The Android image: JDK, SDK, NDK, Gradle and the app's dependencies, offline (closes #19) c8917cf1f931

# The OxygenFlow Android image (oxygenflow#19): a JDK, the Android SDK and

# NDK, Gradle, cargo-ndk, the crates and Gradle dependencies of the

# OxygenHub app, so its build and tests run in a job with no network.

# Built by ./build.sh, which fetches and checks the downloads first.

FROM rust:1.97.1-slim-bookworm

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates openjdk-17-jdk-headless unzip make git pkg-config \

 && rm -rf /var/lib/apt/lists/*

# The guest's PATH is fixed and has no /usr/local/cargo/bin, and a rustup

# proxy would need RUSTUP_HOME: link the toolchain's own binaries instead.

RUN rustup target add aarch64-linux-android x86_64-linux-android \

 && cargo install --locked --version 4.1.2 --root /opt/cargo-ndk cargo-ndk \

 && rm -rf /usr/local/cargo/registry /usr/local/cargo/git \

 && tc=$(ls -d /usr/local/rustup/toolchains/*/ | head -1) \

 && for b in cargo rustc rustdoc; do ln -sf "$tc/bin/$b" /usr/local/bin/$b; done \

 && ln -sf /opt/cargo-ndk/bin/cargo-ndk /usr/local/bin/cargo-ndk

# The SDK: Google's command-line tools (checked by build.sh), then the

# platform, build tools and NDK the app names, licences accepted here.

ENV ANDROID_HOME=/opt/android-sdk JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64

COPY dl/cmdline-tools.zip /tmp/cmdline-tools.zip

RUN mkdir -p "$ANDROID_HOME/cmdline-tools" \

 && unzip -q /tmp/cmdline-tools.zip -d /tmp/ct \

 && mv /tmp/ct/cmdline-tools "$ANDROID_HOME/cmdline-tools/latest" \

 && rm -rf /tmp/ct /tmp/cmdline-tools.zip \

 && yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null \

 && "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --install \

      "platforms;android-37.0" "build-tools;36.0.0" "ndk;30.0.16248370" >/dev/null

# Gradle itself (checked by build.sh): jobs run `gradle`, not the wrapper,

# which would download its distribution.

ARG GRADLE_VERSION

COPY dl/gradle.zip /tmp/gradle.zip

RUN unzip -q /tmp/gradle.zip -d /opt && rm /tmp/gradle.zip \

 && ln -sf /opt/gradle-${GRADLE_VERSION}/bin/gradle /usr/local/bin/gradle

# The app's crates, vendored: cargo reads /.cargo/config.toml for any

# directory under /, so rust-core builds offline.

COPY vendor /opt/vendor

COPY cargo-config.toml /.cargo/config.toml

# Gradle's dependencies: build the app once here, with the network, and

# keep what Gradle fetched as a read-only cache (GRADLE_RO_DEP_CACHE) that

# a job's own, writable GRADLE_USER_HOME reads first. A failing test does

# not matter here; only the downloads do.

COPY app /tmp/app

RUN cd /tmp/app \

 && printf 'sdk.dir=%s\n' "$ANDROID_HOME" > local.properties \

 && (GRADLE_USER_HOME=/opt/gradle-home gradle --no-daemon -q --continue \

      :app:assembleDebug :app:testDebugUnitTest :app:lintDebug :app:validateDebugScreenshotTest || true) \

 && test -d /opt/gradle-home/caches/modules-2 \

 && cd / && rm -rf /tmp/app /opt/gradle-home/daemon /opt/gradle-home/native /opt/gradle-home/wrapper \

      /opt/gradle-home/caches/[0-9]* /opt/gradle-home/caches/transforms-* /opt/gradle-home/caches/build-cache-* \

      /opt/gradle-home/caches/journal-* /opt/gradle-home/caches/jars-* \

 && rm -f /opt/gradle-home/caches/modules-2/*.lock /opt/gradle-home/caches/modules-2/gc.properties \

 && chmod -R a+rX /opt/gradle-home "$ANDROID_HOME" /opt/vendor

# The OxygenFlow Android image

A root file system for building and testing the OxygenHub Android app (`oxygenhub-android`) in a job with no network (oxygenflow#19):

- OpenJDK 17 (`JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64`).

- The Android SDK in `/opt/android-sdk` (`ANDROID_HOME`): command-line tools 23.0 (checked against Google's published SHA-1), `platforms;android-37.0`, `build-tools;36.0.0` and `ndk;30.0.16248370`, licences accepted.

- Gradle 9.6.0 as `gradle` (checked against its published SHA-256). Jobs run `gradle --offline`, not `./gradlew`, which would download its distribution.

- Rust 1.97.1 with the `aarch64-linux-android` and `x86_64-linux-android` targets and cargo-ndk 4.1.2, for the app's `rust-core`.

- `rust-core`'s crates, vendored in `/opt/vendor`; `/.cargo/config.toml` points cargo at them, as in the rust image.

- The app's Gradle dependencies in `/opt/gradle-home/caches`, fetched by building the app once while the image is built.

The Gradle cache is read-only in the guest. A job points `GRADLE_RO_DEP_CACHE` at it and gives Gradle its own writable `GRADLE_USER_HOME`, so Gradle reads dependencies from the image and writes everything else under `/tmp`.

## Building and importing

```

images/android/build.sh /path/to/oxygenflow-android.tar

scp /path/to/oxygenflow-android.tar claude@earth:/home/claude/flow/dl/

ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-android.tar'

```

`build.sh` expects the app next to this repository (`../oxygenhub-android`, subrepos checked out). It downloads and checks the command-line tools and Gradle into `images/android/dl/`, copies the app without its build output, vendors `rust-core`'s crates, then builds the image with Docker and exports it as a plain tarball. The tarball is about 6 GB, so build it where the disk has room (Earth) and delete it once imported.

Rebuild and re-import when the app changes its SDK, NDK, Gradle or dependency versions, or `rust-core/Cargo.lock` changes, then pin the new hash in the app's pipeline. A dependency missing from the image fails the job with Gradle's "No cached version … available for offline mode", or cargo's "no matching package".

## Using it

```kdl

sandbox "android" {

    runtime "microvm"

    rootfs "cas://blob/<hash printed by flow rootfs import>"

    memory-limit "8GiB"

    cpu-limit 4

    network "isolated"

}

job "test" {

    sandbox "android"

    env {

        ANDROID_HOME "/opt/android-sdk"

        JAVA_HOME "/usr/lib/jvm/java-17-openjdk-amd64"

        GRADLE_RO_DEP_CACHE "/opt/gradle-home/caches"

        GRADLE_USER_HOME "/tmp/gradle"

    }

    exec "gradle" "--offline" "--no-daemon" ":app:testDebugUnitTest"

}

```

#!/bin/sh

# Build the OxygenFlow Android image and write it as a root file system

# tarball for `flow rootfs import` (oxygenflow#19). Run from any directory;

# the app is expected next to this repository (../oxygenhub-android), with

# its subrepos checked out. Rebuild when the app's SDK, NDK, Gradle or

# dependency versions change, or rust-core's Cargo.lock does.

set -eu

here=$(cd "$(dirname "$0")" && pwd)

dev=$(cd "$here/../../.." && pwd)

app="$dev/oxygenhub-android"

out=${1:-$here/oxygenflow-android.tar}

# Command-line tools 23.0, as Google's repository2-3.xml lists them.

CMDLINE_TOOLS=commandlinetools-linux-16111833_latest.zip

CMDLINE_TOOLS_SHA1=e025545c62a8e64c7559119566a569fb1dec5f60

GRADLE_VERSION=9.6.0

mkdir -p "$here/dl"

if [ ! -f "$here/dl/cmdline-tools.zip" ]; then

    curl -fsSL "https://dl.google.com/android/repository/$CMDLINE_TOOLS" -o "$here/dl/cmdline-tools.zip"

fi

echo "$CMDLINE_TOOLS_SHA1  $here/dl/cmdline-tools.zip" | sha1sum -c - >/dev/null

if [ ! -f "$here/dl/gradle.zip" ]; then

    curl -fsSL "https://services.gradle.org/distributions/gradle-$GRADLE_VERSION-bin.zip" -o "$here/dl/gradle.zip"

fi

# Gradle publishes each distribution's SHA-256 beside it.

want=$(curl -fsSL "https://services.gradle.org/distributions/gradle-$GRADLE_VERSION-bin.zip.sha256")

echo "$want  $here/dl/gradle.zip" | sha256sum -c - >/dev/null

# The app, without build output, and rust-core's crates vendored.

rm -rf "$here/app" "$here/vendor"

mkdir -p "$here/app"

tar -C "$app" --exclude='./build' --exclude='./app/build' --exclude='./rust-core/target' \

    --exclude='./.gradle' --exclude='./.oxy' --exclude='./local.properties' -cf - . | tar -C "$here/app" -xf -

cargo vendor --locked --versioned-dirs --manifest-path "$app/rust-core/Cargo.toml" "$here/vendor" >/dev/null

chmod -R a+rX "$here/vendor" "$here/app"

docker build -q -t oxygenflow-android --build-arg GRADLE_VERSION=$GRADLE_VERSION "$here"

id=$(docker create oxygenflow-android)

docker export "$id" -o "$out"

docker rm "$id" >/dev/null

rm -rf "${here:?}/app" "${here:?}/vendor"

echo "$out"

# Crates come from the image, never the network (OxygenFlow jobs are isolated).

[source.crates-io]

replace-with = "vendored"

[source.vendored]

directory = "/opt/vendor"

[net]

offline = true

images/android/dl/

images/android/app/

images/android/vendor/

images/android/*.tar

- **The Android image (#19).** `images/android`: OpenJDK 17, the Android SDK (command-line tools 23.0, platform 37.0, build-tools 36.0.0, NDK 30.0), Gradle 9.6.0, Rust with the Android targets and cargo-ndk, and the OxygenHub app's crates and Gradle dependencies, so the app builds and tests offline. Each download is checked against its published hash.