Cloning active branches in Dockerfile

[vy]

I see many project Dockerfiles clone an actively developed branch:

RUN git clone --depth 1 https://github.com/apache/commons-cli.git 

This creates an image that one cannot update to align with the most recent changes in the external repository. That is, docker build will not update the image even if https://github.com/apache/commons-cli is updated. Shouldn't this cloning operation be a part of build.sh instead? Or, put another way, how can I make sure docker build -t foo . && docker run -it foo always generates fuzzer scripts using the tip of the remote code base?

[DaveLak]

I believe the project Docker images are re-built once daily by default, and the RUN git clone command will fetch whatever is at the tip of the remote branch at that time.

To continue with your https://github.com/apache/commons-cli example, we can look at the last two commits on the master branch and search for their SHAs in the build logs listed on the OSS-Fuzz build status dashboard.

At the time of writing, the two latest commits to https://github.com/apache/commons-cli/tree/master branch are:

• Aug 23, 2024: apache/commons-cli@c9e543d
• Aug 21, 2024: apache/commons-cli@cc3d5be

If you search for the commit hash in the build logs for each day, you'll find:

• Build e1543b70-fcd5-4f9a-9109-c37c0b0b23b9
  Completed on 8/22/2024 at 2:07:33 AM (EDT)
  Includes commit cc3d5be66bbe3dffbc2b1f00cefda35c05698e22

• Build 280dcd05-b811-4ba7-9256-92f9084f31d9
  Completed on 8/23/2024 at 2:29:06 AM (EDT)
  Includes commit cc3d5be66bbe3dffbc2b1f00cefda35c05698e22 (the build must have started before the commit landed in master)

• Build f9bef852-93d2-457c-902d-d971c0c260a2
  Completed on 8/24/2024 at 2:24:53 AM (EDT)
  Includes commit c9e543d2c94147ae78d920b266789d6c22827d94, but not cc3d5be66bbe3dffbc2b1f00cefda35c05698e22

[vy]

You're right, Docker images are re-built daily, which is a ClusterFuzz behaviour. Though for maintainers trying to run fuzz tests locally, this becomes an implicit extra step they need to be aware of. That is, unless they explicitly do a python infra/helper.py build_image beforehand, python infra/helper.py build_fuzzers will use the last build image and this can produce results not matching the ones reported by ClusterFuzz. Hence, IMHO, documentation should advise as a best practice to place git clone-like ephemeral resource population to build.sh and keep Dockerfile as stable as possible.