From ee3bb03086bf84965550b20eec3ae79c62e09188 Mon Sep 17 00:00:00 2001
From: Matthieu Baerts <matttbe@kernel.org>
Date: Wed, 6 May 2026 15:43:49 +0200
Subject: [PATCH 1/5] docker: move to a subdirectory

In preparation to new images.

Note that this image is outdated: various packages are missing to run
ingest_mdir.py.

Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
---
 docker/{ => debian}/.dockerignore | 0
 docker/{ => debian}/.gitignore    | 0
 docker/{ => debian}/Dockerfile    | 0
 docker/{ => debian}/README.rst    | 0
 docker/{ => debian}/config.dist   | 0
 docker/{ => debian}/nipa.config   | 0
 docker/{ => debian}/results.sh    | 0
 docker/{ => debian}/run.sh        | 2 +-
 8 files changed, 1 insertion(+), 1 deletion(-)
 rename docker/{ => debian}/.dockerignore (100%)
 rename docker/{ => debian}/.gitignore (100%)
 rename docker/{ => debian}/Dockerfile (100%)
 rename docker/{ => debian}/README.rst (100%)
 rename docker/{ => debian}/config.dist (100%)
 rename docker/{ => debian}/nipa.config (100%)
 rename docker/{ => debian}/results.sh (100%)
 rename docker/{ => debian}/run.sh (98%)

diff --git a/docker/.dockerignore b/docker/debian/.dockerignore
similarity index 100%
rename from docker/.dockerignore
rename to docker/debian/.dockerignore
diff --git a/docker/.gitignore b/docker/debian/.gitignore
similarity index 100%
rename from docker/.gitignore
rename to docker/debian/.gitignore
diff --git a/docker/Dockerfile b/docker/debian/Dockerfile
similarity index 100%
rename from docker/Dockerfile
rename to docker/debian/Dockerfile
diff --git a/docker/README.rst b/docker/debian/README.rst
similarity index 100%
rename from docker/README.rst
rename to docker/debian/README.rst
diff --git a/docker/config.dist b/docker/debian/config.dist
similarity index 100%
rename from docker/config.dist
rename to docker/debian/config.dist
diff --git a/docker/nipa.config b/docker/debian/nipa.config
similarity index 100%
rename from docker/nipa.config
rename to docker/debian/nipa.config
diff --git a/docker/results.sh b/docker/debian/results.sh
similarity index 100%
rename from docker/results.sh
rename to docker/debian/results.sh
diff --git a/docker/run.sh b/docker/debian/run.sh
similarity index 98%
rename from docker/run.sh
rename to docker/debian/run.sh
index 98b7f356..a9068e4b 100755
--- a/docker/run.sh
+++ b/docker/debian/run.sh
@@ -39,7 +39,7 @@ echo >&2 Running nipa in Docker...
 docker run $DOCKER_FLAGS --rm --user=nipa \
        --read-only \
        -v $PWD/nipa-run/tmp:/tmp \
-       -v $PWD/..:/nipa:ro \
+       -v $PWD/../..:/nipa:ro \
        -v $PWD/nipa-run/patatt:/home/nipa/.local/share/patatt \
        -v $PWD/nipa-run/patatt:/root/.local/share/patatt \
        -v $PWD/nipa.config:/nipa.config:ro \

From 6ce1ecd219e264735692e9a91b9ae7e34f959c61 Mon Sep 17 00:00:00 2001
From: Matthieu Baerts <matttbe@kernel.org>
Date: Mon, 24 Aug 2026 17:37:49 +0200
Subject: [PATCH 2/5] docker: new base on top of Fedora

This base will be used in the following commits to be able to run the
static tests on one side, and the selftests on the other.

The Dockerfile is simple: it contains a few common dependences, a 'nipa'
user with a git config and CCACHE configured.

A few simple bash scripts are added to build and run the docker images
easily:

  ./docker/build.sh        # build all images
  ./docker/<dir>/build.sh  # build a specific image
  ./docker/<dir>/run.sh    # get a prompt or execute a command from a
                           # specific docker image

The build scripts can be used with INPUT_PUSH=1 to publish the images
after having built them.

Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
---
 docker/.gitignore      |  1 +
 docker/base/Dockerfile | 28 ++++++++++++++++++++++++++
 docker/base/build.sh   |  1 +
 docker/base/run.sh     |  1 +
 docker/build.sh        |  3 +++
 docker/common/build.sh | 26 ++++++++++++++++++++++++
 docker/common/run.sh   | 45 ++++++++++++++++++++++++++++++++++++++++++
 7 files changed, 105 insertions(+)
 create mode 100644 docker/.gitignore
 create mode 100644 docker/base/Dockerfile
 create mode 120000 docker/base/build.sh
 create mode 120000 docker/base/run.sh
 create mode 100755 docker/build.sh
 create mode 100755 docker/common/build.sh
 create mode 100755 docker/common/run.sh

diff --git a/docker/.gitignore b/docker/.gitignore
new file mode 100644
index 00000000..ca284b70
--- /dev/null
+++ b/docker/.gitignore
@@ -0,0 +1 @@
+.ccache/
diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
new file mode 100644
index 00000000..710fa162
--- /dev/null
+++ b/docker/base/Dockerfile
@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: GPL-2.0
+FROM fedora:44
+
+LABEL name=nipa-base
+
+RUN echo "install_weak_deps=False" >> /etc/dnf/dnf.conf
+RUN dnf install -y \
+		bison ccache flex gcc make rsync \
+		bc cpio curl diffutils gawk git perl openssl patch which \
+		elfutils-libelf-devel ncurses-devel openssl-devel && \
+	sudo dnf clean all
+
+# nipa user with "root" rights
+RUN useradd -m nipa
+RUN usermod -aG wheel nipa
+RUN echo 'nipa ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+# workaround https://github.com/apptainer/apptainer/issues/2756
+RUN chmod 0400 /etc/shadow
+USER nipa
+WORKDIR /home/nipa
+
+RUN git config --global user.name "Nipa Container" && \
+	git config --global user.email "nipa@container"
+
+# CCache
+ENV PATH=/usr/lib64/ccache:${PATH}
+ENV CCACHE_COMPRESS=true
+ENV KBUILD_BUILD_TIMESTAMP="0"
diff --git a/docker/base/build.sh b/docker/base/build.sh
new file mode 120000
index 00000000..f84531b1
--- /dev/null
+++ b/docker/base/build.sh
@@ -0,0 +1 @@
+../common/build.sh
\ No newline at end of file
diff --git a/docker/base/run.sh b/docker/base/run.sh
new file mode 120000
index 00000000..aee911b2
--- /dev/null
+++ b/docker/base/run.sh
@@ -0,0 +1 @@
+../common/run.sh
\ No newline at end of file
diff --git a/docker/build.sh b/docker/build.sh
new file mode 100755
index 00000000..643450ef
--- /dev/null
+++ b/docker/build.sh
@@ -0,0 +1,3 @@
+#! /bin/bash -e
+cd "$(dirname "${0}")"
+./base/build.sh
diff --git a/docker/common/build.sh b/docker/common/build.sh
new file mode 100755
index 00000000..2250b47a
--- /dev/null
+++ b/docker/common/build.sh
@@ -0,0 +1,26 @@
+#!/bin/bash -e
+# SPDX-License-Identifier: GPL-2.0
+
+: "${INPUT_PUSH:=0}"
+: "${INPUT_PREFIX:="ghcr.io/linux-netdev"}"
+: "${INPUT_TAG:="latest"}"
+
+cd "$(dirname "${0}")"
+
+DIR_NAME="$(basename "${PWD}")"
+ARGS=()
+IMG="nipa-${DIR_NAME}"
+PUB_IMG="${INPUT_PREFIX}/${IMG}:${INPUT_TAG}"
+
+if [[ ${-} =~ "x" ]]; then
+	ARGS+=(--progress plain)
+fi
+
+if [ "${INPUT_PUSH}" = 1 ]; then
+	ARGS+=(--push)
+fi
+
+docker buildx build --build-arg=BASE_PREFIX="${INPUT_PREFIX}" \
+	--build-arg=BASE_TAG="${INPUT_TAG}" -f "Dockerfile" --load \
+	-t "${PUB_IMG}" "${ARGS[@]}" "${@}" .
+docker system prune --filter "label=name=${IMG}" -f >&2
diff --git a/docker/common/run.sh b/docker/common/run.sh
new file mode 100755
index 00000000..8723c04e
--- /dev/null
+++ b/docker/common/run.sh
@@ -0,0 +1,45 @@
+#!/bin/bash -e
+# SPDX-License-Identifier: GPL-2.0
+
+: "${INPUT_PREFIX:="ghcr.io/linux-netdev"}"
+: "${INPUT_TAG:="latest"}"
+
+SCRIPT_DIR=$(cd "$(dirname "${0}")" && pwd)
+DIR_NAME="$(basename "${SCRIPT_DIR}")"
+CCACHE_DIR="${SCRIPT_DIR}/.ccache"
+mkdir -p "${CCACHE_DIR}"
+ARGS=(
+	-v "${CCACHE_DIR}:/home/nipa/.ccache:rw"
+	-v "${PWD}:${PWD}:rw"
+	-w "${PWD}"
+	-u "${RUID:-$(id -u)}:${RGID:-$(id -g)}"
+	--group-add "$(grep "^kvm:" /etc/group | cut -d: -f3)"
+	--rm
+	-i
+	--privileged
+)
+test -t 1 && ARGS+=("-t")
+
+DOCKER_IMG="${INPUT_PREFIX}/nipa-${DIR_NAME}:${INPUT_TAG}"
+echo "Using ${DOCKER_IMG} image" >&2
+
+# $1: basedir
+add_git_worktree() {
+	local wt
+	if [ -f "${1}/.git" ]; then
+		wt="$(realpath "$(git -C "${1}" rev-parse --git-common-dir)")"
+		ARGS+=(-v "${wt}:${wt}:rw")
+	fi
+}
+
+add_git_worktree .
+# trying to be smart: mounting directories passed in argument
+for arg in "${@}"; do
+	if [ -d "${arg}" ]; then
+		d="$(realpath "${arg}")"
+		ARGS+=(-v "${d}:${d}:rw")
+		add_git_worktree "${arg}"
+	fi
+done
+
+docker run "${ARGS[@]}" "${DOCKER_IMG}" "${@:-bash}"

From 0ffce9611d27c7b3ff3ad54a1ca89e1b38435853 Mon Sep 17 00:00:00 2001
From: Matthieu Baerts <matttbe@kernel.org>
Date: Fri, 8 May 2026 10:43:13 +0200
Subject: [PATCH 3/5] docker: image to build kernel and run static tests

This image includes all the dependences to execute the static tests from
this repo. In other words, to execute the ingest_mdir.py script.

Once built, the ingest_mdir.py script can be executed that way:

  cd $linux
  b4 send -o /tmp/b4

  cd $nipa
  ./docker/build/run.sh ./ingest_mdir.py \
      --mdir /tmp/b4 --tree $linux --result-dir out

Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
---
 docker/build.sh            |  1 +
 docker/build/.dockerignore |  1 +
 docker/build/Dockerfile    | 29 +++++++++++++++++++++++++++++
 docker/build/build.sh      |  1 +
 docker/build/run.sh        |  1 +
 5 files changed, 33 insertions(+)
 create mode 100644 docker/build/.dockerignore
 create mode 100644 docker/build/Dockerfile
 create mode 120000 docker/build/build.sh
 create mode 120000 docker/build/run.sh

diff --git a/docker/build.sh b/docker/build.sh
index 643450ef..73f708f5 100755
--- a/docker/build.sh
+++ b/docker/build.sh
@@ -1,3 +1,4 @@
 #! /bin/bash -e
 cd "$(dirname "${0}")"
 ./base/build.sh
+./build/build.sh
diff --git a/docker/build/.dockerignore b/docker/build/.dockerignore
new file mode 100644
index 00000000..55686717
--- /dev/null
+++ b/docker/build/.dockerignore
@@ -0,0 +1 @@
+/.ccache
diff --git a/docker/build/Dockerfile b/docker/build/Dockerfile
new file mode 100644
index 00000000..20a0a58b
--- /dev/null
+++ b/docker/build/Dockerfile
@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: GPL-2.0
+ARG BASE_PREFIX="ghcr.io/linux-netdev"
+ARG BASE_TAG="latest"
+FROM ${BASE_PREFIX}/nipa-base:${BASE_TAG}
+
+LABEL name=nipa-build
+
+RUN sudo dnf install -y \
+		clang llvm lld \
+		ruff pylint yamllint jsonschema shellcheck \
+		dwarves libasan libasan-static glibc-devel.i686 \
+		rustc \
+		perl-Git lei \
+		python-lxml python-yaml python-jsonschema python-GitPython \
+		python-pyroute2 python-sphinx python-psutil \
+		libcap-devel numactl-devel libmnl-devel \
+		coccinelle && \
+	sudo dnf clean all
+
+# Sparse
+ARG SPARSE_GIT_URL="https://kernel.googlesource.com/pub/scm/devel/sparse/sparse.git"
+ARG SPARSE_GIT_SHA="37156835e3d725b6d750f000be33ba3814bb2310" # include a fix for __builtin_strlen
+RUN git clone "${SPARSE_GIT_URL}" sparse && \
+	cd "sparse" && \
+		git checkout "${SPARSE_GIT_SHA}" && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make PREFIX=/usr install && \
+		cd .. && \
+	rm -rf "sparse"
diff --git a/docker/build/build.sh b/docker/build/build.sh
new file mode 120000
index 00000000..f84531b1
--- /dev/null
+++ b/docker/build/build.sh
@@ -0,0 +1 @@
+../common/build.sh
\ No newline at end of file
diff --git a/docker/build/run.sh b/docker/build/run.sh
new file mode 120000
index 00000000..aee911b2
--- /dev/null
+++ b/docker/build/run.sh
@@ -0,0 +1 @@
+../common/run.sh
\ No newline at end of file

From 4fd9862c168daf6a43fb5f2511a8edc90b380589 Mon Sep 17 00:00:00 2001
From: Matthieu Baerts <matttbe@kernel.org>
Date: Mon, 24 Aug 2026 18:09:16 +0200
Subject: [PATCH 4/5] docker: image to run selftests

This image contains all the dependences and tools to build a kernel, and
run the net selftests. Most dependences are coming from the Fedora repo,
but others are installed from specific versions, like IPRoute2 or
virtme-ng.

After discussions with other maintainers, it has been decided to have a
single image to run all the selftests.

Once the images are built, the 'run.sh' script can be used to execute
the usual commands to build the kernel and the selftests, and run the
tests from a VM machine, e.g.

  cd $linux
  $nipa/docker/selftests/run.sh \
      vng --build --config tools/testing/selftests/net/mptcp/config

  $nipa/docker/selftests/run.sh \
      make -C tools/testing/selftests TARGETS=net/mptcp

  $nipa/docker/selftests/run.sh \
      vng -v --run . --user root --cpus 4 -- \
          make -C tools/testing/selftests TARGETS=net/mptcp run_tests

Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
---
 docker/build.sh                               |   1 +
 docker/selftests/.dockerignore                |   1 +
 docker/selftests/Dockerfile                   | 129 ++++++++++++++++++
 docker/selftests/build.sh                     |   1 +
 docker/selftests/run.sh                       |   1 +
 .../systemd-network-macaddresspolicy-none     |   7 +
 6 files changed, 140 insertions(+)
 create mode 100644 docker/selftests/.dockerignore
 create mode 100644 docker/selftests/Dockerfile
 create mode 120000 docker/selftests/build.sh
 create mode 120000 docker/selftests/run.sh
 create mode 100644 docker/selftests/systemd-network-macaddresspolicy-none

diff --git a/docker/build.sh b/docker/build.sh
index 73f708f5..9aaf9c46 100755
--- a/docker/build.sh
+++ b/docker/build.sh
@@ -2,3 +2,4 @@
 cd "$(dirname "${0}")"
 ./base/build.sh
 ./build/build.sh
+./selftests/build.sh
diff --git a/docker/selftests/.dockerignore b/docker/selftests/.dockerignore
new file mode 100644
index 00000000..55686717
--- /dev/null
+++ b/docker/selftests/.dockerignore
@@ -0,0 +1 @@
+/.ccache
diff --git a/docker/selftests/Dockerfile b/docker/selftests/Dockerfile
new file mode 100644
index 00000000..b6b50f64
--- /dev/null
+++ b/docker/selftests/Dockerfile
@@ -0,0 +1,129 @@
+# SPDX-License-Identifier: GPL-2.0
+ARG BASE_PREFIX="ghcr.io/linux-netdev"
+ARG BASE_TAG="latest"
+FROM ${BASE_PREFIX}/nipa-base:${BASE_TAG}
+
+LABEL name=nipa-selftests-base
+
+# a common base to run net selftests
+RUN sudo dnf install -y \
+		busybox kmod qemu-system-x86 systemd virtiofsd \
+		clang cmake \
+		python3-argcomplete python3-jsonschema python3-pip \
+		  python3-pyroute2 python3-requests python3-scapy \
+		  python3-yaml \
+		iptables-devel libbpf-devel libcap-devel libdb-devel \
+		  libmnl-devel libnl3-devel libpcap-devel libselinux-devel \
+		  libtirpc-devel mbedtls-devel \
+		bpftool bpftrace bridge-utils conntrack dropwatch dwarves \
+		  ebtables-legacy ethtool iperf iperf3 iptables-nft \
+		  iptables-legacy iptables-utils iputils ipvsadm jq mtools \
+		  ndisc6 ngrep netperf netsniff-ng net-tools nftables \
+		  nmap-ncat numactl-devel perf pppoe-server procps-ng psmisc \
+		  smcrouted socat strace tcpdump teamd traceroute tshark \
+		  udevadm \
+		&& \
+	sudo dnf clean all
+
+# systemd changing the MAC address is racy: it does it too slowly and some tests
+# start doing their thing, then systemd comes in and flips the address.
+# Disable that by setting MACAddressPolicy=none
+COPY systemd-network-macaddresspolicy-none /etc/systemd/network/99-default.link
+
+# use nft by default
+RUN sudo alternatives --set iptables /usr/bin/iptables-nft
+
+# net/netfilter/bridge_brouter.sh requires ebtables-legacy
+RUN sudo alternatives --set ebtables /usr/bin/ebtables-legacy
+
+# Not worth it to build in isolated containers: build deps still needed for slft
+
+# Needed for net and drivers/net/hw targets
+ARG LIBURING_GIT_URL="https://github.com/axboe/liburing.git"
+ARG LIBURING_GIT_SHA="liburing-2.14"
+RUN git clone "${LIBURING_GIT_URL}" liburing && \
+	cd liburing && \
+		git checkout "${LIBURING_GIT_SHA}" && \
+		./configure && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make install && \
+		cd .. && \
+	rm -rf liburing
+
+# Needed for drivers/net/netdevsim target
+ARG LIBPSAMPLE_GIT_URL="https://github.com/Mellanox/libpsample.git"
+ARG LIBPSAMPLE_GIT_SHA="62bb27d9a49424e45191eee81df7ce0d8c74e774"
+RUN git clone "${LIBPSAMPLE_GIT_URL}" libpsample && \
+	cd libpsample && \
+		cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_INSTALL_PREFIX=/usr . && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make install && \
+		cd .. && \
+	rm -rf libpsample
+
+# Needed for net/ppp target
+ARG XL2TPD_GIT_URL="https://github.com/xelerance/xl2tpd.git"
+ARG XL2TPD_GIT_SHA="v1.3.20"
+RUN git clone "${XL2TPD_GIT_URL}" xl2tpd && \
+	cd xl2tpd && \
+		git checkout "${XL2TPD_GIT_SHA}" && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make install && \
+		cd .. && \
+	rm -rf xl2tpd
+
+# Needed for net target
+ARG IPV6TOOLKIT_GIT_URL="https://github.com/fgont/ipv6toolkit.git"
+# v2.2 has bad csum: https://github.com/fgont/ipv6toolkit/issues/104
+ARG IPV6TOOLKIT_GIT_SHA="367bbe60489a6ae68898b9c81e672b48ad81df43"
+RUN git clone "${IPV6TOOLKIT_GIT_URL}" ipv6toolkit && \
+	cd ipv6toolkit && \
+		git checkout "${IPV6TOOLKIT_GIT_SHA}" && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make install && \
+		cd .. && \
+	rm -rf ipv6toolkit
+
+# Needed for net/forwarding target
+ARG MTOOLS_GIT_URL="https://github.com/troglobit/mtools.git"
+ARG MTOOLS_GIT_SHA="v3.2"
+RUN git clone "${MTOOLS_GIT_URL}" mtools && \
+	cd mtools && \
+		git checkout "${MTOOLS_GIT_SHA}" && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make install && \
+		cd .. && \
+	rm -rf mtools
+
+# Needed for net/packetdrill and net/netfilter targets
+ARG PACKETDRILL_GIT_URL="https://github.com/google/packetdrill.git"
+ARG PACKETDRILL_GIT_SHA="2c4001c4d6fc04a3bbd01d4b92be62717a37648a"
+RUN git clone "${PACKETDRILL_GIT_URL}" packetdrill && \
+	cd packetdrill/gtests/net/packetdrill && \
+		git checkout "${PACKETDRILL_GIT_SHA}" && \
+		./configure && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo cp packetdrill /usr/local/bin/ && \
+		cd .. && \
+	rm -rf packetdrill
+
+# Needed for most targets
+# Multiple remotes are possible, likely we want next + in-review patches
+ARG IPROUTE2_GIT_URL="https://github.com/linux-netdev/iproute2.git"
+# ARG IPROUTE2_GIT_URL="https://kernel.googlesource.com/pub/scm/network/iproute2/iproute2-next.git"
+# ARG IPROUTE2_GIT_URL="https://kernel.googlesource.com/pub/scm/network/iproute2/iproute2.git"
+ARG IPROUTE2_GIT_SHA="fce739fa4f2ec83206d8d9435aa94ce22f09cdb1"
+RUN git clone "${IPROUTE2_GIT_URL}" iproute2 && \
+	cd iproute2 && \
+		git checkout "${IPROUTE2_GIT_SHA}" && \
+		./configure --color=auto && \
+		make -j"$(nproc)" -l"$(nproc)" && \
+		sudo make install && \
+		cd .. && \
+	rm -rf iproute2
+
+ARG VIRTME_NG_VERSION="1.41"
+RUN sudo pip3 install --no-cache-dir \
+	virtme-ng=="${VIRTME_NG_VERSION}"
+
+CMD ["bash"]
diff --git a/docker/selftests/build.sh b/docker/selftests/build.sh
new file mode 120000
index 00000000..f84531b1
--- /dev/null
+++ b/docker/selftests/build.sh
@@ -0,0 +1 @@
+../common/build.sh
\ No newline at end of file
diff --git a/docker/selftests/run.sh b/docker/selftests/run.sh
new file mode 120000
index 00000000..aee911b2
--- /dev/null
+++ b/docker/selftests/run.sh
@@ -0,0 +1 @@
+../common/run.sh
\ No newline at end of file
diff --git a/docker/selftests/systemd-network-macaddresspolicy-none b/docker/selftests/systemd-network-macaddresspolicy-none
new file mode 100644
index 00000000..a1c70fa2
--- /dev/null
+++ b/docker/selftests/systemd-network-macaddresspolicy-none
@@ -0,0 +1,7 @@
+[Match]
+OriginalName=*
+
+[Link]
+NamePolicy=keep kernel database onboard slot path
+AlternativeNamesPolicy=database onboard slot path mac
+MACAddressPolicy=none

From 1f944af799fb7a92b77f6c419efea147a82eae17 Mon Sep 17 00:00:00 2001
From: Matthieu Baerts <matttbe@kernel.org>
Date: Mon, 24 Aug 2026 17:46:20 +0200
Subject: [PATCH 5/5] gh: build and publish docker images

A simple GitHub Action to build and publish docker images.

This is triggered on a push to the main branch and on pull requests, but
only when related files are modified.

The publication is only done when the main branch is updated.

Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
---
 .github/workflows/dockerhub.yml | 49 +++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/dockerhub.yml

diff --git a/.github/workflows/dockerhub.yml b/.github/workflows/dockerhub.yml
new file mode 100644
index 00000000..6a0cdc71
--- /dev/null
+++ b/.github/workflows/dockerhub.yml
@@ -0,0 +1,49 @@
+name: dockerhub
+
+on:
+  push:
+    branches:
+      - 'main'
+    paths:
+      - 'docker/**'
+      - '.github/workflows/dockerhub.yml'
+  pull_request:
+    paths:
+      - 'docker/**'
+      - '.github/workflows/dockerhub.yml'
+
+jobs:
+  docker:
+    name: Build and push Docker images
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+
+    steps:
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      -
+        name: Login to GHCR
+        if: ${{ github.event_name == 'push' }}
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Build and push docker images
+        run: |
+          INPUT_PUSH=${{ github.event_name == 'push' && '1' || '0' }} \
+            INPUT_PREFIX="ghcr.io/${{ github.repository_owner }}" \
+            INPUT_TAG="latest" \
+            ./docker/build.sh