NAME)
--- a/containers/builder/spack.yaml
+++ b/containers/builder/spack.yaml
-spack:
-  specs:
-    - madx@5.06.1
-    - cmake@3.20.0
-    - fmt@7.1.2 cxxstd=17
-    - spdlog@1.8.1
-    - nlohmann-json@3.9.1
-    - heppdt@3.04.01
-    - clhep@2.4.4.0 cxxstd=17
-    - eigen@3.3.9
-    - python@3.7.8
-    - py-pip
-    - py-numpy
-    - py-pyyaml
-    - xrootd@5.1.0 cxxstd=17 +python
-    - root@6.22.08 cxxstd=17 
-          +fftw +fortran +gdml +http +mlp +pythia8 
-          +root7 +tmva +vc +xrootd +ssl ^mesa+opengl 
-          -llvm -osmesa
-    - pythia8@8303
-    - hepmc3@3.2.2 +python +rootio 
-    - stow@2.3.1
-    - cairo+fc+ft+X+pdf+gobject
-    - podio@0.13
-    - geant4@10.7.1 cxxstd=17 +opengl +vecgeom +x11 +qt ^qt +opengl
-    - dd4hep@1.16.1 +geant4 +assimp +hepmc3 +ipo
-    - acts@5.00.0 +dd4hep +digitization +identification +json +tgeo +ipo
-    - gaudi@34.0
-    - dawn@3_91a
-    - dawncut@1_54a
-    - opencascade
-  concretization: together
-  view: /usr/local
--- a/containers/debian/Dockerfile
+++ b/containers/debian/Dockerfile
+#syntax=docker/dockerfile:1.8
+#check=error=true
+ARG BASE_IMAGE="amd64/debian:stable-slim"
+ARG BUILD_IMAGE="debian_stable_base"
+# Minimal container based on Debian base systems for up-to-date packages. 
+FROM ${BASE_IMAGE}
+ARG TARGETPLATFORM
+# Open Container Initiative labels (no heredoc support)
+LABEL \
+org.opencontainers.image.vendor="Electron-Ion Collider" \
+org.opencontainers.image.authors="Electron-Ion Collider Software Working Groups <eic-software-l-owner@lists.bnl.gov>" \
+org.opencontainers.image.url="https://github.com/eic/containers" \
+org.opencontainers.image.source="https://github.com/eic/containers" \
+org.opencontainers.image.documentation="https://eic.github.io" \
+org.opencontainers.image.license="GPL-3.0-or-later"
+LABEL org.opencontainers.image.title="Electron-Ion Collider base image ($TARGETPLATFORM)"
+COPY bashrc /root/.bashrc
+## With heredocs for multi-line scripts, we want to fail on error and the print failing line.
+## Ref: https://docs.docker.com/engine/reference/builder/#example-running-a-multi-line-script
+SHELL ["bash", "-ex", "-c"]
+ENV CLICOLOR_FORCE=1                                                    \
+    LANGUAGE=en_US.UTF-8                                                \
+    LANG=en_US.UTF-8                                                    \
+    LC_ALL=en_US.UTF-8
+## Install additional packages. Remove the auto-cleanup functionality
+## for docker, as we're using the new buildkit cache instead.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked <<EOF
+rm -f /etc/apt/apt.conf.d/docker-clean
+ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime
+echo "US/Eastern" > /etc/timezone
+apt-get -yqq update
+apt-get -yqq install --no-install-recommends                            \
+        bc                                                              \
+        bzip2                                                           \
+        ca-certificates                                                 \
+        ccache                                                          \
+        curl                                                            \
+        file                                                            \
+        gawk                                                            \
+        gdb                                                             \
+        ghostscript                                                     \
+        git                                                             \
+        gnupg2                                                          \
+        gv                                                              \
+        iproute2                                                        \
+        iputils-ping                                                    \
+        iputils-tracepath                                               \
+        less                                                            \
+        libc6-dbg                                                       \
+        libcbor-xs-perl                                                 \
+        libegl-dev                                                      \
+        libjson-xs-perl                                                 \
+        libgl-dev                                                       \
+        libglew-dev                                                     \
+        libglx-dev                                                      \
+        libopengl-dev                                                   \
+        locales                                                         \
+        lua-posix                                                       \
+        make                                                            \
+        moreutils                                                       \
+        nano                                                            \
+        openssh-client                                                  \
+        parallel                                                        \
+        patch                                                           \
+        poppler-utils                                                   \
+        time                                                            \
+        unzip                                                           \
+        vim-nox                                                         \
+        wget
+apt-get -yqq autoremove
+localedef -i en_US -f UTF-8 en_US.UTF-8
+EOF
+# Install updated compilers, with support for multiple base images
+## Ubuntu: latest gcc from toolchain ppa, latest stable clang
+## Debian: default gcc with distribution, latest stable clang
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked <<EOF
+. /etc/os-release
+mkdir -p /etc/apt/source.list.d
+# GCC and CLANG version and repository
+case ${ID} in
+  debian)
+    case ${VERSION_CODENAME} in
+      bookworm) GCC="-12" ; CLANG="-16" ;;
+      trixie) GCC="-13" ; CLANG="-17" ;;
+      *) echo "Unsupported VERSION_CODENAME=${VERSION_CODENAME}" ; exit 1 ;;
+    esac ;;
+  ubuntu)
+    echo "deb http://ppa.launchpad.net/ubuntu-toolchain-r/ppa/ubuntu/${VERSION_CODENAME} main" > /etc/apt/source.list.d/ubuntu-toolchain.list
+    case ${VERSION_CODENAME} in
+      focal) GCC="-10" ; CLANG="-16" ;;
+      jammy) GCC="-12" ; CLANG="-16" ;;
+      noble) GCC="-13" ; CLANG="-17" ;;
+      *) echo "Unsupported VERSION_CODENAME=${VERSION_CODENAME}" ; exit 1 ;;
+    esac ;;
+  *) echo "Unsupported ID=${ID}" ; exit 1 ;;
+esac
+# Clang repository
+curl -s https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
+if [ ${VERSION_CODENAME} = trixie ] ; then
+  echo "deb http://apt.llvm.org/unstable llvm-toolchain${CLANG} main" > /etc/apt/sources.list.d/llvm.list
+else
+  echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME}${CLANG} main" > /etc/apt/sources.list.d/llvm.list
+fi
+# Install packages
+apt-get -yqq update
+apt-get -yqq install cpp${GCC} gcc${GCC} g++${GCC} gfortran${GCC}
+apt-get -yqq install clang${CLANG} clang-tidy${CLANG} clang-format${CLANG} libclang${CLANG}-dev
+apt-get -yqq autoremove
+# Remove symlinks loop in nvidia/cuda:12.5.1-devel-ubuntu24.04
+rm -f /usr/bin/cpp /etc/alternatives/cpp
+# Ensure alternatives without version tags
+update-alternatives --install /usr/bin/cpp cpp /usr/bin/cpp${GCC} 100
+update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc${GCC} 100
+update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++${GCC} 100
+update-alternatives --install /usr/bin/gfortran gfortran /usr/bin/gfortran${GCC} 100
+update-alternatives --install /usr/bin/clang clang /usr/bin/clang${CLANG} 100
+update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++${CLANG} 100
+update-alternatives --install /usr/bin/clang-format clang-format /usr/bin/clang-format${CLANG} 100
+update-alternatives --install /usr/bin/clang-format-diff clang-format-diff /usr/bin/clang-format-diff${CLANG} 100
+update-alternatives --install /usr/bin/clang-tidy-diff clang-tidy-diff /usr/bin/clang-tidy-diff${CLANG}.py 100
+update-alternatives --install /usr/bin/run-clang-tidy run-clang-tidy /usr/bin/run-clang-tidy${CLANG}.py 100
+update-alternatives --install /usr/bin/llvm-config llvm-config /usr/bin/llvm-config${CLANG} 100
+# Default to gcc
+update-alternatives --install /usr/bin/cc  cc  /usr/bin/gcc 100
+update-alternatives --install /usr/bin/c++ c++ /usr/bin/g++ 100
+# Check versions
+gcc --version
+clang --version
+EOF
+## Install some extra spack dependencies
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=${TARGETPLATFORM} \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked,id=${TARGETPLATFORM} <<EOF
+rm -f /etc/apt/apt.conf.d/docker-clean
+apt-get -yqq update
+apt-get -yqq install --no-install-recommends                            \
+        jq                                                              \
+        python3                                                         \
+        python3-dev                                                     \
+        python3-boto3                                                   \
+        python-is-python3
+EOF
+## Setup spack
+ENV SPACK_ROOT=/opt/spack
+ARG SPACK_ORGREPO="spack/spack"
+ARG SPACK_VERSION="releases/latest"
+ENV SPACK_PYTHON=/usr/bin/python3
+ARG SPACK_CHERRYPICKS=""
+ARG SPACK_CHERRYPICKS_FILES=""
+ADD https://api.github.com/repos/${SPACK_ORGREPO}/commits/${SPACK_VERSION} /tmp/spack.json
+RUN <<EOF
+git config --global user.email "gitlab@eicweb.phy.anl.gov"
+git config --global user.name "EIC Container Build Service"
+git config --global advice.detachedHead false
+git config --global gc.autoDetach false
+git clone --filter=tree:0 https://github.com/${SPACK_ORGREPO}.git ${SPACK_ROOT}
+git -C ${SPACK_ROOT} checkout ${SPACK_VERSION}
+if [ -n "${SPACK_CHERRYPICKS}" ] ; then
+  SPACK_CHERRYPICKS=$(git -C ${SPACK_ROOT} rev-list --topo-order ${SPACK_CHERRYPICKS} | grep -m $(echo ${SPACK_CHERRYPICKS} | wc -w)  "${SPACK_CHERRYPICKS}" | tac)
+  eval "declare -A SPACK_CHERRYPICKS_FILES_ARRAY=(${SPACK_CHERRYPICKS_FILES})"
+  for hash in ${SPACK_CHERRYPICKS} ; do
+    if [ -n "${SPACK_CHERRYPICKS_FILES_ARRAY[${hash}]+found}" ] ; then
+      git -C ${SPACK_ROOT} show ${hash} -- ${SPACK_CHERRYPICKS_FILES_ARRAY[${hash}]//,/ } | patch -p1 -d ${SPACK_ROOT}
+      git -C ${SPACK_ROOT} commit --all --message "$(git -C ${SPACK_ROOT} show --no-patch --pretty=format:%s ${hash})"
+    else
+      git -C ${SPACK_ROOT} cherry-pick ${hash}
+    fi
+  done
+fi
+git -C $SPACK_ROOT gc --prune=all --aggressive
+sed -i 's/timeout=60/timeout=None/' $SPACK_ROOT/lib/spack/spack/stage.py
+ln -s $SPACK_ROOT/share/spack/docker/entrypoint.bash /usr/bin/docker-shell
+ln -s $SPACK_ROOT/share/spack/docker/entrypoint.bash /usr/bin/interactive-shell
+ln -s $SPACK_ROOT/share/spack/docker/entrypoint.bash /usr/bin/spack-env
+EOF
+## Use spack entrypoint. NOTE: Requires `set -ex` in all multi-line scripts!
+SHELL ["docker-shell"]
+## Setup build configuration
+ARG jobs=1
+RUN <<EOF
+set -e
+declare -A target=(["linux/amd64"]="x86_64_v2" ["linux/arm64"]="aarch64")
+target=${target[${TARGETPLATFORM}]}
+spack config --scope site add "packages:all:require:[target=${target}]"
+spack config --scope site add "packages:all:target:[${target}]"
+spack config blame packages
+spack config --scope user add "config:suppress_gpg_warnings:true"
+spack config --scope user add "config:build_jobs:${jobs}"
+spack config --scope user add "config:db_lock_timeout:${jobs}00"
+spack config --scope user add "config:source_cache:/var/cache/spack"
+spack config --scope user add "config:install_tree:root:/opt/software"
+spack config --scope user add "config:ccache:true"
+spack config blame config
+spack compiler find --scope site
+spack config blame compilers
+EOF
+## Setup buildcache mirrors
+## - this always adds the read-only mirror to the container
+## - the write-enabled mirror is provided later as a secret mount
+RUN --mount=type=cache,target=/var/cache/spack <<EOF
+set -e
+spack mirror add --scope site --signed spack-${SPACK_VERSION} https://binaries.spack.io/${SPACK_VERSION}
+spack mirror add --scope site --unsigned ghcr-${SPACK_VERSION} oci://ghcr.io/eic/spack-${SPACK_VERSION}
+spack mirror list
+EOF
+## Setup key4hep-spack
+ENV KEY4HEPSPACK_ROOT=${SPACK_ROOT}/var/spack/repos/key4hep-spack
+ARG KEY4HEPSPACK_ORGREPO="key4hep/key4hep-spack"
+ARG KEY4HEPSPACK_VERSION="main"
+ADD https://github.com/${KEY4HEPSPACK_ORGREPO}.git#${KEY4HEPSPACK_VERSION} ${KEY4HEPSPACK_ROOT}
+RUN spack repo add --scope site "${KEY4HEPSPACK_ROOT}"
+## Setup eic-spack
+ENV EICSPACK_ROOT=${SPACK_ROOT}/var/spack/repos/eic-spack
+ARG EICSPACK_ORGREPO="eic/eic-spack"
+ARG EICSPACK_VERSION="develop"
+ADD https://github.com/${EICSPACK_ORGREPO}.git#${EICSPACK_VERSION} ${EICSPACK_ROOT}
+RUN spack repo add --scope site "${EICSPACK_ROOT}"
--- a/containers/debian/README.md
+++ b/containers/debian/README.md
+To build the container in this directory:
+```
+docker buildx build -f Dockerfile .
+```
--- a/containers/release/bashrc
+++ b/containers/release/bashrc
@@ -394,7 +394,7 @@ function __setprompt
 	fi
 	# Date
-	PS1+="\[${DARKGRAY}\](\[${CYAN}\]\$(date +%a) $(date +%b-'%-m')" # Date
+	PS1+="\[${DARKGRAY}\](\[${CYAN}\]\$(date +%a) $(date +%b-'%-d')" # Date
 	PS1+="${BLUE} $(date +'%-I':%M:%S%P)\[${DARKGRAY}\])-" # Time
 	# CPU

--- a/containers/eic/Dockerfile
+++ b/containers/eic/Dockerfile
+#syntax=docker/dockerfile:1.10
+#check=error=true
+ARG DOCKER_REGISTRY="eicweb/"
+ARG BUILDER_IMAGE="debian_stable_base"
+ARG RUNTIME_IMAGE="debian_stable_base"
+ARG INTERNAL_TAG="master"
+##
+## This docker build follows two tracks, in order to ensure that we build all packages
+## in a builder image, but install them in a runtime image, while at the same time
+## avoiding a expensive filesystem copy operation at the end that breaks layering.
+##
+## The build is split in an infrequently-changing default environment, upon which
+## an environment with custom versions (e.g. individual commits) is layered. The
+## custom environment will change frequently but layers will be smaller, allowing
+## for easier deployment with smaller delta layers.
+##
+## The separation in a builder and runtime image is particularly relevant to end up with
+## lightweight images for expensive build dependencies, such as for example CUDA.
+##
+## builder track                         runtime track
+## ----------------------------------------------------------------------
+## builder_image                         runtime_image
+## builder_concretization_default   
+## builder_installation_default     ->   runtime_concretization_default  (copy spack.lock)
+##                                 \->   runtime_installation_default    (from buildcache)
+## builder_concretization_custom
+## builder_installation_custom      ->   runtime_concretization_custom   (copy spack.lock)
+##                                 \->   runtime_installation_custom     (from buildcache)
+##
+## ========================================================================================
+## builder_concretization_default
+## - builder base with concretization of default versions
+## ========================================================================================
+FROM ${DOCKER_REGISTRY}${BUILDER_IMAGE}:${INTERNAL_TAG} AS builder_concretization_default
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build concretization image (default configuration, $TARGETPLATFORM)"
+## Copy our default environment
+COPY --from=spack-environment . /opt/spack-environment/
+ARG ENV=xl
+ENV SPACK_ENV=/opt/spack-environment/${ENV}
+# Concretization (default environment)
+RUN <<EOF
+echo -e "\n  view: false" >> ${SPACK_ENV}/spack.yaml
+spack env activate --dir ${SPACK_ENV}
+spack external find --not-buildable --scope env:${SPACK_ENV} --path /usr/local/cuda/bin cuda
+spack external find --not-buildable --scope env:${SPACK_ENV} llvm
+spack concretize --force
+EOF
+## ========================================================================================
+## builder_installation_default
+## - builder base with installation of default versions
+## ========================================================================================
+FROM builder_concretization_default AS builder_installation_default
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build installation image (default configuration, $TARGETPLATFORM)"
+# Installation (default environment)
+RUN --mount=type=cache,target=/ccache,id=${TARGETPLATFORM}              \
+    --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    --mount=type=secret,id=CI_REGISTRY_USER,env=CI_REGISTRY_USER        \
+    --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
+    --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
+    --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    <<EOF
+set -e
+export CCACHE_DIR=/ccache
+mkdir -p /var/cache/spack/blobs/sha256/
+find /var/cache/spack/blobs/sha256/ -ignore_readdir_race -atime +7 -delete
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV}
+ccache --show-stats
+ccache --zero-stats
+EOF
+## ========================================================================================
+## runtime_concretization_default
+## - runtime base with concretization of default versions (taken from equivalent builder)
+## ========================================================================================
+FROM ${DOCKER_REGISTRY}${RUNTIME_IMAGE}:${INTERNAL_TAG} AS runtime_concretization_default
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime concretization image (default configuration, $TARGETPLATFORM)"
+## Copy our default environment
+COPY --from=spack-environment . /opt/spack-environment/
+ARG ENV=xl
+ENV SPACK_ENV=/opt/spack-environment/${ENV}
+RUN echo -e "\n  view: false" >> ${SPACK_ENV}/spack.yaml
+COPY --from=builder_installation_default \
+  /opt/spack-environment/${ENV}/spack.* \
+  /opt/spack-environment/${ENV}/
+## ========================================================================================
+## runtime_installation_default
+## - runtime base with installation of default versions (buildcache populated by builder)
+## ========================================================================================
+FROM runtime_concretization_default AS runtime_installation_default
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime installation image (default configuration, $TARGETPLATFORM)"
+# Installation (default environment, from buildcache)
+RUN --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    --mount=type=secret,id=CI_REGISTRY_USER,env=CI_REGISTRY_USER        \
+    --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
+    --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
+    --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    <<EOF
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV} SPACK_INSTALL_FLAGS="--use-buildcache only"
+spack gc --yes-to-all
+EOF
+## ========================================================================================
+## builder_concretization_custom
+## - builder base with concretization of custom versions
+## ========================================================================================
+FROM builder_installation_default AS builder_concretization_custom
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build concretization image (custom configuration, $TARGETPLATFORM)"
+## 2. Setup our environment with custom versions (on top of cached layer)
+## Note: these default versions are just the very first commit.
+ARG EDM4EIC_VERSION="8aeb507f93a93257c99985efbce0ec1371e0b331"
+ARG EICRECON_VERSION="28108da4a1e8919a05dfdb5f11e114800a2cbe96"
+ARG EPIC_VERSION="c1827f05430b2051df8a0b421db1cbab87165e0b"
+ARG JUGGLER_VERSION="df87bf1f8643afa8e80bece9d36d6dc26dfe8132"
+ADD https://api.github.com/repos/eic/edm4eic/commits/${EDM4EIC_VERSION} /tmp/edm4eic.json
+ADD https://api.github.com/repos/eic/eicrecon/commits/${EICRECON_VERSION} /tmp/eicrecon.json
+ADD https://api.github.com/repos/eic/epic/commits/${EPIC_VERSION} /tmp/epic.json
+ADD https://api.github.com/repos/eic/juggler/commits/${JUGGLER_VERSION} /tmp/juggler.json
+# Concretization (custom environment)
+RUN <<EOF
+spack env activate --dir ${SPACK_ENV}
+if [ "${EDM4EIC_VERSION}" != "8aeb507f93a93257c99985efbce0ec1371e0b331" ] ; then
+  export EDM4EIC_VERSION=$(jq -r .sha /tmp/edm4eic.json)
+  sed -i "/# EDM4EIC_VERSION$/ s/@[^' ]*/@git.${EDM4EIC_VERSION}=main/" /opt/spack-environment/packages.yaml
+  spack deconcretize -y --all edm4eic
+fi
+if [ "${EICRECON_VERSION}" != "28108da4a1e8919a05dfdb5f11e114800a2cbe96" ] ; then
+  export EICRECON_VERSION=$(jq -r .sha /tmp/eicrecon.json)
+  sed -i "/# EICRECON_VERSION$/ s/@[^' ]*/@git.${EICRECON_VERSION}=main/" /opt/spack-environment/packages.yaml
+  spack deconcretize -y --all eicrecon
+fi
+if [ "${EPIC_VERSION}" != "c1827f05430b2051df8a0b421db1cbab87165e0b" ] ; then
+  export EPIC_VERSION=$(jq -r .sha /tmp/epic.json)
+  sed -i "/# EPIC_VERSION$/ s/epic\s/epic@git.${EPIC_VERSION}=main /" /opt/spack-environment/${ENV}/spack.yaml
+  sed -i "/# EPIC_VERSION$/ s/epic@main\s/epic@git.${EPIC_VERSION}=main /" /opt/spack-environment/${ENV}/spack.yaml
+  spack deconcretize -y --all epic
+fi
+if [ "${JUGGLER_VERSION}" != "df87bf1f8643afa8e80bece9d36d6dc26dfe8132" ] ; then
+  export JUGGLER_VERSION=$(jq -r .sha /tmp/juggler.json)
+  sed -i "/# JUGGLER_VERSION$/ s/@[^' ]*/@git.${JUGGLER_VERSION}=main/" /opt/spack-environment/packages.yaml
+  spack deconcretize -y --all juggler
+fi
+spack concretize --force
+EOF
+## ========================================================================================
+## builder_installation_custom
+## - builder base with installation of custom versions
+## ========================================================================================
+FROM builder_concretization_custom AS builder_installation_custom
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider build installation image (custom configuration, $TARGETPLATFORM)"
+# Installation (custom environment)
+RUN --mount=type=cache,target=/ccache,id=${TARGETPLATFORM}              \
+    --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    --mount=type=secret,id=CI_REGISTRY_USER,env=CI_REGISTRY_USER        \
+    --mount=type=secret,id=CI_REGISTRY_PASSWORD,env=CI_REGISTRY_PASSWORD \
+    --mount=type=secret,id=GITHUB_REGISTRY_USER,env=GITHUB_REGISTRY_USER \
+    --mount=type=secret,id=GITHUB_REGISTRY_TOKEN,env=GITHUB_REGISTRY_TOKEN \
+    <<EOF
+set -e
+export CCACHE_DIR=/ccache
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV}
+spack gc --yes-to-all
+spack find --long --no-groups \
+| sed -e '1,/Installed packages/d;s/\([^@]*\).*/\1/g' \
+| uniq -D -f1 | grep -v -w -e "\(epic\|py-pip\|py-cython\)" \
+| tee /tmp/duplicates.txt
+if [ -s /tmp/duplicates.txt ] ; then
+  echo "Duplicate packages found"
+  cat /tmp/duplicates.txt | while read hash spec ; do spack spec --long /${hash} ; done
+  exit 1
+fi
+ccache --show-stats
+ccache --zero-stats
+EOF
+## ========================================================================================
+## runtime_concretization_custom
+## - runtime base with concretization of custom versions (taken from equivalent builder)
+## ========================================================================================
+FROM runtime_installation_default AS runtime_concretization_custom
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime concretization image (custom configuration, $TARGETPLATFORM)"
+COPY --from=builder_installation_custom \
+  /opt/spack-environment/${ENV}/spack.* \
+  /opt/spack-environment/${ENV}/
+COPY --from=builder_installation_custom \
+  /opt/spack-environment/packages.yaml \
+  /opt/spack-environment/
+## ========================================================================================
+## runtime_installation_custom
+## - runtime base with installation of custom versions (buildcache populated by builder)
+## ========================================================================================
+FROM runtime_concretization_custom AS runtime_installation_custom
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime installation image (custom configuration, $TARGETPLATFORM)"
+# Installation (default environment, from buildcache)
+RUN --mount=type=cache,target=/var/cache/spack                          \
+    --mount=type=secret,id=mirrors,target=/opt/spack/etc/spack/mirrors.yaml \
+    <<EOF
+set -e
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment \
+  SPACK_ENV=${SPACK_ENV} SPACK_INSTALL_FLAGS="--use-buildcache only"
+spack gc --yes-to-all
+spack find --long --no-groups \
+| sed -e '1,/Installed packages/d;s/\([^@]*\).*/\1/g' \
+| uniq -D -f1 | grep -v -w -e "\(epic\|py-pip\|py-cython\)" \
+| tee /tmp/duplicates.txt
+if [ -s /tmp/duplicates.txt ] ; then
+  echo "Duplicate packages found"
+  cat /tmp/duplicates.txt | while read hash spec ; do spack spec --long /${hash} ; done
+  exit 1
+fi
+EOF
+## ========================================================================================
+## final image, based on runtime_installation_custom
+## ========================================================================================
+FROM runtime_installation_custom
+ARG TARGETPLATFORM
+# Open Container Initiative labels
+LABEL org.opencontainers.image.title="Electron-Ion Collider runtime installation image (custom configuration, $TARGETPLATFORM)"
+## Create views at /opt/local and /opt/detector
+RUN <<EOF
+set -e
+rm -rf /opt/local
+sed -i -e '/view: false/d' ${SPACK_ENV}/spack.yaml
+cat /opt/spack-environment/view.yaml >> ${SPACK_ENV}/spack.yaml
+spack -e ${SPACK_ENV} env view regenerate /opt/local
+spack -e ${SPACK_ENV} env view regenerate /opt/detector
+# ensure /opt/local is the view, not a symlink
+rm -rf /opt/local /opt/detector
+LOCAL_PREFIX_PATH=$(realpath $(ls /opt/._local/ | tail -n1))
+mv /opt/._local/${LOCAL_PREFIX_PATH} /opt/local
+ln -s /opt/local /opt/._local/${LOCAL_PREFIX_PATH}
+DETECTOR_PREFIX_PATH=$(realpath $(ls /opt/._detector/ | tail -n1))
+mv /opt/._detector/${DETECTOR_PREFIX_PATH} /opt/detector
+ln -s /opt/detector /opt/._detector/${DETECTOR_PREFIX_PATH}
+EOF
+## Place cvmfs catalogs
+RUN <<EOF
+set -e
+touch ${SPACK_ROOT}/.cvmfscatalog
+touch /opt/software/.cvmfscatalog
+find /opt/software -mindepth 2 -maxdepth 3 -type d -exec touch {}/.cvmfscatalog \;
+touch /opt/local/.cvmfscatalog
+EOF
+## Store environment
+RUN <<EOF
+set -e
+spack env activate --sh --dir ${SPACK_ENV} > /etc/profile.d/z10_spack_environment.sh
+EOF
+## Fixup /opt/detector/epic-git.fcf90937193c983c0af2acf1251e01f2e2c3a259_main
+RUN <<EOF
+set -e
+shopt -s nullglob
+cd /opt/detector
+for detector in epic-git.*_* ; do
+  ln -s ${detector} epic-${detector/*_/}
+done
+EOF
+## Fill jug_info
+RUN <<EOF
+set -e
+spack debug report | sed "s/^/ - /" | sed "s/\* \*\*//" | sed "s/\*\*//" >> /etc/jug_info
+spack find --no-groups --long --variants | sed "s/^/ - /" >> /etc/jug_info
+spack graph --dot > /opt/spack-environment/env.dot
+EOF
+## Copy custom content
+COPY eic-shell /opt/local/bin/eic-shell
+COPY eic-info /opt/local/bin/eic-info
+COPY entrypoint.sh /opt/local/sbin/entrypoint.sh
+COPY eic-env.sh /etc/eic-env.sh
+COPY profile.d/* /etc/profile.d
+COPY singularity.d /.singularity.d
+## set ROOT TFile forward compatibility
+RUN sed --in-place --follow-symlinks 's/# \(TFile.v630forwardCompatibility:\) no/\1 yes/' /opt/local/etc/root/system.rootrc
+## Setup ld.so.conf with what could go in LD_LIBRARY_PATH (but lower priority)
+## Ref: https://man7.org/linux/man-pages/man8/ld.so.8.html
+COPY <<EOF /etc/ld.so.conf.d/eic-shell.conf
+/opt/local/lib/root
+EOF
+RUN ldconfig
+## set the local spack configuration
+ENV SPACK_DISABLE_LOCAL_CONFIG="true"
+RUN <<EOF
+set -e
+spack config --scope site add "config:install_tree:root:~/spack"
+spack config --scope site add "config:source_cache:~/.spack/cache"
+spack config --scope site add "config:binary_index_root:~/.spack"
+spack config --scope site add "config:environments_root:~/.spack/env"
+spack config --scope site add "config:suppress_gpg_warnings:true"
+spack config blame config
+spack config --scope site add "upstreams:eic-shell:install_tree:/opt/software"
+spack config blame upstreams
+EOF
+## Install benchmarks into the container
+ARG BENCHMARK_COM_VERSION="master"
+ARG BENCHMARK_DET_VERSION="master"
+ARG BENCHMARK_REC_VERSION="master"
+ARG BENCHMARK_PHY_VERSION="master"
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/common_bench.git#${BENCHMARK_COM_VERSION} /opt/benchmarks/common_bench
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/detector_benchmarks.git#${BENCHMARK_DET_VERSION} /opt/benchmarks/detector_benchmarks
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/reconstruction_benchmarks.git#${BENCHMARK_REC_VERSION} /opt/benchmarks/reconstruction_benchmarks
+ADD https://eicweb.phy.anl.gov/EIC/benchmarks/physics_benchmarks.git#${BENCHMARK_PHY_VERSION} /opt/benchmarks/physics_benchmarks
+RUN <<EOF
+ln -sf ../common_bench /opt/benchmarks/detector_benchmarks/.local
+ln -sf ../common_bench /opt/benchmarks/reconstruction_benchmarks/.local
+ln -sf ../common_bench /opt/benchmarks/physics_benchmarks/.local
+EOF
+## Install campaigns into the container
+ARG CAMPAIGNS_HEPMC3_VERSION="main"
+ARG CAMPAIGNS_CONDOR_VERSION="main"
+ARG CAMPAIGNS_SLURM_VERSION="main"
+ADD https://github.com/eic/simulation_campaign_hepmc3.git#${CAMPAIGNS_HEPMC3_VERSION} /opt/campaigns/hepmc3
+ADD https://github.com/eic/job_submission_condor.git#${CAMPAIGNS_CONDOR_VERSION} /opt/campaigns/condor
+ADD https://github.com/eic/job_submission_slurm.git#${CAMPAIGNS_SLURM_VERSION} /opt/campaigns/slurm
+## make sure we have the entrypoints setup correctly
+ENTRYPOINT ["/opt/local/sbin/entrypoint.sh"]
+CMD ["bash", "--rcfile", "/etc/profile", "-l"]
+USER 0
+WORKDIR /
+SHELL ["/opt/local/bin/eic-shell"]
+## rucio config (unprivileged read-only account)
+COPY <<EOF /opt/rucio/etc/rucio.cfg
+[client]
+rucio_host = https://rucio-server.jlab.org:443
+auth_host = https://rucio-server.jlab.org:443
+auth_type = userpass
+username = eicread
+password = eicread
+[policy]
+package = eic_rucio_policy_package
+extract_scope = eic
+lfn2pfn_algorithm_default = eic
+EOF
+## eic-news
+COPY --chmod=0755 eic-news /opt/local/bin/eic-news
+## set the container version
+ARG EIC_CONTAINER_VERSION=1
+RUN echo -e "\n - jug_dev: ${EIC_CONTAINER_VERSION}" >> /etc/jug_info
+## Hotfix for misbehaving OSG nodes
+RUN mkdir /hadoop /localscratch
--- a/containers/eic/README.md
+++ b/containers/eic/README.md
+To build the container in this directory:
+```
+docker buildx build -f Dockerfile --build-context spack-environment=../../spack-environment .
+```
--- a/containers/eic/eic-env.sh
+++ b/containers/eic/eic-env.sh
+#!/bin/sh
+for i in /etc/profile.d/*.sh; do
+  if [ -r "$i" ]; then
+    . "$i"
+  fi
+done
+## default PS1 preamble in case we can't find better info
+PS1_PREAMBLE='eic-shell> '
+## try to guess who we are
+## note: we use sigils for the following cases:
+## - no sigil for nightly builds (jug_xl> )
+## - (*) for master builds     (jug_xl*> )
+## - (+) for stable (versioned) (jug_xl+> )
+## - (?) for unstable (MR)      (jug_xl?> )
+if [ -f /etc/jug_info ]; then
+  container=$(grep -e 'jug_' /etc/jug_info | tail -n 1 | awk '{print($2);}')
+  container=${container%:}              ## jug_xl
+  version=$(grep -e 'jug_' /etc/jug_info | tail -n 1 | awk '{print($3);}')
+  if [ -n "${container}" ]; then
+    case "${version}" in
+      *unstable*) sigil="?" ;;
+      *nightly*)  sigil="" ;;
+      *testing*)  sigil="*" ;;
+      *) sigil="+" ;;
+    esac
+    ps1_preamble="${container}${sigil}> "
+    export PS1_SIGIL=${sigil}
+    unset sigil
+  fi
+  unset version
+  unset container
+fi
+export PS1=${ps1_preamble}'\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
+export LS_COLORS='rs=0:di=01;34:ln=01;36:mh=00:pi=40;33'
+unset ps1_preamble
+## unset CURL_CA_BUNDLE and SSL_CERT_FILE if not accessible
+## inside container: this addresses certain HPC systems where
+## CURL_CA_BUNDLE and SSL_CERT_FILE are customized to point
+## to paths that do not exist inside this container
+if [ ! -r ${CURL_CA_BUNDLE:-/} ]; then
+  unset CURL_CA_BUNDLE
+fi
+if [ ! -r ${SSL_CERT_FILE:-/} ]; then
+  unset SSL_CERT_FILE
+fi
+## set CLING_STANDARD_PCH and CPPYY_API_PATH to `none` for cppyy
+export CLING_STANDARD_PCH='none'
+export CPPYY_API_PATH='none'
+## redefine ls and less as functions, as this is something we
+## can import into our plain bash --norc --noprofile session
+## (aliases cannot be transferred to a child shell)
+ls () {
+  /bin/ls --color=auto "$@"
+}
+less () {
+  /usr/bin/less -R "$@"
+}
+grep () {
+  /bin/grep --color=auto "$@"
+}
+MYSHELL=$(ps -p $$ | awk '{print($4);}' | tail -n1)
+## only export the functions for bash, as this does not work
+## in all shells and we only care about bash here. Note that
+## the singularity startup runs in plain sh which requires the
+## if statement
+if [ "$MYSHELL" = "bash" ]; then
+  export -f ls
+  export -f less
+  export -f grep
+fi
+unset MYSHELL
--- a/containers/eic/eic-info
+++ b/containers/eic/eic-info
+#!/bin/bash
+cat /etc/jug_info
--- a/containers/eic/eic-news
+++ b/containers/eic/eic-news
+#!/bin/bash
+news=$HOME/.eic-news
+hints=$HOME/.eic-hints
+# run only if stdin and sterr, when not hushlogin, and when opt-in
+if [[ -t 0 && -t 2 && ! -f $HOME/.hushlogin && -f $news ]] ; then
+  # ensure hints file exists (atime or mtime not checked)
+  touch $hints
+  # check if interactive shell (sourced) or else (eic-news explicitly invoked)
+  if [[ $- == *i* ]] ; then
+    # when sourced: print news at most once an hour
+    if [[ -z $(find $news -atime +1) ]] ; then
+      cat $news
+      echo
+      cat $hints | shuf | head -n1
+      echo
+      echo 'More news with `eic-news`; you can disable `eic-news` by creating `$HOME/.hushlogin`'
+    fi
+  else
+    # when invoked: print always
+    cat $news
+    echo
+    cat $hints | shuf | head -n1
+  fi
+  # update news at most once a day
+  if [[ -z $(find $news -mtime +24) ]] ; then
+    (&>/dev/null curl --silent --connect-timeout 5 --location https://eic.github.io/motd/index.html --output $news &)
+  fi
+  # update hints at most once a day
+  if [[ -z $(find $hints -mtime +24) ]] ; then
+    (&>/dev/null curl --silent --connect-timeout 5 --location https://eic.github.io/motd/hints.html --output $hints &)
+  fi
+fi
--- a/containers/release/eic-shell
+++ b/containers/release/eic-shell
-#! /usr/bin/env bash
+#!/usr/bin/env bash
-source /etc/profile
-## Force environment to be clean
-source /etc/eic-env.sh
+piped_args=()
 if [ -p /dev/stdin ]; then
  # If we want to read the input line by line
  while IFS= read line; do
-    if [ -z "$piped_args" ]; then
+    piped_args+=("${line}")
-      piped_args="${line}"
-    else 
-      piped_args="${piped_args}\n${line}"
-    fi
  done
 fi
-## Fire off bash
+## Properly setup environment
-if [ ${piped_args} ]  ; then
+. /etc/eic-env.sh
-  echo -e ${piped_args} | exec bash
+### Fire off bash
+if [ "${#piped_args[@]}" != "0" ]; then
+  printf "%s\n" "${piped_args[@]}" | bash -s -- --norc --noprofile
 elif [ $# -gt 0 ]; then
  exec bash -c "$@"
 else
-  exec bash
+  exec bash --norc --noprofile
 fi
No results found