Fix Docker build to support current Ubuntu

docker/Dockerfile

@@ -1,3 +1,29 @@
+FROM --platform=linux/amd64 ubuntu:rolling AS trafficserver-build
+
+# Rolling Ubuntu no longer packages ATS. Build a verified upstream release in a
+# separate stage so its compiler and development dependencies stay out of the image.
+ARG ATS_VERSION=10.2.0
+ARG ATS_SHA512=afdd02ea6b37dc344e24e985727add89e26d0bbce4ac7f91f2c51134c8219484d6739d9b5c7c4c177f913cd0a9f756cbc0c89bcb06ee21bc159c32046e38379e
+ARG ATS_BUILD_JOBS=4
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    build-essential ca-certificates cmake curl ninja-build pkg-config \
+    libcap-dev libpcre2-dev libssl-dev zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src/trafficserver
+RUN curl -fL --retry 3 "https://archive.apache.org/dist/trafficserver/trafficserver-${ATS_VERSION}.tar.bz2" -o ats.tar.bz2 \
+    && echo "${ATS_SHA512}  ats.tar.bz2" | sha512sum -c - \
+    && tar -xjf ats.tar.bz2 --strip-components=1 \
+    && cmake -S . -B build -G Ninja \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX=/opt/trafficserver \
+    -DWITH_USER=trafficserver -DWITH_GROUP=trafficserver \
+    -DBUILD_REGRESSION_TESTING=OFF -DBUILD_TESTING=OFF \
+    && cmake --build build --parallel "${ATS_BUILD_JOBS}" \
+    && DESTDIR=/opt/ats-install cmake --install build
+
 FROM --platform=linux/amd64 ubuntu:rolling
 LABEL maintainer="Mark Nottingham <mnot@mnot.net>"
 
@@ -9,7 +35,7 @@ RUN apt-get update \
     nodejs npm git openssh-client telnet \
     squid \
     nginx \
-    trafficserver \
+    libcap2 libpcre2-8-0 libssl3t64 zlib1g \
     apache2 \
     varnish \
     golang \
@@ -20,7 +46,9 @@ RUN apt-get update \
 
 # squid
 
-COPY squid/squid.conf /etc/squid/conf.d/cache-test.conf
+# Use the test configuration directly. Ubuntu's default access rules run before
+# conf.d and reject the link-local origin address used by rootless Podman.
+COPY squid/squid.conf /etc/squid/squid.conf
 
 ENV SQUID_CACHE_DIR=/var/spool/squid
 ENV SQUID_LOG_DIR=/var/log/squid
@@ -37,12 +65,16 @@ EXPOSE 8002
 
 # trafficserver
 
-COPY trafficserver/ip_allow.config /etc/trafficserver/ip_allow.config
-COPY trafficserver/records.config /etc/trafficserver/records.config
-COPY trafficserver/remap.config /etc/trafficserver/remap.config
+COPY --from=trafficserver-build /opt/ats-install/opt/trafficserver/ /opt/trafficserver/
+RUN groupadd --system trafficserver \
+    && useradd --system --gid trafficserver --home-dir /opt/trafficserver/var/trafficserver \
+    --shell /usr/sbin/nologin trafficserver
+COPY trafficserver/ip_allow.yaml /opt/trafficserver/etc/trafficserver/ip_allow.yaml
+COPY trafficserver/records.yaml /opt/trafficserver/etc/trafficserver/records.yaml
+COPY trafficserver/remap.config /opt/trafficserver/etc/trafficserver/remap.config
 
-ENV TS_CACHE_DIR=/var/run/trafficserver
-ENV TS_LOG_DIR=/var/log/trafficserver
+ENV TS_CACHE_DIR=/opt/trafficserver/var/trafficserver
+ENV TS_LOG_DIR=/opt/trafficserver/var/log/trafficserver
 ENV TS_USER=trafficserver
 EXPOSE 8003
 

docker/entrypoint.sh

@@ -5,14 +5,14 @@
 if [[ ! -z $1 ]] ; then
 
     # squid
-    sed -i s/localhost/$1/g /etc/squid/conf.d/cache-test.conf
+    sed -i s/localhost/$1/g /etc/squid/squid.conf
 
     # nginx
     sed -i s/localhost/$1/g /etc/nginx/sites-enabled/cache-test.conf
     sed -i s/worker_connections 768/worker_connections 2048/ /etc/nginx/nginx.conf
 
     # trafficserver
-    sed -i s/localhost:8000/$1:8000/g /etc/trafficserver/remap.config
+    sed -i s/localhost:8000/$1:8000/g /opt/trafficserver/etc/trafficserver/remap.config
 
     # apache
     sed -i s/localhost/$1/g /etc/apache2/sites-enabled/cache-test.conf

docker/serve.sh

@@ -7,7 +7,7 @@ echo "* Starting nginx"
 /usr/sbin/nginx -g "daemon off;" &
 
 echo "* starting TrafficServer"
-/usr/bin/traffic_manager &
+/opt/trafficserver/bin/traffic_server &
 
 echo "* Starting Apache"
 source /etc/apache2/envvars

docker/trafficserver/ip_allow.yaml

@@ -0,0 +1,10 @@
+# Allow the test harness to exercise every HTTP method through the reverse proxy.
+ip_allow:
+  - apply: in
+    ip_addrs: 0/0
+    action: allow
+    methods: ALL
+  - apply: in
+    ip_addrs: ::/0
+    action: allow
+    methods: ALL

docker/trafficserver/records.yaml

@@ -0,0 +1,97 @@
+# ATS 10 configuration; retain the test settings from records.config.
+# Container runtimes put host.docker.internal in /etc/hosts, not DNS.
+records:
+  exec_thread:
+    autoconfig:
+      enabled: 1
+      scale: 1.5
+    limit: 2
+    affinity: 1
+  accept_threads: 1
+  task_threads: 2
+  cache:
+    threads_per_disk: 8
+    ram_cache:
+      size: -1
+    ram_cache_cutoff: 4194304
+    limits:
+      http:
+        max_alts: 5
+    max_doc_size: 0
+    min_average_object_size: 8000
+  http:
+    server_ports: "8003"
+    insert_request_via_str: 1
+    insert_response_via_str: 0
+    parent_proxy:
+      retry_time: 300
+    forward:
+      proxy_auth_to_parent: 0
+    uncacheable_requests_bypass_parent: 1
+    keep_alive_no_activity_timeout_in: 120
+    keep_alive_no_activity_timeout_out: 120
+    transaction_no_activity_timeout_in: 30
+    transaction_no_activity_timeout_out: 30
+    transaction_active_timeout_in: 900
+    transaction_active_timeout_out: 0
+    accept_no_activity_timeout: 120
+    connect_attempts_max_retries: 3
+    connect_attempts_max_retries_suspect_server: 1
+    connect_attempts_rr_retries: 3
+    connect_attempts_timeout: 30
+    down_server:
+      cache_time: 60
+    negative_caching_enabled: 0
+    negative_caching_lifetime: 1800
+    insert_client_ip: 1
+    insert_squid_x_forwarded_for: 1
+    push_method_enabled: 0
+    cache:
+      http: 1
+      ignore_client_cc_max_age: 1
+      cache_responses_to_cookies: 1
+      cache_urls_that_look_dynamic: 1
+      when_to_revalidate: 0
+      required_headers: 2
+      heuristic_min_lifetime: 3600
+      heuristic_max_lifetime: 86400
+      heuristic_lm_factor: 0.1
+    normalize_ae: 1
+    slow:
+      log:
+        threshold: 0
+  hostdb:
+    host_file:
+      path: "/etc/hosts"
+  net:
+    default_inactivity_timeout: 86400
+    connections_throttle: 30000
+    max_connections_in: 30000
+  log:
+    logging_enabled: 3
+    max_space_mb_for_logs: 25000
+    max_space_mb_headroom: 1000
+    rolling_enabled: 1
+    rolling_interval_sec: 86400
+    rolling_size_mb: 10
+    auto_delete_rolled_files: 1
+    periodic_tasks_interval: 5
+  url_remap:
+    remap_required: 1
+    pristine_host_hdr: 1
+  reverse_proxy:
+    enabled: 1
+  ssl:
+    client:
+      CA:
+        cert:
+          filename: null
+    server:
+      cipher_suite: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+  diags:
+    debug:
+      enabled: 0
+      tags: "http|dns"
+  dump_mem_info_frequency: 0
+  admin:
+    user_id: "trafficserver"