Split compiler away for gnu and centos

.github/workflows/_build-image.yml

@@ -182,6 +182,35 @@ jobs:
             -e BUNDLE_GEMFILE=gemfiles/${{ inputs.engine }}-${{ inputs.version }}.gemfile \
             ${{ steps.vars.outputs.IMAGE }}:test \
             /bin/sh -c 'bundle config set without "check ide" && bundle config set with "test" && bundle install && bundle exec rake test'
+          # Smoke-test C extensions to prove their shared library deps are present
+          # Ruby 1.8 uses syck; 1.9+ uses psych
+          if [ "${{ inputs.version }}" = "1.8" ]; then
+            docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -rsyck -e 'puts YAML'
+          else
+            docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -rpsych -e 'puts Psych.dump({ :smoke => "test"})'
+          fi
+          docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -ryaml -e 'puts YAML.dump({ :smoke => "test"})'
+          docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
+          docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -rreadline -e 'puts Readline::VERSION'
+          # fiddle became available in Ruby 2.0; jruby 9.2 lacks FFI on aarch64
+          case "${{ inputs.engine }}:${{ inputs.version }}:${{ matrix.arch }}" in
+            *:1.8:*|*:1.9:*) : ;;
+            jruby:9.2:aarch64) : ;;
+            *) docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -rfiddle -e 'puts Fiddle::SIZEOF_VOIDP' ;;
+          esac
+          docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -rzlib -e 'puts Zlib.zlib_version'
+          # gdbm was removed from Ruby's bundled gems in 3.1; not available in JRuby (C extension)
+          case "${{ inputs.engine }}:${{ inputs.version }}" in
+            jruby:*|ruby:3.[1-9]*|ruby:[4-9]*) : ;;
+            *) docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -rgdbm -e 'puts GDBM::VERSION' ;;
+          esac
+          # io/console not available in Ruby 1.8
+          # TODO: investigate io/console failure on jruby 9.2/9.3 aarch64 (gnu + musl)
+          case "${{ inputs.engine }}:${{ inputs.version }}:${{ matrix.arch }}" in
+            *:1.8:*) : ;;
+            jruby:9.2:aarch64|jruby:9.3:aarch64) : ;;
+            *) docker run --rm ${{ steps.vars.outputs.IMAGE }}:test ruby -e 'require "io/console"; puts IO.console.class' ;;
+          esac
 
   join:
     needs: build

.github/workflows/build-ruby-compilers.yml

@@ -35,6 +35,75 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # gnu
+          - engine: ruby
+            version: "1.8"
+            libc: gnu
+            arch: ["x86_64"]
+          - engine: ruby
+            version: "1.9"
+            libc: gnu
+            arch: ["x86_64"]
+          - engine: ruby
+            version: "2.0"
+            libc: gnu
+            arch: ["x86_64"]
+          - engine: ruby
+            version: "2.1"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.2"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.3"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.4"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.5"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.6"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.7"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.0"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.1"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.2"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.3"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.4"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.5"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "4.0"
+            libc: gnu
+            arch: ["x86_64", "aarch64"]
           # musl
           - engine: ruby
             version: "2.1"
@@ -108,6 +177,75 @@ jobs:
             version: "10.0"
             libc: musl
             arch: ["x86_64", "aarch64"]
+          # centos
+          - engine: ruby
+            version: "1.8"
+            libc: centos
+            arch: ["x86_64"]
+          - engine: ruby
+            version: "1.9"
+            libc: centos
+            arch: ["x86_64"]
+          - engine: ruby
+            version: "2.0"
+            libc: centos
+            arch: ["x86_64"]
+          - engine: ruby
+            version: "2.1"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.2"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.3"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.4"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.5"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.6"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "2.7"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.0"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.1"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.2"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.3"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.4"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "3.5"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
+          - engine: ruby
+            version: "4.0"
+            libc: centos
+            arch: ["x86_64", "aarch64"]
     name: ${{ matrix.engine }}:${{ matrix.version }}-${{ matrix.libc }}${{ inputs.tag_suffix }}
     uses: ./.github/workflows/_build-image.yml
     with:

.github/workflows/ruby.yml

@@ -23,10 +23,10 @@ jobs:
       push: ${{ inputs.push || false }}
     secrets: inherit
 
-  # Stage 2: Build musl compiler images (musl.gcc, musl.clang)
+  # Stage 2: Build compiler images (gnu.gcc, gnu.clang, musl.gcc, musl.clang, centos.gcc, centos.clang)
   #
-  # These depend on the base musl images existing in the registry.
-  # The compiler Dockerfiles FROM the release tag (e.g. FROM ...ruby:3.3-musl)
+  # These depend on the base images existing in the registry.
+  # The compiler Dockerfiles FROM the release tag (e.g. FROM ...ruby:3.3-gnu)
   # but _build-image.yml uses --build-context to override it with the
   # commit-tagged base image from this pipeline run, so correctness does not
   # depend on the release tag being pushed.

src/engines/ruby/1.8/Dockerfile.centos

@@ -68,17 +68,17 @@ RUN true "${REPRO_RUN_KEY}" && yum makecache -y
 # localedef has been forcefully removed by:
 # rm -rf "$target"/usr/{{lib,share}/locale,{lib,lib64}/gconv,bin/localedef,sbin/build-locale-archive}
 # fun: CentOS 8 has `yum list glibc-langpack-\*` but not CentOS 7 :'(
-RUN yum reinstall -y glibc-common
-
-RUN yum install -y curl gcc gcc-c++ gettext make patchutils patch libtool pkgconfig gettext file zip unzip git
-
-# fun: this has to be after `yum install curl gcc make`... but only on aarch64; go figure
-# extra fun: table is botched, localedef not happy, swallow result and test `locale` for errors
+# On aarch64, the base image may ship an older glibc than what the altarch
+# repo provides; updating glibc + glibc-common brings in gconv modules that
+# localedef needs to generate the locale.
 RUN <<SHELL
+yum update -y glibc glibc-common
 localedef -v -c -i en_US -f UTF-8 en_US.UTF-8 || true
 if locale 2>&1 | grep -e 'locale: Cannot set LC_.* to default locale: No such file or directory'; then exit 1; fi
 SHELL
 
+# Install runtime packages only (no compiler or build tools)
+RUN yum install -y curl gettext file zip unzip git
 # Skip installing gem documentation
 COPY <<GEMRC /usr/local/etc/gemrc
 install: --no-document
@@ -96,7 +96,19 @@ ENV LANG="en_US.UTF-8"
 RUN <<SHELL
 set -eux
 
-yum install -y xz gcc automake bison zlib-devel libyaml-devel openssl-devel gdbm-devel readline-devel ncurses-devel libffi-devel
+# --- Install compiler and build dependencies ---
+# Install runtime libraries that Ruby links against; these must be present
+# BEFORE the checkpoint so they survive the rollback.
+yum install -y zlib libyaml gdbm readline ncurses-libs libffi openssl-libs
+
+# Record checkpoint: everything after this transaction will be rolled back.
+yum_checkpoint=$(yum history list all 2>/dev/null | awk '$1 ~ /^[0-9]+$/ {print $1; exit}')
+
+yum install -y \
+    gcc gcc-c++ make patchutils patch libtool pkgconfig xz automake autoconf bison \
+    zlib-devel libyaml-devel openssl-devel gdbm-devel readline-devel ncurses-devel libffi-devel
+
+# --- Build Ruby ---
 
 curl -L -o ruby.tar.gz "https://github.com/ruby/ruby/archive/f48ae0d10c5b586db5748b0d4b645c7e9ff5d52e.tar.gz"
 echo "$RUBY_DOWNLOAD_SHA256 *ruby.tar.gz" | sha256sum --check --strict
@@ -158,32 +170,6 @@ gnuArch="$(uname -m)-linux-gnu"
 make
 make install
 
-# 	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
-# 		| awk '/=>/ { print $(NF-1) }' \
-# 		| sort -u \
-# 		| grep -vE '^/usr/local/lib/' \
-# 		| xargs -r dpkg-query --search \
-# 		| cut -d: -f1 \
-# 		| sort -u \
-# 		| xargs -r apt-mark manual \
-#
-# 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
-#
-# find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' \
-#       | awk '/=>/ { print $(NF-1) }' \
-#       | grep -v '=>' \
-#       | sort -u \
-#       | grep -vE '^/usr/local/lib/' \
-#       | xargs -r rpm -qf \
-#       | sort -u \
-#       | xargs -r yum ?mark-manual?
-#
-# yum autoremove -y
-# yum remove --setopt=clean_requirements_on_remove=1
-# package-cleanup --leaves && yum autoremove # yum-utils
-# sudo yum history list pdftk
-# sudo yum history undo 88
-
 cd /
 rm -r /usr/src/ruby
 if yum list installed ruby; then exit 1; fi
@@ -239,6 +225,14 @@ ruby --version
 gem --version
 bundle --version
 
+# --- Clean up compiler and build dependencies ---
+# Roll back to the checkpoint: removes compilers, build tools, and -devel
+# packages while preserving the runtime libraries installed before
+# the checkpoint.
+yum -y history rollback "${yum_checkpoint}"
+yum clean all
+
+
 SHELL
 
 # don't create ".bundle" in all our apps

src/engines/ruby/1.8/Dockerfile.centos.clang

@@ -0,0 +1,3 @@
+FROM ghcr.io/datadog/images-rb/engines/ruby:1.8-centos
+
+RUN yum install -y epel-release && yum install -y clang make binutils file patch

src/engines/ruby/1.8/Dockerfile.centos.gcc

@@ -0,0 +1,3 @@
+FROM ghcr.io/datadog/images-rb/engines/ruby:1.8-centos
+
+RUN yum install -y gcc gcc-c++ make binutils file patch

src/engines/ruby/1.8/Dockerfile.gnu

@@ -1,6 +1,4 @@
 # platforms: linux/x86_64
-# strip-tags: gnu
-# append-tags: gcc
 
 # Debian 11 (bullseye)
 FROM public.ecr.aws/docker/library/debian:11
@@ -63,6 +61,7 @@ ENV LANG="en_US.UTF-8"
 RUN <<SHELL
 set -eux
 
+# --- Install compiler and build dependencies ---
 apt-get install -y \
     curl \
     ca-certificates \
@@ -84,6 +83,8 @@ apt-get install -y \
     libffi-dev \
     --no-install-recommends
 
+# --- Build Ruby ---
+
 # Ruby 1.8 needs OpenSSL 1.0.x; Debian 11's OpenSSL 1.1.x is incompatible
 OPENSSL_VERSION='1.0.2u'
 OPENSSL_SHA256='ecd0c6ffb493dd06707d38b14bb4d8c2288bb7033735606569d8f90f89669d16'
@@ -234,8 +235,15 @@ ruby --version
 gem --version
 bundle --version
 
-# clean up apt lists
-rm -rf /var/lib/apt/lists/*
+# --- Clean up compiler and build dependencies ---
+# Note: --auto-remove is deliberately NOT used because runtime libraries
+# (libyaml, libffi, libssl, etc.) were auto-installed as dependencies of
+# -dev packages and apt has no way to know that Ruby needs them at runtime.
+apt-get purge -y \
+    gcc g++ cpp make autoconf bison patch build-essential xz-utils \
+    libc6-dev zlib1g-dev libyaml-dev libgdbm-dev libreadline-dev \
+    libncurses5-dev libncurses-dev libffi-dev libssl-dev
+
 
 SHELL
 

src/engines/ruby/1.8/Dockerfile.gnu.clang

@@ -0,0 +1,9 @@
+FROM ghcr.io/datadog/images-rb/engines/ruby:1.8-gnu
+
+RUN apt-get install -y \
+    binutils \
+    file \
+    make \
+    libc6-dev \
+    clang \
+    --no-install-recommends

src/engines/ruby/1.8/Dockerfile.gnu.gcc

@@ -0,0 +1,10 @@
+FROM ghcr.io/datadog/images-rb/engines/ruby:1.8-gnu
+
+RUN apt-get install -y \
+    binutils \
+    file \
+    make \
+    libc6-dev \
+    gcc \
+    g++ \
+    --no-install-recommends