Skip to content

Commit 9e35b77

Browse files
claudeaviator-bot
claude
authored and
aviator-bot
committed
Containers: retry raw downloads in Dockerfiles on transient failures
CDNs and download hosts intermittently reset connections or return 5xx errors, and a single such failure in any download aborted the whole container build before CI ran a single test -- most recently `curl: (35) OpenSSL SSL_connect: Connection reset by peer` fetching the awscli installer. Gave every raw `curl` and `wget` download in the repo-root and development container `Dockerfile`s retry semantics using the tools' native flags, and downloads that piped installer scripts straight into an interpreter now fetch to a temporary file and execute it instead, so a torn stream can no longer reach an interpreter. Nothing about what gets downloaded changes; validated by building the `respect-current-minimum` stage and the development image through its `uv` install. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UPXVU5ytyWJxSL4YChKhm6
1 parent b54858c commit 9e35b77

2 files changed

Lines changed: 97 additions & 38 deletions

File tree

‎Dockerfile‎

Lines changed: 73 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,20 @@ ARG ENVOY_VERSION=1.38.2
3737
# manylinux-builder container.
3838
ARG CLANG_VERSION=20
3939

40+
# Raw `curl` and `wget` downloads in this file retry transient
41+
# failures: `curl --retry 5 --retry-all-errors -f` (plain `--retry`
42+
# does not retry connection resets, hence `--retry-all-errors`, and
43+
# `-f`/`--fail` turns an HTTP error status into a failed download
44+
# rather than writing the error body to the output file) and `wget
45+
# --tries=5 --waitretry=10 --retry-connrefused`. Installer scripts
46+
# are downloaded to a temporary file and executed from it rather than
47+
# piped straight into an interpreter, because on a retry after a
48+
# mid-body failure curl re-sends the whole body into the
49+
# already-written pipe, corrupting the stream. Pipes into key-material
50+
# consumers like `apt-key` and `gpg --dearmor` keep the pipe: their
51+
# input is validated cryptographically, so a torn stream fails the
52+
# build loudly.
53+
4054
###############################################################################
4155
# Use a specific ubuntu version so we're not surprised by silent changes to gcc
4256
# versions (and thus C++ feature support). We additionally care about the `glibc`
@@ -77,7 +91,10 @@ RUN update-alternatives --install /usr/bin/python usr-bin-python /usr/bin/python
7791
&& python --version | grep -Eq "^Python ${PYTHON_VERSION}.*"
7892

7993
# Ensure pip is installed and up to date.
80-
RUN curl -sS https://bootstrap.pypa.io/get-pip.py | python \
94+
RUN curl --retry 5 --retry-all-errors -fsS https://bootstrap.pypa.io/get-pip.py \
95+
-o /tmp/get-pip.py \
96+
&& python /tmp/get-pip.py \
97+
&& rm /tmp/get-pip.py \
8198
&& update-alternatives --install /usr/local/bin/pip pip /usr/local/bin/pip3 3
8299

83100
ENV TINI_VERSION=v0.19.0
@@ -99,7 +116,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
99116
# https://github.com/fullstorydev/grpcurl
100117
ARG GRPCURL_VERSION=1.9.2
101118
RUN if [ "${TARGETARCH}" = "amd64" ]; then \
102-
wget https://github.com/fullstorydev/grpcurl/releases/download/v${GRPCURL_VERSION}/grpcurl_${GRPCURL_VERSION}_linux_x86_64.tar.gz \
119+
wget --tries=5 --waitretry=10 --retry-connrefused https://github.com/fullstorydev/grpcurl/releases/download/v${GRPCURL_VERSION}/grpcurl_${GRPCURL_VERSION}_linux_x86_64.tar.gz \
103120
&& tar -xvf ./grpcurl_${GRPCURL_VERSION}_linux_x86_64.tar.gz grpcurl \
104121
&& rm ./grpcurl_${GRPCURL_VERSION}_linux_x86_64.tar.gz \
105122
&& chmod +x grpcurl \
@@ -209,7 +226,7 @@ RUN apt-get update \
209226
zsh \
210227
# Install clang. Instructions:
211228
# https://apt.llvm.org/
212-
&& wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add - \
229+
&& wget --tries=5 --waitretry=10 --retry-connrefused -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add - \
213230
&& add-apt-repository "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-${CLANG_VERSION} main" \
214231
&& apt-get update \
215232
&& apt install -y clang-${CLANG_VERSION} \
@@ -225,7 +242,7 @@ RUN apt-get update \
225242
# Install Docker from the official Docker repository. Instructions:
226243
# https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository
227244
&& install -m 0755 -d /etc/apt/keyrings \
228-
&& curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
245+
&& curl --retry 5 --retry-all-errors -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \
229246
&& chmod a+r /etc/apt/keyrings/docker.asc \
230247
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null \
231248
&& apt-get update \
@@ -236,13 +253,16 @@ RUN apt-get update \
236253

237254
# Install Bazel.
238255
ARG BAZELISK_VERSION=v1.27.0
239-
RUN wget -O /usr/local/bin/bazel https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_VERSION}/bazelisk-linux-${TARGETARCH} \
256+
RUN wget --tries=5 --waitretry=10 --retry-connrefused -O /usr/local/bin/bazel https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_VERSION}/bazelisk-linux-${TARGETARCH} \
240257
&& chmod +x /usr/local/bin/bazel
241258

242259
# Install k3d.io which we'll use to run integration tests.
243260
# See https://k3d.io/v5.8.3/#install-specific-release
244261
ARG K3D_VERSION=v5.8.3
245-
RUN curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=${K3D_VERSION} bash
262+
RUN curl --retry 5 --retry-all-errors -fsS https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh \
263+
-o /tmp/k3d-install.sh \
264+
&& TAG=${K3D_VERSION} bash /tmp/k3d-install.sh \
265+
&& rm /tmp/k3d-install.sh
246266
# The version of Kubernetes used by k3d is determined by the version of k3s it
247267
# installs, which is determined by the version of k3d. Confirm that the expected
248268
# Kubernetes version is indeed that k3d's default.
@@ -253,13 +273,16 @@ RUN k3d version | grep -q "k3s version ${KUBERNETES_VERSION}-k3s"
253273
# (+/- 1 version) with the Kubernetes used by the k3d installation above.
254274
# See https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#install-kubectl-binary-with-curl-on-linux
255275
ARG KUBECTL_VERSION=$KUBERNETES_VERSION
256-
RUN curl -LO https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl \
276+
RUN curl --retry 5 --retry-all-errors -fLO https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl \
257277
&& chmod +x kubectl \
258278
&& mv kubectl /usr/local/bin/kubectl
259279

260280
# Install Istio.
261281
# See https://istio.io/latest/docs/setup/getting-started/
262-
RUN curl -L https://istio.io/downloadIstio | ISTIO_VERSION=${ISTIO_VERSION} sh - \
282+
RUN curl --retry 5 --retry-all-errors -fL https://istio.io/downloadIstio \
283+
-o /tmp/downloadIstio \
284+
&& ISTIO_VERSION=${ISTIO_VERSION} sh /tmp/downloadIstio \
285+
&& rm /tmp/downloadIstio \
263286
&& mv istio-${ISTIO_VERSION}/bin/istioctl /usr/local/bin/istioctl \
264287
&& chmod +x /usr/local/bin/istioctl \
265288
&& rm -rf istio-${ISTIO_VERSION}
@@ -268,7 +291,7 @@ RUN curl -L https://istio.io/downloadIstio | ISTIO_VERSION=${ISTIO_VERSION} sh -
268291
# https://skaffold.dev/docs/install/
269292
# Latest version as of 2023-04-17.
270293
ARG SKAFFOLD_VERSION=2.3.1
271-
RUN curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v${SKAFFOLD_VERSION}/skaffold-linux-${TARGETARCH} \
294+
RUN curl --retry 5 --retry-all-errors -fLo skaffold https://storage.googleapis.com/skaffold/releases/v${SKAFFOLD_VERSION}/skaffold-linux-${TARGETARCH} \
272295
&& chmod +x skaffold && mv skaffold /usr/local/bin/
273296

274297
# Skaffold will call kustomize via the `kustomize build` command; however, we
@@ -290,14 +313,14 @@ RUN set -e; \
290313
else \
291314
echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
292315
fi; \
293-
curl -sL "https://github.com/google/go-containerregistry/releases/download/v${CRANE_VERSION}/go-containerregistry_linux_${ARCH_SUFFIX}.tar.gz" > go-containerregistry.tar.gz \
316+
curl --retry 5 --retry-all-errors -fsL "https://github.com/google/go-containerregistry/releases/download/v${CRANE_VERSION}/go-containerregistry_linux_${ARCH_SUFFIX}.tar.gz" -o go-containerregistry.tar.gz \
294317
&& tar -zxvf go-containerregistry.tar.gz -C /usr/local/bin/ crane \
295318
&& rm go-containerregistry.tar.gz
296319

297320
# Install the Groundcover CLI based on instructions here:
298321
# https://github.com/groundcover-com/cli#from-the-binary-releases
299322
ARG GROUNDCOVER_VERSION=0.21.0
300-
RUN curl -SsL https://github.com/groundcover-com/cli/releases/download/v${GROUNDCOVER_VERSION}/groundcover_${GROUNDCOVER_VERSION}_linux_${TARGETARCH}.tar.gz -o /tmp/groundcover.tar.gz \
323+
RUN curl --retry 5 --retry-all-errors -fSsL https://github.com/groundcover-com/cli/releases/download/v${GROUNDCOVER_VERSION}/groundcover_${GROUNDCOVER_VERSION}_linux_${TARGETARCH}.tar.gz -o /tmp/groundcover.tar.gz \
301324
&& tar -zxf /tmp/groundcover.tar.gz -C /usr/bin \
302325
&& chmod +x /usr/bin/groundcover
303326

@@ -312,13 +335,13 @@ RUN set -e; \
312335
echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
313336
fi; \
314337
BINARY_NAME="envoy-${ENVOY_VERSION}-linux-${ARCH_SUFFIX}"; \
315-
wget https://github.com/envoyproxy/envoy/releases/download/v${ENVOY_VERSION}/${BINARY_NAME}; \
338+
wget --tries=5 --waitretry=10 --retry-connrefused https://github.com/envoyproxy/envoy/releases/download/v${ENVOY_VERSION}/${BINARY_NAME}; \
316339
chmod +x ${BINARY_NAME}; \
317340
mv ${BINARY_NAME} /usr/local/bin/envoy
318341

319342
# Install `ngrok`, useful in testing MCP servers from non-local clients
320343
# like `claude.ai` - or to intercept traffic for inspection.
321-
RUN curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
344+
RUN curl --retry 5 --retry-all-errors -fsSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
322345
| sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
323346
&& echo "deb https://ngrok-agent.s3.amazonaws.com bookworm main" \
324347
| sudo tee /etc/apt/sources.list.d/ngrok.list \
@@ -360,7 +383,9 @@ ENV SHELL=/bin/bash \
360383
ARG VSCODE_SCRIPTS_COMMIT=ef146121026c67d41bbca80d9af482f20f89f9e0
361384
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
362385
&& apt-get -y install --no-install-recommends curl ca-certificates \
363-
&& bash -c "$(curl -fsSL "https://raw.githubusercontent.com/microsoft/vscode-dev-containers/${VSCODE_SCRIPTS_COMMIT}/script-library/common-debian.sh")" -- "true" "${UNAME}" "${UID}" "${GID}" "true" \
386+
&& curl --retry 5 --retry-all-errors -fsSL "https://raw.githubusercontent.com/microsoft/vscode-dev-containers/${VSCODE_SCRIPTS_COMMIT}/script-library/common-debian.sh" -o /tmp/common-debian.sh \
387+
&& bash /tmp/common-debian.sh "true" "${UNAME}" "${UID}" "${GID}" "true" \
388+
&& rm /tmp/common-debian.sh \
364389
&& apt-get clean -y && rm -rf /var/lib/apt/lists/*
365390

366391
# Finish setting up user account:
@@ -376,7 +401,9 @@ CMD ["sleep", "infinity"]
376401
# Install GitHub CLI through Codespace's preferred mechanism.
377402
# https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/github-cli.md
378403
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
379-
&& bash -c "$(curl -fsSL "https://raw.githubusercontent.com/microsoft/vscode-dev-containers/main/script-library/github-debian.sh")" \
404+
&& curl --retry 5 --retry-all-errors -fsSL "https://raw.githubusercontent.com/microsoft/vscode-dev-containers/main/script-library/github-debian.sh" -o /tmp/github-debian.sh \
405+
&& bash /tmp/github-debian.sh \
406+
&& rm /tmp/github-debian.sh \
380407
&& rm -rf /var/lib/apt/lists/*
381408

382409
# Ensure we have the most up to date version of the public key for
@@ -389,7 +416,7 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
389416
# TODO(benh): do we need this once/if the 'FROM' gets updated correctly?
390417
#
391418
# TODO(gorm,rjh): try out whether this is still needed.
392-
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
419+
RUN curl --retry 5 --retry-all-errors -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
393420
&& chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
394421
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null
395422

@@ -398,7 +425,7 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | d
398425
#
399426
# We use the latest Buildifier version that matches our Bazel major version.
400427
ARG BUILDIFIER_VERSION=6.4.0
401-
RUN wget https://github.com/bazelbuild/buildtools/releases/download/v${BUILDIFIER_VERSION}/buildifier-linux-${TARGETARCH} \
428+
RUN wget --tries=5 --waitretry=10 --retry-connrefused https://github.com/bazelbuild/buildtools/releases/download/v${BUILDIFIER_VERSION}/buildifier-linux-${TARGETARCH} \
402429
&& chmod +x ./buildifier-linux-${TARGETARCH} \
403430
&& mv ./buildifier-linux-${TARGETARCH} /usr/local/bin/buildifier
404431

@@ -408,7 +435,7 @@ RUN wget https://github.com/bazelbuild/buildtools/releases/download/v${BUILDIFIE
408435
ARG NODE_MAJOR=20
409436
ARG NPM_VERSION=11.5.1
410437
RUN mkdir -p /etc/apt/keyrings \
411-
&& curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
438+
&& curl --retry 5 --retry-all-errors -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
412439
&& echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
413440
&& apt-get update \
414441
&& DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs \
@@ -450,7 +477,7 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq fish \
450477
# We need 'google-chrome-stable' for test purposes, we do not run tests on arm64
451478
# (currently).
452479
RUN if [ "${TARGETARCH}" = "amd64" ]; then \
453-
wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
480+
wget --tries=5 --waitretry=10 --retry-connrefused -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
454481
&& sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list' \
455482
&& apt-get update -qqy \
456483
&& DEBIAN_FRONTEND=noninteractive apt-get install -qqy google-chrome-stable; \
@@ -468,15 +495,15 @@ RUN set -e; \
468495
else \
469496
echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
470497
fi; \
471-
curl "https://awscli.amazonaws.com/awscli-exe-linux-${ARCH_SUFFIX}.zip" -o "awscliv2.zip" \
498+
curl --retry 5 --retry-all-errors -f "https://awscli.amazonaws.com/awscli-exe-linux-${ARCH_SUFFIX}.zip" -o "awscliv2.zip" \
472499
&& unzip awscliv2.zip \
473500
&& ./aws/install \
474501
&& rm awscliv2.zip
475502

476503
# Install `aws-iam-authenticator`, which `kubectl` uses to authenticate with
477504
# AWS.
478505
ARG AWS_IAM_AUTHENTICATOR_VERSION=0.6.11
479-
RUN curl -Lo aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_IAM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_IAM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
506+
RUN curl --retry 5 --retry-all-errors -fLo aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v${AWS_IAM_AUTHENTICATOR_VERSION}/aws-iam-authenticator_${AWS_IAM_AUTHENTICATOR_VERSION}_linux_${TARGETARCH} \
480507
&& chmod +x ./aws-iam-authenticator \
481508
&& mv ./aws-iam-authenticator /usr/local/bin/
482509

@@ -494,7 +521,7 @@ RUN set -e; \
494521
echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
495522
fi; \
496523
ARCHIVE_NAME="pulumi-v${PULUMI_VERSION}-linux-${ARCH_SUFFIX}.tar.gz"; \
497-
wget https://get.pulumi.com/releases/sdk/${ARCHIVE_NAME} \
524+
wget --tries=5 --waitretry=10 --retry-connrefused https://get.pulumi.com/releases/sdk/${ARCHIVE_NAME} \
498525
&& tar -xvf ${ARCHIVE_NAME} \
499526
&& mv ./pulumi/* /usr/local/bin/ \
500527
&& rm ${ARCHIVE_NAME}
@@ -503,7 +530,10 @@ RUN set -e; \
503530
# versions. (The latter is optional but enables the Python versions to be
504531
# cached in the Docker image).
505532
USER $UNAME
506-
RUN curl -LsSf https://astral.sh/uv/0.11.13/install.sh | sh \
533+
RUN curl --retry 5 --retry-all-errors -LsSf https://astral.sh/uv/0.11.13/install.sh \
534+
-o /tmp/uv-install.sh \
535+
&& sh /tmp/uv-install.sh \
536+
&& rm /tmp/uv-install.sh \
507537
&& "$HOME/.local/bin/uv" python install 3.10.13 3.11.8 3.12.2
508538

509539
# Bazel's `--incompatible_strict_action_env` causes a hardcoded PATH to be used which
@@ -520,7 +550,10 @@ RUN echo "export PATH=\"$HOME/.local/bin:\$PATH\"" >> "$HOME/.bashrc"
520550
# like `uv` above so non-interactive shells and other users find it too.
521551
# It's a human-driven tool, so we don't pin the version and leave
522552
# auto-update on.
523-
RUN curl -fsSL https://claude.ai/install.sh | bash \
553+
RUN curl --retry 5 --retry-all-errors -fsSL https://claude.ai/install.sh \
554+
-o /tmp/claude-install.sh \
555+
&& bash /tmp/claude-install.sh \
556+
&& rm /tmp/claude-install.sh \
524557
&& sudo ln -sf "$HOME/.local/bin/claude" /usr/local/bin/claude
525558

526559
# Give Claude Code the headless Chrome DevTools MCP server in the user's
@@ -533,21 +566,24 @@ USER root
533566

534567
# Install Helm.
535568
ARG HELM_VERSION=3.15.4
536-
RUN wget https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \
569+
RUN wget --tries=5 --waitretry=10 --retry-connrefused https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \
537570
&& tar --to-stdout -xvf ./helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz linux-${TARGETARCH}/helm > /usr/local/bin/helm \
538571
&& rm ./helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \
539572
&& chmod +x /usr/local/bin/helm
540573

541574
# Install the Helm chart-testing tool.
542575
ARG CHART_TESTING_VERSION=3.11.0
543-
RUN wget https://github.com/helm/chart-testing/releases/download/v${CHART_TESTING_VERSION}/chart-testing_${CHART_TESTING_VERSION}_linux_${TARGETARCH}.tar.gz \
576+
RUN wget --tries=5 --waitretry=10 --retry-connrefused https://github.com/helm/chart-testing/releases/download/v${CHART_TESTING_VERSION}/chart-testing_${CHART_TESTING_VERSION}_linux_${TARGETARCH}.tar.gz \
544577
&& tar --to-stdout -xvf ./chart-testing_${CHART_TESTING_VERSION}_linux_${TARGETARCH}.tar.gz ct > /usr/local/bin/ct \
545578
&& rm ./chart-testing_${CHART_TESTING_VERSION}_linux_${TARGETARCH}.tar.gz \
546579
&& chmod +x /usr/local/bin/ct
547580

548581
# Install `pnpm` at a version compatible with our `aspect_rules_js`.
549582
ARG PNPM_VERSION=8.15.8
550-
RUN curl -fsSL https://get.pnpm.io/install.sh | env PNPM_VERSION=${PNPM_VERSION} sh -
583+
RUN curl --retry 5 --retry-all-errors -fsSL https://get.pnpm.io/install.sh \
584+
-o /tmp/pnpm-install.sh \
585+
&& env PNPM_VERSION=${PNPM_VERSION} sh /tmp/pnpm-install.sh \
586+
&& rm /tmp/pnpm-install.sh
551587

552588
# Install additional npm packages: `corepack` in order to get `yarn`, and the
553589
# Firebase CLI.
@@ -568,7 +604,7 @@ RUN set -e; \
568604
TMPDIR="$(mktemp -d)" \
569605
&& cd "${TMPDIR}" \
570606
&& KREW="krew-linux_${TARGETARCH}" \
571-
&& curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/download/${KREW_VERSION}/${KREW}.tar.gz" \
607+
&& curl --retry 5 --retry-all-errors -fsSLO "https://github.com/kubernetes-sigs/krew/releases/download/${KREW_VERSION}/${KREW}.tar.gz" \
572608
&& tar zxf "${KREW}.tar.gz" \
573609
&& ./"${KREW}" install krew \
574610
&& ln -s "${KREW_ROOT}/bin/kubectl-krew" /usr/local/bin/kubectl-krew \
@@ -652,7 +688,9 @@ RUN if [ "${TARGETARCH}" = "amd64" ]; then \
652688
# above). Only on amd64, matching the SDK install above.
653689
USER $UNAME
654690
RUN if [ "${TARGETARCH}" = "amd64" ]; then \
655-
curl -fsSL "https://get.maestro.mobile.dev" | bash; \
691+
curl --retry 5 --retry-all-errors -fsSL "https://get.maestro.mobile.dev" -o /tmp/maestro-install.sh \
692+
&& bash /tmp/maestro-install.sh \
693+
&& rm /tmp/maestro-install.sh; \
656694
fi
657695
USER root
658696

@@ -777,7 +815,7 @@ RUN set -e; \
777815
else \
778816
echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
779817
fi; \
780-
wget -O /usr/local/bin/bazel https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_VERSION}/bazelisk-linux-${ARCH_SUFFIX} \
818+
wget --tries=5 --waitretry=10 --retry-connrefused -O /usr/local/bin/bazel https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_VERSION}/bazelisk-linux-${ARCH_SUFFIX} \
781819
&& chmod +x /usr/local/bin/bazel
782820

783821
# Install Python build dependencies.
@@ -824,7 +862,7 @@ RUN set -e; \
824862
echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
825863
fi; \
826864
BINARY_NAME="envoy-${ENVOY_VERSION}-linux-${ARCH_SUFFIX}"; \
827-
wget https://github.com/envoyproxy/envoy/releases/download/v${ENVOY_VERSION}/${BINARY_NAME}; \
865+
wget --tries=5 --waitretry=10 --retry-connrefused https://github.com/envoyproxy/envoy/releases/download/v${ENVOY_VERSION}/${BINARY_NAME}; \
828866
chmod +x ${BINARY_NAME}; \
829867
mv ${BINARY_NAME} /usr/local/bin/envoy
830868

@@ -834,7 +872,10 @@ RUN dnf install -y nodejs && dnf clean all
834872
# Install uv for the builder user. We create a symlink in /usr/local/bin
835873
# so it's accessible on the PATH regardless of the user.
836874
USER builder
837-
RUN curl -LsSf https://astral.sh/uv/0.11.13/install.sh | sh
875+
RUN curl --retry 5 --retry-all-errors -LsSf https://astral.sh/uv/0.11.13/install.sh \
876+
-o /tmp/uv-install.sh \
877+
&& sh /tmp/uv-install.sh \
878+
&& rm /tmp/uv-install.sh
838879

839880
USER root
840881
RUN ln -sf /home/builder/.local/bin/uv /usr/local/bin/uv

0 commit comments

Comments
 (0)