Bookworm Base-image Upgrade

.azure-pipelines/docker-sonic-slave-template.yml

@@ -16,6 +16,7 @@ parameters:
 - name: dist
   type: string
   values:
+  - bookworm
   - bullseye
   - buster
   - stretch

.azure-pipelines/docker-sonic-slave.yml

@@ -8,7 +8,7 @@ resources:
   - repository: buildimage
     type: github
     name: sonic-net/sonic-buildimage
-    ref: master
+    ref: bookworm
     endpoint: sonic-net
 
 schedules:
@@ -44,6 +44,7 @@ parameters:
 - name: 'dists'
   type: object
   default:
+  - bookworm
   - bullseye
   - buster
   - stretch

Makefile

@@ -4,6 +4,7 @@ NOJESSIE ?= 1
 NOSTRETCH ?= 1
 NOBUSTER ?= 0
 NOBULLSEYE ?= 0
+NOBOOKWORM ?= 0
 
 override Q := @
 ifeq ($(QUIET),n)
@@ -29,6 +30,10 @@ ifeq ($(NOBULLSEYE),0)
 BUILD_BULLSEYE=1
 endif
 
+ifeq ($(NOBOOKWORM),0)
+BUILD_BOOKWORM=1
+endif
+
 PLATFORM_PATH := platform/$(if $(PLATFORM),$(PLATFORM),$(CONFIGURED_PLATFORM))
 PLATFORM_CHECKOUT := platform/checkout
 PLATFORM_CHECKOUT_FILE := $(PLATFORM_CHECKOUT)/$(PLATFORM).ini
@@ -47,9 +52,12 @@ ifeq ($(NOBUSTER), 0)
 	$(MAKE_WITH_RETRY) EXTRA_DOCKER_TARGETS=$(notdir $@) BLDENV=buster -f Makefile.work buster
 endif
 ifeq ($(NOBULLSEYE), 0)
-	$(MAKE_WITH_RETRY) BLDENV=bullseye -f Makefile.work $@
+	$(MAKE_WITH_RETRY) EXTRA_DOCKER_TARGETS=$(notdir $@) BLDENV=bullseye -f Makefile.work bullseye
 endif
-	BLDENV=bullseye $(MAKE) -f Makefile.work docker-cleanup
+ifeq ($(NOBOOKWORM), 0)
+	$(MAKE_WITH_RETRY) BLDENV=bookworm -f Makefile.work $@
+endif
+	BLDENV=bookworm $(MAKE) -f Makefile.work docker-cleanup
 
 jessie:
 	@echo "+++ Making $@ +++"
@@ -69,6 +77,12 @@ ifeq ($(NOBUSTER), 0)
 	$(MAKE) -f Makefile.work buster
 endif
 
+bullseye:
+	@echo "+++ Making $@ +++"
+ifeq ($(NOBUSTER), 0)
+	$(MAKE) -f Makefile.work bullseye
+endif
+
 init:
 	@echo "+++ Making $@ +++"
 	$(MAKE) -f Makefile.work $@
@@ -82,6 +96,7 @@ define make_work
 	$(if $(BUILD_STRETCH),BLDENV=stretch $(MAKE) -f Makefile.work $@,)
 	$(if $(BUILD_BUSTER),BLDENV=buster $(MAKE) -f Makefile.work $@,)
 	$(if $(BUILD_BULLSEYE),BLDENV=bullseye $(MAKE) -f Makefile.work $@,)
+	$(if $(BUILD_BOOKWORM),BLDENV=bookworm $(MAKE) -f Makefile.work $@,)
 endef
 
 .PHONY: $(PLATFORM_PATH)

Makefile.cache

@@ -78,7 +78,8 @@ SONIC_COMMON_DPKG_LIST  :=  debian/control debian/changelog debian/rules \
 SONIC_COMMON_BASE_FILES_LIST  := sonic-slave-jessie/Dockerfile.j2 sonic-slave-jessie/Dockerfile.user.j2 \
                                  sonic-slave-stretch/Dockerfile.j2 sonic-slave-stretch/Dockerfile.user.j2 \
                                  sonic-slave-buster/Dockerfile.j2 sonic-slave-buster/Dockerfile.user.j2 \
-                                 sonic-slave-bullseye/Dockerfile.j2 sonic-slave-bullseye/Dockerfile.user.j2
+                                 sonic-slave-bullseye/Dockerfile.j2 sonic-slave-bullseye/Dockerfile.user.j2 \
+                                 sonic-slave-bookworm/Dockerfile.j2 sonic-slave-bookworm/Dockerfile.user.j2
 
 
 

Makefile.work

@@ -69,6 +69,7 @@ USER := $(shell id -un)
 PWD := $(shell pwd)
 USER_LC := $(shell echo $(USER) | tr A-Z a-z)
 DOCKER_MACHINE := $(shell docker run --rm debian:buster uname -m)
+HOST_DOCKERD_GID := $(shell getent group docker | cut -d : -f3)
 
 comma := ,
 
@@ -121,7 +122,9 @@ else
 TARGET_BOOTLOADER = uboot
 endif
 
-ifeq ($(BLDENV), bullseye)
+ifeq ($(BLDENV), bookworm)
+SLAVE_DIR = sonic-slave-bookworm
+else ifeq ($(BLDENV), bullseye)
 SLAVE_DIR = sonic-slave-bullseye
 else ifeq ($(BLDENV), buster)
 SLAVE_DIR = sonic-slave-buster
@@ -184,6 +187,12 @@ INCLUDE_FIPS := n
 ENABLE_FIPS := n
 endif
 
+# FIPS not yet available on Bookworm
+ifeq ($(BLDENV),bookworm)
+$(warning FIPS support not yet available on Bookworm)
+INCLUDE_FIPS := n
+endif
+
 ifeq ($(INCLUDE_FIPS), n)
 ifeq ($(ENABLE_FIPS), y)
     $(error Cannot set fips config ENABLE_FIPS=y when INCLUDE_FIPS=n)
@@ -381,7 +390,7 @@ endif
 
 ifeq ($(SONIC_CONFIG_USE_NATIVE_DOCKERD_FOR_BUILD), y)
 ifneq ($(MULTIARCH_QEMU_ENVIRON), y)
-    DOCKER_RUN += -v /var/run/docker.sock:/var/run/docker.sock
+    DOCKER_RUN += -v /var/run/docker.sock:/var/run/docker.sock --group-add $(HOST_DOCKERD_GID)
 endif
 endif
 

README.md

@@ -131,6 +131,7 @@ pip3 install --user j2cli
   system to allow running the 'docker' command without 'sudo':
   * Add current user to the docker group: `sudo gpasswd -a ${USER} docker`
   * Log out and log back in so that your group membership is re-evaluated
+  * If you are using Linux kernel 5.3 or newer, then you must use Docker 20.10.10 or newer. This is because older Docker versions did not allow the `clone3` syscall, which is now used in Bookworm.
 
 > Note: If a previous installation of Docker using snap was present on the
 > system, remove it and also remove docker from snap before reinstallating docker.
@@ -187,9 +188,6 @@ The supported ASIC vendors are:
 
 ## Usage for ARM Architecture
 
-ARM build has dependency in docker version 18.
-If docker version is 19, downgrade to 18 with:
-
 ```shell
 sudo apt-get install --allow-downgrades -y docker-ce=5:18.09.0~3-0~ubuntu-xenial
 sudo apt-get install --allow-downgrades -y docker-ce-cli=5:18.09.0~3-0~ubuntu-xenial

azure-pipelines.yml

@@ -42,7 +42,7 @@ variables:
 - name: CACHE_MODE
   value: rcache
 - name: ENABLE_FIPS
-  value: y
+  value: n
 
 stages:
 - stage: BuildVS

build_debian.sh

@@ -31,9 +31,9 @@ set -x -e
 CONFIGURED_ARCH=$([ -f .arch ] && cat .arch || echo amd64)
 
 ## docker engine version (with platform)
-DOCKER_VERSION=5:24.0.2-1~debian.11~$IMAGE_DISTRO
+DOCKER_VERSION=5:24.0.2-1~debian.12~$IMAGE_DISTRO
 CONTAINERD_IO_VERSION=1.6.21-1
-LINUX_KERNEL_VERSION=5.10.0-23-2
+LINUX_KERNEL_VERSION=6.1.0-11-2
 
 ## Working directory to prepare the file system
 FILESYSTEM_ROOT=./fsroot
@@ -256,24 +256,19 @@ sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apparmor
 sudo cp files/image_config/ntp/ntp-apparmor $FILESYSTEM_ROOT/etc/apparmor.d/local/usr.sbin.ntpd
 sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apt-transport-https \
                                                        ca-certificates \
-                                                       curl \
-                                                       gnupg2 \
-                                                       software-properties-common
+                                                       curl
 if [[ $CONFIGURED_ARCH == armhf ]]; then
     # update ssl ca certificates for secure pem
     sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT c_rehash
 fi
 sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/docker.asc -fsSL https://download.docker.com/linux/debian/gpg
 sudo LANG=C chroot $FILESYSTEM_ROOT mv /tmp/docker.asc /etc/apt/trusted.gpg.d/
-sudo LANG=C chroot $FILESYSTEM_ROOT add-apt-repository \
-                                    "deb [arch=$CONFIGURED_ARCH] https://download.docker.com/linux/debian $IMAGE_DISTRO stable"
+sudo tee $FILESYSTEM_ROOT/etc/apt/sources.list.d/docker.list >/dev/null <<EOF
+deb [arch=$CONFIGURED_ARCH] https://download.docker.com/linux/debian $IMAGE_DISTRO stable
+EOF
 sudo LANG=C chroot $FILESYSTEM_ROOT apt-get update
 sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} containerd.io=${CONTAINERD_IO_VERSION}
 
-# Uninstall 'python3-gi' installed as part of 'software-properties-common' to remove debian version of 'PyGObject'
-# pip version of 'PyGObject' will be installed during installation of 'sonic-host-services'
-sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y remove software-properties-common gnupg2 python3-gi
-
 install_kubernetes () {
     local ver="$1"
     sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -fsSL \
@@ -375,6 +370,7 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
     sysfsutils              \
     squashfs-tools          \
     $bootloader_packages    \
+    rsyslog                 \
     screen                  \
     hping3                  \
     tcptraceroute           \
@@ -390,9 +386,9 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
     python3-pip             \
     python-is-python3       \
     cron                    \
-    libprotobuf23           \
+    libprotobuf32           \
     libgrpc++1              \
-    libgrpc10               \
+    libgrpc29               \
     haveged                 \
     fdisk                   \
     gpg                     \
@@ -401,11 +397,9 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
     linux-perf              \
     resolvconf              \
 	lsof                    \
-	sysstat
-
-# default rsyslog version is 8.2110.0 which has a bug on log rate limit,
-# use backport version
-sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -t bullseye-backports -y install rsyslog
+	sysstat                 \
+	xxd                     \
+	zstd
 
 # Have systemd create the auditd log directory
 sudo mkdir -p ${FILESYSTEM_ROOT}/etc/systemd/system/auditd.service.d
@@ -451,14 +445,6 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
     systemd-sysv \
     ntp
 
-# Workaround for issue: The udev rule may fail to be executed because the
-#                       daemon-reload command is executed in parallel
-# Github issue: https://github.com/systemd/systemd/issues/24668
-# Github PR: https://github.com/systemd/systemd/pull/24673
-# This workaround should be removed after a upstream already contains the fixes
-sudo patch $FILESYSTEM_ROOT/lib/systemd/system/systemd-udevd.service \
-    files/image_config/systemd/systemd-udevd/fix-udev-rule-may-fail-if-daemon-reload-command-runs.patch
-
 if [[ $TARGET_BOOTLOADER == grub ]]; then
     if [[ $CONFIGURED_ARCH == amd64 ]]; then
         GRUB_PKG=grub-pc-bin
@@ -535,13 +521,11 @@ done < files/image_config/sysctl/sysctl-net.conf
 
 sudo augtool --autosave "$sysctl_net_cmd_string" -r $FILESYSTEM_ROOT
 
-# Upgrade pip via PyPI and uninstall the Debian version
-sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install --upgrade pip
-sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get purge -y python3-pip
+# Specify that we want to explicitly install Python packages into the system environment, and risk breakages
+sudo cp files/image_config/pip/pip.conf $FILESYSTEM_ROOT/etc/pip.conf
 
 # For building Python packages
-sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install 'setuptools==49.6.00'
-sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install 'wheel==0.35.1'
+sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install python3-setuptools python3-wheel
 
 # docker Python API package is needed by Ansible docker module as well as some SONiC applications
 sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip3 install 'docker==6.1.1'
@@ -574,13 +558,12 @@ sudo cp files/dhcp/sethostname6 $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
 sudo cp files/dhcp/graphserviceurl $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
 sudo cp files/dhcp/snmpcommunity $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
 sudo cp files/dhcp/vrf $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
-if [ -f files/image_config/ntp/ntp ]; then
-    sudo cp ./files/image_config/ntp/ntp $FILESYSTEM_ROOT/etc/init.d/
+if [ -f files/image_config/ntp/ntpsec ]; then
+    sudo cp ./files/image_config/ntp/ntpsec $FILESYSTEM_ROOT/etc/init.d/
 fi
 
 if [ -f files/image_config/ntp/ntp-systemd-wrapper ]; then
-    sudo mkdir -p $FILESYSTEM_ROOT/usr/lib/ntp/
-    sudo cp ./files/image_config/ntp/ntp-systemd-wrapper $FILESYSTEM_ROOT/usr/lib/ntp/
+    sudo cp ./files/image_config/ntp/ntp-systemd-wrapper $FILESYSTEM_ROOT/usr/libexec/ntpsec/
 fi
 
 ## Version file part 1

device/mellanox/x86_64-mlnx_msn2700-r0/platform_wait

@@ -8,8 +8,9 @@ declare -r SYSLOG_INFO="info"
 
 declare -r HW_MGMT_CONFIG="/var/run/hw-management/config"
 
-declare -r MODULE_COUNTER="${HW_MGMT_CONFIG}/module_counter"
-declare -r SFP_COUNTER="${HW_MGMT_CONFIG}/sfp_counter"
+declare -r ASIC_INIT_DONE="${HW_MGMT_CONFIG}/asics_init_done"
+declare -r NUM_ASICS="${HW_MGMT_CONFIG}/asic_num"
+declare -r ASIC_CHIPUP_COMPLETED="${HW_MGMT_CONFIG}/asic_chipup_completed"
 
 declare -r EXIT_SUCCESS="0"
 declare -r EXIT_TIMEOUT="1"
@@ -26,44 +27,42 @@ function log_info() {
     eval "${SYSLOG_LOGGER} -t ${SYSLOG_IDENTIFIER} -p ${SYSLOG_INFO} $@"
 }
 
-function wait_for_sfp() {
-    local -r _NUM_MATCH="^[0-9]+$"
-    local -r _NUM_ZERO="0"
+function wait_for_asic_chipup() {
 
-    local _MODULE_CNT="0"
-    local _SFP_CNT="0"
+    local _ASIC_INIT="0"
+    local _ASIC_COUNT="0"
+    local _ASICS_CHIPUP="0"
 
     local -i _WDOG_CNT="1"
     local -ir _WDOG_MAX="300"
 
     local -r _TIMEOUT="1s"
 
     while [[ "${_WDOG_CNT}" -le "${_WDOG_MAX}" ]]; do
-        _MODULE_CNT="$(cat ${MODULE_COUNTER} 2>&1)"
-        _SFP_CNT="$(cat ${SFP_COUNTER} 2>&1)"
+        _ASIC_INIT="$(cat ${ASIC_INIT_DONE} 2>&1)"
+        _ASIC_COUNT="$(cat ${NUM_ASICS} 2>&1)"
+        _ASICS_CHIPUP="$(cat ${ASIC_CHIPUP_COMPLETED} 2>&1)"
 
-        if [[ "${_MODULE_CNT}" =~ ${_NUM_MATCH} && "${_SFP_CNT}" =~ ${_NUM_MATCH} ]]; then
-            if [[ "${_SFP_CNT}" -gt "${_NUM_ZERO}" && "${_MODULE_CNT}" -eq "${_SFP_CNT}" ]]; then
-                return "${EXIT_SUCCESS}"
-            fi
+        if [[ "${_ASIC_INIT}" -eq 1 && "${_ASIC_COUNT}" -eq "${_ASICS_CHIPUP}" ]]; then
+            return "${EXIT_SUCCESS}"
         fi
 
         let "_WDOG_CNT++"
         sleep "${_TIMEOUT}"
     done
 
+    log_error "Mellanox ASIC is not ready: INIT: ${_ASIC_INIT}, NUM_ASIC: ${_ASIC_COUNT}, CHIPUP: ${_ASICS_CHIPUP} timeout...."
     return "${EXIT_TIMEOUT}"
 }
 
-log_info "Wait for SFP interfaces to be ready"
+log_info "Wait for Mellanox ASIC to be ready"
 
-wait_for_sfp
+wait_for_asic_chipup
 EXIT_CODE="$?"
 if [[ "${EXIT_CODE}" != "${EXIT_SUCCESS}" ]]; then
-    log_error "SFP interfaces are not ready: timeout"
     exit "${EXIT_CODE}"
 fi
 
-log_info "SFP interfaces are ready"
+log_notice "Mellanox ASIC is ready"
 
 exit "${EXIT_SUCCESS}"

dockers/docker-sonic-mgmt-framework/Dockerfile.j2

@@ -8,8 +8,10 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
     apt-get install -y g++ python3-dev libxml2 libcurl3-gnutls libcjson-dev
 
+# Limited to grpcio 1.58.0 due to armhf 
 RUN pip3 install connexion==2.7.0 \
                  setuptools==21.0.0 \
+                 grpcio==1.58.0 \
                  grpcio-tools==1.20.0 \
                  certifi==2017.4.17 \
                  python-dateutil==2.6.0 \

files/apt/sources.list.j2

@@ -1,20 +1,26 @@
 # The configuration is generated by template
 # Please add additional sources in /etc/apt/sources.list.d
 
+{% if DISTRIBUTION == 'bookworm' -%}
+{%- set nonfree_component='non-free-firmware' -%}
+{%- else -%}
+{%- set nonfree_component='non-free' -%}
+{%- endif %}
+
 {% for mirror_url in MIRROR_URLS.split(',') %}
-deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }} main contrib non-free
-deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }} main contrib non-free
-deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-updates main contrib non-free
-deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-updates main contrib non-free
-deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-backports main contrib non-free
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }} main contrib {{ nonfree_component }}
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }} main contrib {{ nonfree_component }}
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-updates main contrib {{ nonfree_component }}
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-updates main contrib {{ nonfree_component }}
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-backports main contrib {{ nonfree_component }}
 {% endfor %}
 {% for mirror_url in MIRROR_SECURITY_URLS.split(',') %}
 {% set dist_separator='/' %}{% if 'packages.trafficmanager.net/debian' in mirror_url %}{% set dist_separator='_' %}{% endif %}
 {% if DISTRIBUTION == 'stretch' or DISTRIBUTION == 'buster' %}
 deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}{{ dist_separator }}updates main contrib non-free
 deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}{{ dist_separator }}updates main contrib non-free
 {% else %}
-deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-security main contrib non-free
-deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-security main contrib non-free
+deb [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-security main contrib {{ nonfree_component }}
+deb-src [arch={{ ARCHITECTURE }}] {{ mirror_url }} {{ DISTRIBUTION }}-security main contrib {{ nonfree_component }}
 {% endif %}
 {% endfor %}