summaryrefslogtreecommitdiffhomepage
path: root/build_docker.sh
AgeCommit message (Collapse)AuthorFilesLines
2025-10-02build_docker.sh: support including extra files (#17405)Tom Proctor1-0/+6
mkctr already has support for including extra files in the built container image. Wire up a new optional environment variable to thread that through to mkctr. The operator e2e tests will use this to bake additional trusted CAs into the test image without significantly departing from the normal build or deployment process for our containers. Updates tailscale/corp#32085 Change-Id: Ica94ed270da13782c4f5524fdc949f9218f79477 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-09-17docker: bump alpine v3.19 -> 3.22 (#17155)Tom Proctor1-1/+1
Updates #15328 Change-Id: Ib33baf8756b648176dce461b25169e079cbd5533 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-09cmd/{k8s-operator,k8s-proxy}: add kube-apiserver ProxyGroup type (#16266)Tom Proctor1-0/+18
Adds a new k8s-proxy command to convert operator's in-process proxy to a separately deployable type of ProxyGroup: kube-apiserver. k8s-proxy reads in a new config file written by the operator, modelled on tailscaled's conffile but with some modifications to ensure multiple versions of the config can co-exist within a file. This should make it much easier to support reading that config file from a Kube Secret with a stable file name. To avoid needing to give the operator ClusterRole{,Binding} permissions, the helm chart now optionally deploys a new static ServiceAccount for the API Server proxy to use if in auth mode. Proxies deployed by kube-apiserver ProxyGroups currently work the same as the operator's in-process proxy. They do not yet leverage Tailscale Services for presenting a single HA DNS name. Updates #13358 Change-Id: Ib6ead69b2173c5e1929f3c13fb48a9a5362195d8 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-07-04Dockerfile,build_docker.sh: add a note on how to build local images (#16471)Irbe Krumina1-0/+10
Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-06-03cmd/tsidp: add Docker image building support (#16078)Raj Singh1-0/+18
- Add tsidp target to build_docker.sh for standard Tailscale image builds - Add publishdevtsidp Makefile target for development image publishing - Remove Dockerfile, using standard build process - Include tsidp in depaware dependency tracking - Update README with comprehensive Docker usage examples This enables tsidp to be built and published like other Tailscale components (tailscale/tailscale, tailscale/k8s-operator, tailscale/k8s-nameserver). Fixes #16077 Signed-off-by: Raj Singh <raj@tailscale.com>
2025-03-26build_docker.sh: bump default base image (#15432)Irbe Krumina1-1/+1
We now have a tailscale/alpine-base:3.19 use that as the default base image. Updates tailscale/tailscale#15328 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-29Makefile,./build_docker.sh: update kube operator image build target name ↵Irbe Krumina1-1/+1
(#14251) Updates tailscale/corp#24540 Updates tailscale/tailscale#12914 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-11-12go.{mod,sum},build_docker.sh: bump mkctr, add ability to set OCI annotations ↵Irbe Krumina1-0/+11
for images (#14065) Updates tailscale/tailscale#12914 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-10-15hostinfo,build_docker.sh,tailcfg: more reliably detect being in a container ↵Tom Proctor1-0/+2
(#13826) Our existing container-detection tricks did not work on Kubernetes, where Docker is no longer used as a container runtime. Extends the existing go build tags for containers to the other container packages and uses that to reliably detect builds that were created by Tailscale for use in a container. Unfortunately this doesn't necessarily improve detection for users' custom builds, but that's a separate issue. Updates #13825 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2024-07-30build_docker.sh: update script comment (#12970)Irbe Krumina1-16/+6
It is no longer correct to state that we don't support running Tailscale in containers or on Kubernetes. Updates tailscale/tailscale#12842 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-07-17hostinfo: set Hostinfo.PackageType for mkctr container buildsBrad Fitzpatrick1-1/+1
Fixes tailscale/corp#21448 Change-Id: Id60fb5cd7d31ef94cdbb176141e034845a480a00 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-30cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make ↵Irbe Krumina1-0/+16
operator deploy it (#11919) * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-17ipn/store: omit AWS & Kubernetes support on 'small' Linux GOARCHesBrad Fitzpatrick1-0/+1
This removes AWS and Kubernetes support from Linux binaries by default on GOARCH values where people don't typically run on AWS or use Kubernetes, such as 32-bit mips CPUs. It primarily focuses on optimizing for the static binaries we distribute. But for people building it themselves, they can set ts_kube or ts_aws (the opposite of ts_omit_kube or ts_omit_aws) to force it back on. Makes tailscaled binary ~2.3MB (~7%) smaller. Updates #7272, #10627 etc Change-Id: I42a8775119ce006fa321462cb2d28bc985d1c146 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-08Revert "cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube ↵Irbe Krumina1-16/+0
nameserver, make operator deploy it (#11017)" (#11669) Temporarily reverting this PR to avoid releasing half finished featue. This reverts commit 9e2f58f8461b32d5970f2680beda13153196ce46. Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-03-27cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make ↵Irbe Krumina1-0/+16
operator deploy it (#11017) * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator/deploy/crds,k8s-operator: add DNSConfig CustomResource Definition DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator,k8s-operator: optionally reconcile nameserver resources Adds a new reconciler that reconciles DNSConfig resources. If a DNSConfig is deployed to cluster, the reconciler creates kube nameserver resources. This reconciler is only responsible for creating nameserver resources and not for populating nameserver's records. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/{k8s-operator,k8s-nameserver}: generate DNSConfig CRD for charts, append to static manifests Signed-off-by: Irbe Krumina <irbe@tailscale.com> --------- Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-03-08Code Improvements (#11311)panchajanya1-3/+3
build_docker, update-flake: cleanup and apply shellcheck fixes Was editing this file to match my needs while shellcheck warnings bugged me out. REV isn't getting used anywhere. Better remove it. Updates #cleanup Signed-off-by: Panchajanya1999 <kernel@panchajanya.dev> Signed-off-by: James Tucker <james@tailscale.com>
2024-01-10Makefile,build_docker.sh: allow to configure target platform. (#10806)Irbe Krumina1-0/+3
Build dev tailscale and k8s-operator images for linux/amd64 only by default, make it possible to configure target build platform via PLATFORM var. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2023-12-11ALPINE.txt,Dockerfile{.base},build_docker.sh: bump alpine (#10543)Irbe Krumina1-1/+1
Bump alpine base image version used to build tailscale/tailscale and tailscale/k8s-operator images 3.16 -> 3.18 Updates #cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2023-02-14Dockerfile: fix docker buildDavid Anderson1-6/+6
The stamp vars got renamed and I forgot to update these scripts. Signed-off-by: David Anderson <danderson@tailscale.com>
2023-02-11version: unexport all vars, turn Short/Long into funcsDavid Anderson1-6/+6
The other formerly exported values aren't used outside the package, so just unexport them. Signed-off-by: David Anderson <danderson@tailscale.com>
2023-01-27build_docker.sh: use docker hub for base image hosting.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
2023-01-27build_docker.sh: set good repo defaults based on the target.David Anderson1-4/+7
Signed-off-by: David Anderson <danderson@tailscale.com>
2023-01-27build_docker.sh: don't push to ghcr by default.David Anderson1-1/+1
Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-13Makefile: add a target for doing dev builds of the k8s operator.David Anderson1-14/+37
Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-11-03cmd/containerboot: PID1 for running tailscaled in a container.David Anderson1-3/+3
This implements the same functionality as the former run.sh, but in Go and with a little better awareness of tailscaled's lifecycle. Also adds TS_AUTH_ONCE, which fixes the unfortunate behavior run.sh had where it would unconditionally try to reauth every time if you gave it an authkey, rather than try to use it only if auth is actually needed. This makes it a bit nicer to deploy these containers in automation, since you don't have to run the container once, then go and edit its definition to remove authkeys. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-06-29Dockerfile: bump alpine to 3.16Maisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-06-07build_docker.sh: add run.sh as an entrypoint to the docker imageMaisem Ali1-1/+3
Fixes #4071 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-06-01build_docker.sh: pin github.com/tailscale/mkctrMaisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-01-04tool/go: add wrapper to download and use go.toolchain.rev go version.Maisem Ali1-0/+3
Also update build_dist.sh and build_docker.sh to use the wrapper. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-01-03build_docker.sh: add env overridesMaisem Ali1-4/+12
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-12-03build_docker.sh: prefix version strings with `v`Maisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-11-22build_docker.sh: use github.com/tailscale/mkctr instead of dockerMaisem Ali1-5/+12
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-10-13docs/k8s: add instructions on how to run as a sidecar or a proxy.Maisem Ali1-1/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-10-12Dockerfile, build_docker: change Docker warningMaya Kaczorowski1-10/+4
Signed-off-by: Maya Kaczorowski <15946341+mayakacz@users.noreply.github.com>
2021-07-07build_docker.sh: use build_dist.sh to inject version informationIrshad Pananilath1-1/+1
version.sh was removed in commit 5088af68. Use `build_dist.sh shellvars` to provide version information instead. Signed-off-by: Irshad Pananilath <pmirshad+code@gmail.com>
2021-03-05build_docker.sh, Dockerfile: fix bug with shell quotingSteve Coffman1-2/+5
Fixes #1449 Signed-off-by: Steve Coffman <steve@khanacademy.org>
2021-01-21Add docker build script to inject version informationSteve Coffman1-0/+31
Signed-off-by: Steve Coffman <steve@khanacademy.org>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.