feat: add ARM64 support and multi-arch build for Raspberry Pi and other ARM devices

.github/workflows/docker-multiarch.yml

@@ -0,0 +1,157 @@
+name: Docker Multi-Arch Build
+
+on:
+  pull_request:
+    branches:
+      - '**'
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  meta:
+    name: Compute build metadata
+    runs-on: ubuntu-latest
+    outputs:
+      do_push: ${{ steps.set.outputs.do_push }}
+      is_tag: ${{ steps.set.outputs.is_tag }}
+      version: ${{ steps.set.outputs.version }}
+    steps:
+      - name: Determine push and tag info
+        id: set
+        shell: bash
+        run: |
+          echo "event=${GITHUB_EVENT_NAME}"
+          do_push=false
+          is_tag=false
+          version=
+          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF}" == refs/tags/* ]]; then
+            is_tag=true
+            do_push=true
+            version="${GITHUB_REF_NAME}"
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            do_push=true
+          fi
+          if [[ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]]; then do_push=false; fi
+          echo "do_push=${do_push}" >> "$GITHUB_OUTPUT"
+          echo "is_tag=${is_tag}" >> "$GITHUB_OUTPUT"
+          if [[ -n "${version}" ]]; then
+            echo "version=${version}" >> "$GITHUB_OUTPUT"
+          fi
+
+  build:
+    name: Build (${{ matrix.platform }})
+    needs: meta
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            arch_suffix: amd64
+          - platform: linux/arm64
+            arch_suffix: arm64
+    env:
+      DOCKERHUB_REPO: ${{ secrets.DOCKERHUB_USERNAME }}/nfs-server
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: all
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        if: needs.meta.outputs.do_push == 'true'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build image (no push) ${{ matrix.platform }}
+        if: needs.meta.outputs.do_push != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: false
+          provenance: false
+          sbom: false
+
+      - name: Build and push image by digest ${{ matrix.platform }}
+        if: needs.meta.outputs.do_push == 'true'
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ matrix.platform }}
+          provenance: false
+          sbom: false
+          outputs: type=image,name=${{ env.DOCKERHUB_REPO }},push-by-digest=true,name-canonical=true,push=true
+
+      - name: write digest file
+        if: needs.meta.outputs.do_push == 'true'
+        shell: bash
+        run: echo "${{ steps.build.outputs.digest }}" > "digest-${{ matrix.arch_suffix }}"
+
+      - name: upload digest artifact
+        if: needs.meta.outputs.do_push == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.arch_suffix }}
+          path: digest-${{ matrix.arch_suffix }}
+
+  manifest:
+    name: Publish multi-arch manifests
+    needs: [meta, build]
+    if: needs.meta.outputs.do_push == 'true'
+    runs-on: ubuntu-latest
+    env:
+      DOCKERHUB_REPO: ${{ secrets.DOCKERHUB_USERNAME }}/nfs-server
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          pattern: digests-*
+          path: ./digests
+          merge-multiple: true
+
+      - name: Create and push 'latest' multi-arch manifest
+        shell: bash
+        run: |
+          repo="${{ env.DOCKERHUB_REPO }}"
+          amd64=$(cat ./digests/digest-amd64)
+          arm64=$(cat ./digests/digest-arm64)
+          docker buildx imagetools create \
+            -t "${repo}:latest" \
+            "${repo}@${amd64}" \
+            "${repo}@${arm64}"
+
+      - name: Create and push versioned multi-arch manifest
+        if: needs.meta.outputs.is_tag == 'true'
+        shell: bash
+        run: |
+          repo="${{ env.DOCKERHUB_REPO }}"
+          version="${{ needs.meta.outputs.version }}"
+          amd64=$(cat ./digests/digest-amd64)
+          arm64=$(cat ./digests/digest-arm64)
+          docker buildx imagetools create \
+            -t "${repo}:${version}" \
+            "${repo}@${amd64}" \
+            "${repo}@${arm64}"

Dockerfile

@@ -2,8 +2,7 @@ ARG BUILD_FROM=alpine:latest
 
 FROM $BUILD_FROM
 
-RUN apk --update --no-cache add bash nfs-utils && \
-                                                  \
+RUN apk --update --no-cache add bash nfs-utils libcap libcap-utils && \
     # remove the default config files
     rm -v /etc/idmapd.conf /etc/exports
 

entrypoint.sh

@@ -148,7 +148,7 @@ term_process() {
 
   if [[ -n $pid ]]; then
     log "terminating $base"
-    kill "$pid"
+    kill $pid
     on_failure warn "unable to terminate $base"
   else
     log "$base was not running"
@@ -272,15 +272,24 @@ is_kernel_module_loaded() {
 }
 
 is_granted_linux_capability() {
-
+  # original check (Debian-style “Current: = …cap”)
   if capsh --print | grep -Eq "^Current: = .*,?${1}(,|$)"; then
     return 0
   fi
 
+  # else-if: handle Alpine-style header by checking Bounding set
+  cap="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+  if capsh --print 2>/dev/null \
+    | sed -n 's/^Bounding set =//p' \
+    | tr ',' '\n' \
+    | sed 's/^ *//;s/ *$//' \
+    | grep -Fxq "$cap"; then
+    return 0
+  fi
+
   return 1
 }
 
-
 ######################################################################################
 ### runtime configuration assertions
 ######################################################################################
@@ -527,10 +536,26 @@ boot_helper_mount() {
   on_failure stop "unable to mount $type filesystem onto $path"
 }
 
+kernel_exposes_nfsd_version() {
+
+  local -r v=$1
+  grep -Eq "(^|[[:space:]])[+-]?${v}([[:space:]]|$)" "$MOUNT_PATH_NFSD/versions"
+}
+
+userspace_exposes_nfsd_version() {
+
+  local -r v=$1
+  rpc.nfsd --help 2>&1 | grep -Eq "[[:space:]]$v([[:space:]]|$)"
+}
+
 boot_helper_get_version_flags() {
 
   local -r requested_version="${state[$STATE_NFS_VERSION]}"
-  local flags=('--nfs-version' "$requested_version" '--no-nfs-version' 2)
+  local flags=('--nfs-version' "$requested_version")
+
+  if kernel_exposes_nfsd_version 2 && userspace_exposes_nfsd_version 2; then
+    flags+=('--no-nfs-version' 2)
+  fi
 
   if ! is_nfs3_enabled; then
     flags+=('--no-nfs-version' 3)
@@ -551,6 +576,7 @@ boot_helper_start_daemon() {
   local -r daemon_args=("$@")
 
   log "$msg"
+  log "$daemon ${daemon_args[*]}"
   "$daemon" "${daemon_args[@]}"
   on_failure stop "$daemon failed"
 }
@@ -627,7 +653,7 @@ boot_main_rpcbind() {
 
   local args=('-s')
   if is_logging_debug; then
-    arg+=('-d')
+    args+=('-d')
   fi
   boot_helper_start_daemon 'starting rpcbind' $PATH_BIN_RPCBIND "${args[@]}"
 }