test: new rules_oci

.github/workflows/ci.yaml

@@ -51,7 +51,7 @@ jobs:
 
   ci-images:
     name: CI image tests
-    runs-on: ubuntu-20.04 # most compatible with debian 11
+    runs-on: distroless-ci-large-ubuntu-20.04 # most compatible with debian 11
     steps:
       - uses: actions/checkout@v4
       - name: Mount bazel caches

CONTRIBUTING.md

@@ -20,9 +20,9 @@ Follow either of the two links above to access the appropriate CLA and instructi
 3. For building and loading images to your local Docker engine, you need to add a new rule for that image to the BUILD:
 
 ```starlark
-load("@rules_oci//oci:defs.bzl", "oci_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_load")
 
-oci_tarball(
+oci_load(
   name = "local_build",
   image = "//base:static_root_amd64_debian17",
   repo_tags = [],

WORKSPACE

@@ -2,6 +2,22 @@ workspace(name = "distroless")
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+# rules_oci setup
+http_archive(
+    name = "rules_oci",
+    sha256 = "311e78803a4161688cc79679c0fb95c56445a893868320a3caf174ff6e2c383b",
+    strip_prefix = "rules_oci-2.0.0-beta2",
+    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.0-beta2/rules_oci-v2.0.0-beta2.tar.gz",
+)
+
+load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
+
+rules_oci_dependencies()
+
+load("@rules_oci//oci:repositories.bzl", "oci_register_toolchains")
+
+oci_register_toolchains(name = "oci")
+
 # rules_distroless setup
 http_archive(
     name = "rules_distroless",
@@ -18,36 +34,16 @@ load("@rules_distroless//distroless:toolchains.bzl", "distroless_register_toolch
 
 distroless_register_toolchains()
 
-# rules_oci setup
-http_archive(
-    name = "rules_oci",
-    sha256 = "56d5499025d67a6b86b2e6ebae5232c72104ae682b5a21287770bd3bf0661abf",
-    strip_prefix = "rules_oci-1.7.5",
-    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.7.5/rules_oci-v1.7.5.tar.gz",
-)
-
-load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
-
-rules_oci_dependencies()
-
-load("@rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "LATEST_ZOT_VERSION", "oci_register_toolchains")
-
-oci_register_toolchains(
-    name = "oci",
-    crane_version = LATEST_CRANE_VERSION,
-    zot_version = LATEST_ZOT_VERSION,
-)
-
 load("@rules_oci//cosign:repositories.bzl", "cosign_register_toolchains")
 
 cosign_register_toolchains(name = "oci_cosign")
 
 # setup container_structure_test
 http_archive(
     name = "container_structure_test",
-    sha256 = "2da13da4c4fec9d4627d4084b122be0f4d118bd02dfa52857ff118fde88e4faa",
-    strip_prefix = "container-structure-test-1.16.0",
-    urls = ["https://github.com/GoogleContainerTools/container-structure-test/archive/v1.16.0.zip"],
+    sha256 = "4fd1e0d4974fb95e06d0e94e6ceaae126382bf958524062db4e582232590b863",
+    strip_prefix = "container-structure-test-1.16.1",
+    urls = ["https://github.com/GoogleContainerTools/container-structure-test/archive/v1.16.1.zip"],
 )
 
 load("@container_structure_test//:repositories.bzl", "container_structure_test_register_toolchain")

examples/go/BUILD

@@ -1,7 +1,7 @@
 # Public notice: this file is for internal documentation, testing, and
 # reference only. Note that repo maintainers can freely change any part of the
 # repository code at any time.
-load("@rules_oci//oci:defs.bzl", "oci_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_load")
 load("//private/oci:defs.bzl", "go_image")
 
 package(default_visibility = ["//visibility:public"])
@@ -13,10 +13,9 @@ go_image(
 )
 
 # Run
-# bazel build //examples/go:tarball
-# podman load -i bazel-bin/examples/go/tarball/tarball.tar
+# bazel run //examples/go:tarball
 # podman run localhost/distroless/examples/go:latest
-oci_tarball(
+oci_load(
     name = "tarball",
     image = ":go_example",
     repo_tags = ["distroless/examples/go:latest"],

examples/python3/BUILD

@@ -1,7 +1,7 @@
 # Public notice: this file is for internal documentation, testing, and
 # reference only. Note that repo maintainers can freely change any part of the
 # repository code at any time.
-load("@rules_oci//oci:defs.bzl", "oci_image", "oci_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
 load("//base:distro.bzl", "DISTROS")
 
@@ -36,10 +36,10 @@ oci_image(
 )
 
 # Run
-# podman load -i bazel-bin/examples/python3/tarball/tarball.tar
+# bazel run //examples/python3/tarball
 # podman run localhost/distroless/examples/py:latest
 [
-    oci_tarball(
+    oci_load(
         name = "tarball_" + distro,
         image = ":hello_" + distro,
         repo_tags = ["distroless/examples/py:latest"],

experimental/python3/BUILD

@@ -1,5 +1,5 @@
 load("@container_structure_test//:defs.bzl", "container_structure_test")
-load("@rules_oci//oci:defs.bzl", "oci_image", "oci_image_index", "oci_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_image_index", "oci_load")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
 load("//:checksums.bzl", ARCHITECTURES = "BASE_ARCHITECTURES")
 load("//base:distro.bzl", DISTROS = "LANGUAGE_DISTROS")
@@ -133,7 +133,7 @@ DISTRO_VERSION = {
 ]
 
 [
-    oci_tarball(
+    oci_load(
         name = "python3_root_" + arch + "_debian11_tarball",
         image = ":python3_root_" + arch + "_debian11",
         repo_tags = ["distroless/gen/python3_root_%s_debian11_tarball:gen" % arch],
@@ -145,16 +145,29 @@ DISTRO_VERSION = {
     for arch in ARCHITECTURES
 ]
 
+[
+    filegroup(
+        name = "python3_root_" + arch + "_debian11_tarball_tar",
+        srcs = ["python3_root_" + arch + "_debian11_tarball"],
+        output_group = "tarball",
+        tags = [
+            "manual",
+            arch,
+        ],
+    )
+    for arch in ARCHITECTURES
+]
+
 [
     genrule(
         name = "ld_so_cache_" + arch + "_new",
-        srcs = [":python3_root_" + arch + "_debian11_tarball"],
+        srcs = [":python3_root_" + arch + "_debian11_tarball_tar"],
         outs = ["ld.so.cache." + arch + ".new"],
         cmd = """
 #!/usr/bin/env bash
 set -o errexit
 
-TARBALL="$(location :python3_root_{arch}_debian11_tarball)"
+TARBALL="$(location :python3_root_{arch}_debian11_tarball_tar)"
 TAG="distroless/gen/python3_root_{arch}_debian11_tarball:gen"
 DOCKER="docker"