Rancher v2.15.2 build recipe

github.com/rancher/rancher (v2.15.2) at 272e65580ca92b9dc51e0f0f0f9ae9d6d356e3b8

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/rancher/rancher.git v2.15.2
• git https://github.com/k3s-io/containerd.git "$3"
• https://releases.rancher.com/dashboard/v2.15.2.tar.gz
• https://releases.rancher.com/api-ui/1.1.11.tar.gz
• https://releases.rancher.com/kontainer-driver-metadata/release-v2.15/data.json
• https://github.com/rancher/system-agent/releases/download/v0.15.2/install.sh
• https://github.com/rancher/system-agent/releases/download/v0.15.2/system-agent-uninstall.sh
• https://raw.githubusercontent.com/rancher/wins/v0.15.2/install.ps1
• https://raw.githubusercontent.com/rancher/wins/v0.15.2/uninstall.ps1
• https://github.com/rancher/
• https://git.rancher.io/

• Base imagegolang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af
• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1790188871 (2026-09-23T18:41:11Z)
• Target digest (linux/amd64)sha256:aa38564691e1e7e024b1da1c9258731cd61940cf1a04b6a6a79f878b28133d14
• Target config digestsha256:826fb040da1b1a929970a2248106c83c6dfac1c7228449474ef2b0373d8575f9
• Checksummed kit files110,887 (CHECKSUMS.sha256)

# =====================================================================
# Rancher v2.15.2 L-009 HERMETIC OFFLINE BUILD — the canonical, attestation-producing build. build_kit runs
#   docker buildx build --builder readystack-builder-max --network=none
#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>
# Pinned-public-base + vendored model: golang 1.26.10 + ubuntu 24.04 pinned BY DIGEST (BASE_IMAGE_DIGESTS.lock);
# vendored/*-src are fully vendored Go trees (GOPROXY=off, -mod=vendor), every Go program in the image compiled here
# on the one pinned Go; vendored/assets holds the checksummed non-Go inputs; vendored/debs is the apt closure.
# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).
#
# SHAPE: upstream's single-container Rancher ("docker run --privileged"): the rancher server starts an embedded k3s
# (server + agent, so containerd, runc and the CNI plugins run inside this container) and installs its system charts
# into it. Same file layout, entrypoint and environment as upstream's package/Dockerfile `server` target, on Ubuntu,
# but NON-ROOT: the image user is `rancher` (uid 1001) and rancher-entrypoint.sh runs upstream's entrypoint, Rancher and
# k3s inside a rootlesskit user namespace (rancher-entrypoint.sh explains; --user 0 gives upstream's root mode).
# =====================================================================
FROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS gobuild
# libseccomp-dev for runc and k3s (both built with seccomp support, as upstream builds them), dpkg'd offline.
RUN --mount=type=bind,source=vendored/builddebs,target=/tmp/builddebs dpkg -i /tmp/builddebs/*.deb
ENV GOTOOLCHAIN=local GOWORK=off GOFLAGS="-mod=vendor -buildvcs=false" GOPROXY=off CGO_ENABLED=0
# Fail closed on a stale toolchain: `go version <binary>` reads the toolchain recorded in the binary. gocheck ends every
# compile RUN, and it also empties the Go build cache, so no stage's layer keeps its cache: with it, the twelve compile
# stages' layers held well over 100 GB on the build host (<redacted: internal host> ran out of disk at build_kit, chain 618).
RUN printf '%s\n' '#!/bin/sh' 'set -eu' 'for b in "$@"; do v=$(go version "$b" | awk "{print \$2}"); echo "$b: $v";' \
      '[ "$(printf "%s\n%s\n" go1.26.10 "$v" | sort -V | head -n1)" = go1.26.10 ] || { echo "$b built with $v < go1.26.10" >&2; exit 1; }; done' \

Continues: 284 more lines. Create a free account to read the rest, or sign in.

Published with one line redacted (internal host).

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.