Install ws2tcp-local, add entrypoint script and Claude installation handling

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -19,13 +19,6 @@ Use environment variables to select the container engine or override image names
 CONTAINER_ENGINE=podman IMAGE_NAME=my-build-env ./rocky9/build.sh
 ```
 
-The Debian 13 and Rocky Linux 9 images install every library under `/opt/local` by default. Set `PREFIX` to install them elsewhere; the build environment variables (`PATH`, `PKG_CONFIG_PATH`, `CMAKE_PREFIX_PATH`, `CMAKE_INSTALL_PREFIX`, and so on) follow it. Rust is a build tool rather than a library, so it always lives under `/usr/local` and is not affected by `PREFIX`. The Alpine image does not support `PREFIX`.
-
-```sh
-PREFIX=/opt/stack ./debian13/build.sh
-PREFIX=/opt/stack ./rocky9/build.sh
-```
-
 ## Run
 
 ```sh

alpine3.24/Dockerfile

@@ -461,7 +461,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS="-fPIC -std=gnu17" ./configure --prefix=/usr/local --disable-shared --enable-static --enable-fat \
+    && CFLAGS="-fPIC -std=gnu17" ./configure --prefix=/usr/local --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \

debian13/Dockerfile

@@ -23,11 +23,11 @@ RUN sed -i 's|deb.debian.org|mirrors.ustc.edu.cn|g' /etc/apt/sources.list.d/debi
 
 # Install prefix of every dependency, and the Debian multiarch directory name (`gcc -dumpmachine`)
 # its libraries are installed under; build.sh derives the latter from `uname -m`.
-ARG PREFIX=/opt/local
+ARG PREFIX=/usr/local
 ARG MULTIARCH=x86_64-linux-gnu
 
 # Make the compiler, CMake, pkg-config and the shell find earlier dependencies under a prefix other
-# than the default /opt/local. CMake (>= 3.29) takes its default install prefix from the environment.
+# than the default /usr/local. CMake (>= 3.29) takes its default install prefix from the environment.
 ENV PATH=${PREFIX}/bin:${PATH} \
     C_INCLUDE_PATH=${PREFIX}/include \
     CPLUS_INCLUDE_PATH=${PREFIX}/include \
@@ -38,11 +38,12 @@ ENV PATH=${PREFIX}/bin:${PATH} \
 
 RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
 
-# Rust is a build tool, not a library, so it is installed under /usr/local regardless of ${PREFIX}.
+RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
+
 RUN --mount=type=bind,from=sources,source=rust,target=/tmp/rust \
     mkdir rust-src \
     && tar -xJf "/tmp/rust/rust-1.99.1-$(uname -m)-unknown-linux-gnu.tar.xz" -C rust-src --strip-components=1 \
-    && rust-src/install.sh --prefix=/usr/local --without=rust-docs \
+    && rust-src/install.sh --prefix=${PREFIX} --without=rust-docs \
     && rm -rf rust-src
 
 RUN --mount=type=bind,from=sources,source=boost_1_83_0.tar.bz2,target=/tmp/boost.tar.bz2 \
@@ -566,7 +567,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static --enable-fat \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib/$(gcc -dumpmachine) --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -819,8 +820,19 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
-COPY source-stack.cmake.in /tmp/
+RUN cargo install --locked --version 0.11.0 --root /usr/local ws2tcp-local \
-RUN mkdir -p ${PREFIX}/share/source-stack \
+    && rm -rf /root/.cargo/registry /root/.cargo/git
-    && sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \
+
-        > ${PREFIX}/share/source-stack/source-stack.cmake \
+RUN bash -c 'curl -fsSL https://claude.ai/install.sh | bash'
-    && rm /tmp/source-stack.cmake.in
+
+COPY --chmod=755 entrypoint.sh /usr/local/bin/
+
+ENV PATH="/root/.local/bin:${PATH}"
+
+ARG CLAUDE_CODE_OAUTH_TOKEN
+ENV CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN}
+
+ARG WS2TCP_LOCAL_BASIC_AUTH
+ENV WS2TCP_LOCAL_BASIC_AUTH=${WS2TCP_LOCAL_BASIC_AUTH}
+
+ENTRYPOINT ["entrypoint.sh"]

debian13/build.sh

@@ -1,10 +1,38 @@
 #!/bin/sh
+# Usage:
+#   ./build.sh            build the image, asking for the password that unlocks the token
+#   ./build.sh --encrypt  encrypt a token and print the value to paste into ENCRYPTED_TOKEN
 
 set -eu
 
 IMAGE_NAME="${IMAGE_NAME:-debian13-source-stack}"
-PREFIX="${PREFIX:-/opt/local}"
+PREFIX="${PREFIX:-/usr/local}"
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+# CLAUDE_CODE_OAUTH_TOKEN encrypted with AES-256-CBC (PBKDF2, base64). Generate with --encrypt.
+ENCRYPTED_TOKEN='U2FsdGVkX1/BCTASs0tR40hsT+sngp46zANCbGZnklLN1M0wSJs/DxbQ6JDg593G09A+cVtVius4hJHRzB6caOO2KwBV0/+i7yUjr/PfreZksrdkz1DnFc7oorxXfvB7azuNEkQfAE2fZg8cnYL5jy3/LKRdAm11SUm83fU8ke8='
+
+OPENSSL_ARGS="enc -aes-256-cbc -pbkdf2 -iter 600000 -a -A"
+
+if ! command -v openssl >/dev/null 2>&1; then
+    echo "Error: OpenSSL is required." >&2
+    exit 1
+fi
+
+# read_secret PROMPT VARNAME: read the input with echo on, so it stays visible while typing.
+read_secret() {
+    printf '%s' "$1" >&2
+    IFS= read -r "$2"
+}
+
+if [ "${1:-}" = "--encrypt" ]; then
+    read_secret "OAuth token: " token
+    read_secret "Password: " BUILD_PASSWORD
+    export BUILD_PASSWORD
+    printf '%s' "$token" | openssl $OPENSSL_ARGS -pass env:BUILD_PASSWORD
+    echo
+    exit 0
+fi
 SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
 FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
 
@@ -13,6 +41,28 @@ if ! command -v podman >/dev/null 2>&1; then
     exit 1
 fi
 
+if [ -z "$ENCRYPTED_TOKEN" ]; then
+    echo "Error: ENCRYPTED_TOKEN is empty; run './build.sh --encrypt' and paste the output into build.sh." >&2
+    exit 1
+fi
+
+read_secret "Password for CLAUDE_CODE_OAUTH_TOKEN: " BUILD_PASSWORD
+export BUILD_PASSWORD
+if ! CLAUDE_CODE_OAUTH_TOKEN=$(printf '%s' "$ENCRYPTED_TOKEN" | openssl $OPENSSL_ARGS -d -pass env:BUILD_PASSWORD 2>/dev/null); then
+    echo "Error: wrong password or corrupted token." >&2
+    exit 1
+fi
+unset BUILD_PASSWORD
+
+printf 'ws2tcp-local username: ' >&2
+IFS= read -r WS2TCP_USER
+read_secret "ws2tcp-local password: " WS2TCP_PASS
+WS2TCP_LOCAL_BASIC_AUTH="$WS2TCP_USER:$WS2TCP_PASS"
+unset WS2TCP_USER WS2TCP_PASS
+export WS2TCP_LOCAL_BASIC_AUTH
+# Exported so podman reads the value from the environment and it never appears in the command line.
+export CLAUDE_CODE_OAUTH_TOKEN
+
 SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
 
 # macOS reports arm64 where Linux (and Debian multiarch) call it aarch64.
@@ -20,6 +70,9 @@ ARCH=$(uname -m)
 [ "$ARCH" = arm64 ] && ARCH=aarch64
 
 echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
-exec podman build --build-context sources="$SOURCES_DIR" \
+exec podman build \
+    --build-arg CLAUDE_CODE_OAUTH_TOKEN \
+    --build-arg WS2TCP_LOCAL_BASIC_AUTH \
+    --build-context sources="$SOURCES_DIR" \
     --build-arg PREFIX="$PREFIX" --build-arg MULTIARCH="$ARCH-linux-gnu" \
     --tag "$IMAGE_NAME" "$SCRIPT_DIR"

debian13/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# Start ws2tcp-local (logging to a file so it does not garble the claude TUI), point the proxy variables at it, then run claude.
+set -eu
+
+GATEWAY="wss://wangguofang.net/tunnel"
+LISTEN_HOST=127.0.0.1
+LISTEN_PORT=3128
+LOG_FILE="${WS2TCP_LOCAL_LOG:-/tmp/ws2tcp-local.log}"
+
+# The credentials come from WS2TCP_LOCAL_BASIC_AUTH (user:pass), set at image build time.
+ws2tcp-local --gateway "$GATEWAY" --listen "$LISTEN_HOST:$LISTEN_PORT" >"$LOG_FILE" 2>&1 &
+proxy_pid=$!
+
+for _ in $(seq 1 50); do
+    if (exec 3<>"/dev/tcp/$LISTEN_HOST/$LISTEN_PORT") 2>/dev/null; then
+        break
+    fi
+    if ! kill -0 "$proxy_pid" 2>/dev/null; then
+        echo "Error: ws2tcp-local exited during startup. Log ($LOG_FILE):" >&2
+        cat "$LOG_FILE" >&2
+        exit 1
+    fi
+    sleep 0.2
+done
+
+export http_proxy="http://$LISTEN_HOST:$LISTEN_PORT"
+export https_proxy="$http_proxy"
+export HTTP_PROXY="$http_proxy"
+export HTTPS_PROXY="$http_proxy"
+export no_proxy="localhost,127.0.0.1"
+export NO_PROXY="$no_proxy"
+
+trap 'kill "$proxy_pid" 2>/dev/null || true' EXIT
+claude "$@"

debian13/source-stack.cmake.in

@@ -1,52 +0,0 @@
-# Generated into the image at ${PREFIX}/share/source-stack/source-stack.cmake.
-#
-# Points CMake at the dependencies installed by this image. It mirrors the
-# Dockerfile's ENV block (PATH, PKG_CONFIG_PATH, CMAKE_PREFIX_PATH,
-# C_INCLUDE_PATH/CPLUS_INCLUDE_PATH, LIBRARY_PATH) for CMake's own lookups.
-# The prefix is derived from this file's location, so it also works when the
-# prefix is moved. Include it after project(), before the first find_package().
-#
-#   GW_SOURCE_STACK_ONLY  resolve libraries and packages only below the prefix
-
-option(GW_SOURCE_STACK_ONLY
-    "Resolve libraries and packages only below the source-stack prefix" OFF)
-
-get_filename_component(_ss_p "${CMAKE_CURRENT_LIST_DIR}/../.." ABSOLUTE)
-set(_ss_multiarch "@MULTIARCH@")
-
-list(PREPEND CMAKE_PREFIX_PATH "${_ss_p}")
-list(PREPEND CMAKE_PROGRAM_PATH "${_ss_p}/bin")
-list(PREPEND CMAKE_INCLUDE_PATH "${_ss_p}/include")
-list(PREPEND CMAKE_LIBRARY_PATH "${_ss_p}/lib/${_ss_multiarch}" "${_ss_p}/lib")
-
-# pkg_check_modules() reads PKG_CONFIG_PATH at call time.
-set(_ss_pc "${_ss_p}/lib/${_ss_multiarch}/pkgconfig:${_ss_p}/lib/pkgconfig:${_ss_p}/share/pkgconfig")
-if(GW_SOURCE_STACK_ONLY)
-    # PKG_CONFIG_LIBDIR replaces the default search path, so system .pc files are ignored.
-    set(ENV{PKG_CONFIG_LIBDIR} "${_ss_pc}")
-    set(ENV{PKG_CONFIG_PATH} "")
-    # Build tools come from the system; look them up before system paths are switched off.
-    find_program(PKG_CONFIG_EXECUTABLE NAMES pkg-config pkgconf)
-    set(CMAKE_FIND_USE_CMAKE_SYSTEM_PATH OFF)
-    set(CMAKE_FIND_USE_SYSTEM_ENVIRONMENT_PATH OFF)
-    set(CMAKE_FIND_ROOT_PATH "${_ss_p}")
-    set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
-    set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
-    set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
-else()
-    if(NOT "$ENV{PKG_CONFIG_PATH}" STREQUAL "")
-        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}:$ENV{PKG_CONFIG_PATH}")
-    else()
-        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}")
-    endif()
-endif()
-
-# protoc installed next to the libraries, unless the caller chose one.
-if(NOT Protobuf_PROTOC_EXECUTABLE AND EXISTS "${_ss_p}/bin/protoc")
-    set(Protobuf_PROTOC_EXECUTABLE "${_ss_p}/bin/protoc" CACHE FILEPATH "protoc")
-endif()
-
-message(STATUS "source-stack: ${_ss_p} (${_ss_multiarch})")
-unset(_ss_p)
-unset(_ss_multiarch)
-unset(_ss_pc)

rocky9/Dockerfile

@@ -9,9 +9,8 @@ RUN dnf install --assumeyes --enablerepo=crb \
         curl-minimal \
         gcc \
         gcc-c++ \
-        libasan \
         gcc-toolset-15-gcc-c++ \
-        gcc-toolset-15-libasan-devel \
+        libasan \
         git \
         libtool \
         make \
@@ -37,22 +36,6 @@ RUN dnf install --assumeyes --enablerepo=crb \
 
 RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
 
-# Install prefix of every dependency. Libraries are installed under ${PREFIX}/lib64.
-ARG PREFIX=/opt/local
-
-# Make the compiler, CMake, pkg-config and the shell find earlier dependencies under a prefix other
-# than the default /opt/local. CMake (>= 3.29) takes its default install prefix from the environment.
-ENV PATH=${PREFIX}/bin:${PATH} \
-    C_INCLUDE_PATH=${PREFIX}/include \
-    CPLUS_INCLUDE_PATH=${PREFIX}/include \
-    LIBRARY_PATH=${PREFIX}/lib64:${PREFIX}/lib \
-    PKG_CONFIG_PATH=${PREFIX}/lib64/pkgconfig:${PREFIX}/lib/pkgconfig:${PREFIX}/share/pkgconfig \
-    CMAKE_PREFIX_PATH=${PREFIX} \
-    CMAKE_INSTALL_PREFIX=${PREFIX}
-
-RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
-
-# Rust is a build tool, not a library, so it is installed under /usr/local regardless of ${PREFIX}.
 RUN --mount=type=bind,from=sources,source=rust,target=/tmp/rust \
     mkdir rust-src \
     && tar -xJf "/tmp/rust/rust-1.99.1-$(uname -m)-unknown-linux-gnu.tar.xz" -C rust-src --strip-components=1 \
@@ -63,7 +46,7 @@ RUN --mount=type=bind,from=sources,source=boost_1_83_0.tar.bz2,target=/tmp/boost
     mkdir src \
     && tar --extract --bzip2 --file=/tmp/boost.tar.bz2 --directory=src --strip-components=1 \
     && cd src \
-    && ./bootstrap.sh --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+    && ./bootstrap.sh --prefix=/usr/local --libdir=/usr/local/lib64 \
     && ./b2 --jobs="$(nproc)" \
         --with-atomic \
         --with-chrono \
@@ -89,7 +72,7 @@ RUN --mount=type=bind,from=sources,source=openssl-openssl-3.0.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/openssl.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && ./Configure --prefix=${PREFIX} no-shared no-tests -fPIC \
+    && ./Configure --prefix=/usr/local no-shared no-tests -fPIC \
     && make --jobs="$(nproc)" \
     && make install_sw \
     && cd .. \
@@ -127,7 +110,7 @@ RUN --mount=type=bind,from=sources,source=zlib-v1.3.1.tar.gz,target=/tmp/zlib.ta
     mkdir src \
     && tar --extract --gzip --file=/tmp/zlib.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --static \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -220,7 +203,7 @@ RUN --mount=type=bind,from=sources,source=gflags-v2.3.1.tar.gz,target=/tmp/gflag
         -DINSTALL_HEADERS=ON \
         -DINSTALL_SHARED_LIBS=OFF \
         -DINSTALL_STATIC_LIBS=ON \
-        -DLIBRARY_INSTALL_DIR=${PREFIX}/lib64 \
+        -DLIBRARY_INSTALL_DIR=/usr/local/lib64 \
         -DREGISTER_INSTALL_PREFIX=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
@@ -243,7 +226,7 @@ RUN --mount=type=bind,from=sources,source=liburing-liburing-2.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/liburing.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --libdevdir=${PREFIX}/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --libdevdir=/usr/local/lib64 \
     && make --jobs="$(nproc)" ENABLE_SHARED=0 library \
     && make ENABLE_SHARED=0 install \
     && cd .. \
@@ -253,7 +236,7 @@ RUN --mount=type=bind,from=sources,source=libaio_0.3.113.orig.tar.gz,target=/tmp
     mkdir src \
     && tar --extract --gzip --file=/tmp/libaio.tar.gz --directory=src --strip-components=1 \
     && make --directory=src --jobs="$(nproc)" ENABLE_SHARED=0 \
-    && make --directory=src ENABLE_SHARED=0 prefix=${PREFIX} libdir=${PREFIX}/lib64 install \
+    && make --directory=src ENABLE_SHARED=0 prefix=/usr/local libdir=/usr/local/lib64 install \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=libdwarf-code-v2.3.2.tar.gz,target=/tmp/libdwarf-code.tar.gz \
@@ -276,7 +259,7 @@ RUN --mount=type=bind,from=sources,source=libsodium-1.0.20-RELEASE.tar.gz,target
     && tar --extract --gzip --file=/tmp/libsodium.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --with-pic \
+    && ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static --with-pic \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -310,7 +293,7 @@ RUN --mount=type=bind,from=sources,source=numactl-v2.0.19.tar.gz,target=/tmp/num
     && tar --extract --gzip --file=/tmp/numactl.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -413,7 +396,7 @@ RUN --mount=type=bind,from=sources,source=util-linux-2.42.2.tar.xz,target=/tmp/u
     mkdir src \
     && tar --extract --xz --file=/tmp/util-linux.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
         --disable-all-programs \
         --disable-bash-completion \
         --disable-makeinstall-chown \
@@ -513,7 +496,7 @@ RUN --mount=type=bind,from=sources,source=rapidjson-v1.1.0.tar.gz,target=/tmp/ra
     && tar --extract --gzip --file=/tmp/rapidjson.tar.gz --directory=src --strip-components=1 \
     && git -C src apply /tmp/rapidjson-generic-string-ref-assignment.patch \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
-        -DLIB_INSTALL_DIR=${PREFIX}/lib64 \
+        -DLIB_INSTALL_DIR=/usr/local/lib64 \
         -DRAPIDJSON_BUILD_DOC=OFF \
         -DRAPIDJSON_BUILD_EXAMPLES=OFF \
         -DRAPIDJSON_BUILD_TESTS=OFF \
@@ -564,7 +547,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --enable-fat \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -574,7 +557,7 @@ RUN --mount=type=bind,from=sources,source=nettle-3.10.2.tar.gz,target=/tmp/nettl
     mkdir src \
     && tar --extract --gzip --file=/tmp/nettle.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
         --disable-documentation \
         --disable-shared \
         --enable-static \
@@ -587,7 +570,7 @@ RUN --mount=type=bind,from=sources,source=gnutls-3.8.13.tar.xz,target=/tmp/gnutl
     mkdir src \
     && tar --extract --xz --file=/tmp/gnutls.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
         --with-included-libtasn1 \
         --with-included-unistring \
         --disable-cxx \
@@ -626,7 +609,7 @@ RUN --mount=type=bind,from=sources,source=libyaml-0.2.5.tar.gz,target=/tmp/libya
     && tar --extract --gzip --file=/tmp/libyaml.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./bootstrap \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -664,7 +647,7 @@ RUN --mount=type=bind,from=sources,source=libunwind-v1.8.3.tar.gz,target=/tmp/li
     && tar --extract --gzip --file=/tmp/libunwind.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && autoreconf --install \
-    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
         --disable-shared \
         --enable-static \
         --disable-tests \
@@ -681,7 +664,7 @@ RUN --mount=type=bind,from=sources,source=jemalloc-5.3.1.tar.gz,target=/tmp/jema
     && tar --extract --gzip --file=/tmp/jemalloc.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
+    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
         --disable-doc \
         --disable-shared \
         --enable-static \
@@ -696,8 +679,8 @@ RUN --mount=type=bind,from=sources,source=libproxyprotocol-v1.3.3.tar.gz,target=
     mkdir src \
     && tar --extract --gzip --file=/tmp/libproxyprotocol.tar.gz --directory=src --strip-components=1 \
     && gcc -fPIC -c -o src/src/proxy_protocol.o src/src/proxy_protocol.c \
-    && ar rcs ${PREFIX}/lib64/libproxyprotocol.a src/src/proxy_protocol.o \
+    && ar rcs /usr/local/lib64/libproxyprotocol.a src/src/proxy_protocol.o \
-    && cp src/src/proxy_protocol.h ${PREFIX}/include/ \
+    && cp src/src/proxy_protocol.h /usr/local/include/ \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=xsimd-14.2.0.tar.gz,target=/tmp/xsimd.tar.gz \
@@ -717,10 +700,10 @@ RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thri
         -DBUILD_SHARED_LIBS=OFF \
         -DBUILD_TESTING=OFF \
         -DBUILD_TUTORIALS=OFF \
-        -DCMAKE_INSTALL_DIR=${PREFIX}/lib64/cmake \
+        -DCMAKE_INSTALL_DIR=/usr/local/lib64/cmake \
         -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-        -DLIB_INSTALL_DIR=${PREFIX}/lib64 \
+        -DLIB_INSTALL_DIR=/usr/local/lib64 \
-        -DPKGCONFIG_INSTALL_DIR=${PREFIX}/lib64/pkgconfig \
+        -DPKGCONFIG_INSTALL_DIR=/usr/local/lib64/pkgconfig \
         -DWITH_AS3=OFF \
         -DWITH_C_GLIB=OFF \
         -DWITH_CPP=ON \
@@ -734,7 +717,7 @@ RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thri
         -DWITH_ZLIB=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && sed -i 's|^libdir=.*|libdir=${prefix}/lib64|' \
-        ${PREFIX}/lib64/pkgconfig/thrift.pc \
+        /usr/local/lib64/pkgconfig/thrift.pc \
     && rm -rf build src
 
 RUN --mount=type=bind,from=sources,source=snappy-1.2.2.tar.gz,target=/tmp/snappy.tar.gz \
@@ -814,6 +797,4 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
-COPY source-stack.cmake ${PREFIX}/share/source-stack/source-stack.cmake
-
 CMD ["/bin/bash"]

rocky9/build.sh

@@ -3,7 +3,6 @@
 set -eu
 
 IMAGE_NAME="${IMAGE_NAME:-rocky9-source-stack}"
-PREFIX="${PREFIX:-/opt/local}"
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
 FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
@@ -15,6 +14,5 @@ fi
 
 SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
 
-echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
+echo "Building image $IMAGE_NAME with podman ..."
-exec podman build --build-context sources="$SOURCES_DIR" \
+exec podman build --build-context sources="$SOURCES_DIR" --tag "$IMAGE_NAME" "$SCRIPT_DIR"
-    --build-arg PREFIX="$PREFIX" --tag "$IMAGE_NAME" "$SCRIPT_DIR"

rocky9/source-stack.cmake

@@ -1,50 +0,0 @@
-# Installed into the image at ${PREFIX}/share/source-stack/source-stack.cmake.
-#
-# Points CMake at the dependencies installed by this image. It mirrors the
-# Dockerfile's ENV block (PATH, PKG_CONFIG_PATH, CMAKE_PREFIX_PATH,
-# C_INCLUDE_PATH/CPLUS_INCLUDE_PATH, LIBRARY_PATH) for CMake's own lookups.
-# The prefix is derived from this file's location, so it also works when the
-# prefix is moved. Include it after project(), before the first find_package().
-#
-#   GW_SOURCE_STACK_ONLY  resolve libraries and packages only below the prefix
-
-option(GW_SOURCE_STACK_ONLY
-    "Resolve libraries and packages only below the source-stack prefix" OFF)
-
-get_filename_component(_ss_p "${CMAKE_CURRENT_LIST_DIR}/../.." ABSOLUTE)
-
-list(PREPEND CMAKE_PREFIX_PATH "${_ss_p}")
-list(PREPEND CMAKE_PROGRAM_PATH "${_ss_p}/bin")
-list(PREPEND CMAKE_INCLUDE_PATH "${_ss_p}/include")
-list(PREPEND CMAKE_LIBRARY_PATH "${_ss_p}/lib64" "${_ss_p}/lib")
-
-# pkg_check_modules() reads PKG_CONFIG_PATH at call time.
-set(_ss_pc "${_ss_p}/lib64/pkgconfig:${_ss_p}/lib/pkgconfig:${_ss_p}/share/pkgconfig")
-if(GW_SOURCE_STACK_ONLY)
-    # PKG_CONFIG_LIBDIR replaces the default search path, so system .pc files are ignored.
-    set(ENV{PKG_CONFIG_LIBDIR} "${_ss_pc}")
-    set(ENV{PKG_CONFIG_PATH} "")
-    # Build tools come from the system; look them up before system paths are switched off.
-    find_program(PKG_CONFIG_EXECUTABLE NAMES pkg-config pkgconf)
-    set(CMAKE_FIND_USE_CMAKE_SYSTEM_PATH OFF)
-    set(CMAKE_FIND_USE_SYSTEM_ENVIRONMENT_PATH OFF)
-    set(CMAKE_FIND_ROOT_PATH "${_ss_p}")
-    set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
-    set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
-    set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
-else()
-    if(NOT "$ENV{PKG_CONFIG_PATH}" STREQUAL "")
-        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}:$ENV{PKG_CONFIG_PATH}")
-    else()
-        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}")
-    endif()
-endif()
-
-# protoc installed next to the libraries, unless the caller chose one.
-if(NOT Protobuf_PROTOC_EXECUTABLE AND EXISTS "${_ss_p}/bin/protoc")
-    set(Protobuf_PROTOC_EXECUTABLE "${_ss_p}/bin/protoc" CACHE FILEPATH "protoc")
-endif()
-
-message(STATUS "source-stack: ${_ss_p}")
-unset(_ss_p)
-unset(_ss_pc)