[docker] consolidate dockerfiles

This allows us to parameterise later layers on earlier ones.

In practice, I want to use this to avoid rebuilding the `base` layer in
PR and merge queue runs, building it only on `main` and release branches
and tags. As a drive-by bonus, this means we can cache the `base` and
`build` layers for reuse when building the `test` layer.

I've also added a hook to allow building from a local working copy. (By
providing an EC_REPO argument when building the `test` target.) This
should allow us to pre-build the test image once and for all for all
post-build checks. (Using `.` as EC_REPO, perhaps—haven't really thought
that far.)

Author: fdupress

scripts/docker/Dockerfile.build scripts/docker/Dockerfilescripts/docker/Dockerfile.build renamed to scripts/docker/Dockerfile

@@ -1,6 +1,43 @@
-# syntax = devthefuture/dockerfile-x
+ARG BASE_LAYER=base
+ARG BASE_BUILD_LAYER=base-build
+ARG BUILD_LAYER=build
 
-FROM ./Dockerfile.base as base-build
+# Base environment
+FROM debian:stable AS base
+
+LABEL org.opencontainers.image.maintainer="Pierre-Yves Strub <pierre-yves@strub.nu>"
+
+ARG user=charlie
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN \
+	apt-get -q -y update && \
+	apt-get -q -y upgrade && \
+	apt-get -q -y install sudo && \
+	apt-get -q -y clean
+
+COPY --chown=root:root --chmod=0400 docker-parts/sudoers /etc/sudoers.d/
+
+RUN \
+	useradd -ms /bin/bash -d /home/$user -g root -G sudo -u 1001 $user
+
+RUN \
+	apt-get -q -y install opam && \
+	apt-get -q -y clean
+
+USER    $user
+WORKDIR /home/$user
+
+ENV OPAMYES=true OPAMVERBOSE=0 OPAMJOBS=4
+
+ARG OCAML_VERSION=4.14.2
+
+RUN \
+	opam init --disable-sandboxing --compiler=ocaml-base-compiler.${OCAML_VERSION}
+
+# Build environment
+FROM ${BASE_LAYER} AS base-build
 
 RUN \
 	sudo apt-get -q -y install wget curl python3 python3-pip python3-yaml && \
@@ -13,6 +50,8 @@ RUN \
 
 ENV PATH="/home/charlie/bin:$PATH"
 
+FROM ${BASE_BUILD_LAYER} AS build
+
 RUN \
 	version=2.6.3 && \
   wget -O alt-ergo https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-v${version}-x86_64-linux-musl && \
@@ -25,8 +64,6 @@ RUN \
   sudo install -m 0755 alt-ergo /usr/local/bin/alt-ergo-${version} && \
   rm -f alt-ergo
 
-FROM base-build as main-linux-amd64
-
 RUN \
 	version=1.8 && \
 	wget -O cvc4 https://github.com/CVC4/CVC4-archived/releases/download/${version}/cvc4-${version}-x86_64-linux-opt && \
@@ -102,7 +139,16 @@ RUN \
 	sudo install -m 0755 z3 /usr/local/bin/z3-${version} && \
 	rm -f z3 z3.zip
 
-FROM main-linux-amd64
-
 RUN \
 	opam exec -- why3 config detect
+
+# Test environment
+FROM ${BUILD_LAYER} AS test
+
+ARG EC_VERSION=main
+ARG EC_REPO=https://github.com/EasyCrypt/easycrypt.git#${EC_VERSION}
+
+RUN \
+	opam pin add -n easycrypt ${EC_REPO} && \
+	opam install -v easycrypt && \
+	rm -rf .opam/packages.dev/*

scripts/docker/Dockerfile.base

@@ -3,15 +3,16 @@
 # --------------------------------------------------------------------
 VARIANT ?= build
 TAG     ?= main
-BARGS   += --build-arg EC_VERSION=$(TAG)
+VERSION ?= $(TAG)
+BARGS   += --build-arg EC_VERSION=$(VERSION)
 
 # --------------------------------------------------------------------
 .PHONY: default build publish
 
 default: build
 
 build:
-	docker build -f Dockerfile.$(VARIANT) \
+	docker build --target $(VARIANT) \
 	  --platform linux/amd64 \
 	  $(BARGS) \
 	  -t ghcr.io/easycrypt/ec-$(VARIANT)-box:$(TAG) \