justinzeus/wolfskin
1
0
Fork 0
Code Issues 2 Pull requests 4 Releases 3 Packages Activity

Serialize Gradle containers sharing a cache volume
All checks were successful
review/code-claude Approve: lock held across container, no deadlock, releases on all exits

Browse source
This commit is contained in:
justinzeus 2026-10-27 15:30:44 +01:00
parent 761a5a6145
commit 221f623c87
2 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docker/README.md
View file

@ -1,7 +1,8 @@
# Wolfskin TV container builds # Wolfskin TV container builds
Run from a full Git checkout with the upstream `v*` and `p*` tags available. The Run from a full Git checkout with the upstream `v*` and `p*` tags available. The
host needs Docker, GNU Make, Bash, and Git, not Java or the Android SDK. host needs Docker, GNU Make, Bash, Git, and `flock` (util-linux), not Java or the
Android SDK.
```sh ```sh
git fetch origin --tags git fetch origin --tags
@ -46,6 +47,15 @@ Override `WOLFSKIN_BUILD_IMAGE` to change the locally built image tag and
`WOLFSKIN_GRADLE_VOLUME` to isolate a cache. `make build-image` builds only the `WOLFSKIN_GRADLE_VOLUME` to isolate a cache. `make build-image` builds only the
image. Do not delete shared caches during another build. image. Do not delete shared caches during another build.
Every Gradle container holds a host-side exclusive lock for its entire run.
Concurrent targets sharing a cache queue rather than timing out on Gradle's
cross-container cache journal lock; a waiting invocation prints one line.
The default lock is `/var/tmp/${WOLFSKIN_GRADLE_VOLUME}.gradle.lock` (using
`wolfskin-gradle` when unset). Override `WOLFSKIN_GRADLE_LOCK_FILE` with a path
whose parent directory already exists. All callers sharing a volume must use
the same lock path on the Docker host. Do not delete the file while builds are
running or waiting. The lock releases automatically when the invocation exits.
## Release credentials ## Release credentials
The default escrow is The default escrow is

6
docker/gradle.sh
View file

@ -8,6 +8,12 @@ git_common=$(git rev-parse --path-format=absolute --git-common-dir)
image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21} image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle} cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin} secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
lock=${WOLFSKIN_GRADLE_LOCK_FILE:-/var/tmp/${cache}.gradle.lock}
exec {lock_fd}>"$lock"
if ! flock --exclusive --nonblock "$lock_fd"; then
printf 'Waiting for Gradle cache lock: %s\n' "$lock" >&2
flock --exclusive "$lock_fd"
fi
arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)" arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
--mount "type=bind,src=$root,dst=$root" --workdir "$root" --mount "type=bind,src=$root,dst=$root" --workdir "$root"
--mount "type=volume,src=$cache,dst=/gradle" --mount "type=volume,src=$cache,dst=/gradle"