Skip to content

  Add s390x Support for Cloudstack Simulator #12337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
viddya673 wants to merge 4 commits into
base: main
Choose a base branch
from
+91 −0
Open

  Add s390x Support for Cloudstack Simulator #12337

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
89054ea
Adding s390x dockerfile support for cloudstack simulator
viddya673 Dec 23, 2025
8893ace
Merge branch 'apache:main' into s390x_cloudstack_simulator_support
viddya673 Dec 23, 2025
51d38cb
Merge branch 'apache:main' into s390x_cloudstack_simulator_support
viddya673 Jan 13, 2026
89ba48b
docker: address review comments in s390x Dockerfile
Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 91 additions & 0 deletions tools/docker/Dockerfile.s390x
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#
# CloudStack-simulator build

FROM ubuntu:22.04
Copy link
Contributor

@sureshanaparti sureshanaparti Dec 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
FROM ubuntu:22.04
FROM ubuntu:24.04

@viddya673 can use ubuntu 24.04 instead of 22.04?

Copy link
Contributor Author

@viddya673 viddya673 Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We tried upgrading the base image to Ubuntu 24.04, but this resulted in build issues due to dependencies that require a newer version of Python; on s390x, installing a newer Python version typically involves building it from source because suitable prebuilt packages are not readily available, which would significantly increase the image size and introduce additional build complexity and maintenance overhead. To avoid this and maintain a stable, reproducible build environment, we have retained Ubuntu 22.04 as the base image, as it provides well‑supported system libraries and Python versions for s390x while keeping the image lean and manageable.


LABEL Vendor="Apache.org" License="ApacheV2" Version="4.23.0.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"

ARG DEBIAN_FRONTEND=noninteractive

RUN apt-get -y update && apt-get install -y \
genisoimage \
libffi-dev \
libssl-dev \
curl \
gcc-10 \
git \
sudo \
ipmitool \
iproute2 \
maven \
openjdk-11-jdk \
python3-dev \
python-is-python3 \
python3-setuptools \
python3-pip \
python3-mysql.connector \
# Required on s390x as pre-built wheels for bcrypt, cryptography, and cffi are unavailable, necessitating source builds.
python3-bcrypt \
python3-cryptography \
python3-cffi \
supervisor

RUN apt-get install -qqy mysql-server && \
apt-get clean all && \
mkdir -p /var/run/mysqld; \
chown mysql /var/run/mysqld

RUN echo '''sql_mode = "STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION"''' >> /etc/mysql/mysql.conf.d/mysqld.cnf

COPY tools/docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY . ./root
WORKDIR /root

RUN mvn -Pdeveloper -Dsimulator -DskipTests clean install

RUN find /var/lib/mysql -type f -exec touch {} \; && \
(/usr/bin/mysqld_safe &) && \
sleep 5; \
mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password by ''" --connect-expired-password; \
mvn -Pdeveloper -pl developer -Ddeploydb; \
mvn -Pdeveloper -pl developer -Ddeploydb-simulator; \
MARVIN_FILE=`find /root/tools/marvin/dist/ -name "Marvin*.tar.gz"`; \
rm -rf /usr/bin/s390x-linux-gnu-gcc && \
ln -s /usr/bin/gcc-10 /usr/bin/s390x-linux-gnu-gcc && \
pip3 install maturin && \
pip3 install $MARVIN_FILE

RUN apt-get install -y nodejs npm build-essential python3 g++ make

RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.4/install.sh | bash && \
Copy link

Copilot AI Dec 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.4/install.sh | bash pattern downloads and executes remote shell code during the image build without any integrity or authenticity verification. If the nvm-sh repository or the delivery path is compromised, an attacker can serve a malicious script that will execute with full privileges inside the build, allowing them to backdoor the resulting simulator image. Prefer installing Node.js and related tooling from distribution packages or a vendored, checksummed artifact, or at minimum verify a cryptographic checksum or signature of the script before execution.

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@viddya673 viddya673 Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On s390x, installing Node.js via NVM remains the most reliable and supported option due to limited availability of distribution packages and inconsistent prebuilt Node.js binaries for this architecture. The installer is fetched from a pinned, immutable release tag (v0.39.4) over HTTPS from a widely used and publicly audited open‑source repository. The script executes only at image build time, introduces no runtime network dependency, and is not retained in the final image. Alternatives such as compiling Node.js or Python from source or maintaining custom vendor binaries would significantly increase image size, build time, and maintenance complexity, and would negatively impact reproducibility on s390x. Given these platform constraints and the controlled nature of the build process, retaining this installation method represents a measured and proportionate risk.

. /root/.nvm/nvm.sh && \
nvm install 16 && \
nvm use 16 && \
NVM_BIN="$(dirname "$(nvm which node)")" && \
ln -sf "$NVM_BIN/node" /usr/local/bin/node && \
ln -sf "$NVM_BIN/npm" /usr/local/bin/npm && \
cd ui && npm rebuild node-sass && npm install


VOLUME /var/lib/mysql

EXPOSE 8080 8096 5050

CMD ["/usr/bin/supervisord"]

Loading