make our own docker images from ubuntu LTS

.github/workflows/format.yml

@@ -10,13 +10,9 @@ jobs:
   format:
     name: format
     runs-on: ubuntu-latest
-    container:
+    container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-4.14:latest
-      image: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-4.14:latest
-      options: --user root
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - run: chown -R opam:opam .
+      - run: opam exec -- make format-check
-
-      - run: su opam -c "opam exec -- make format-check"

.github/workflows/gh-pages.yml

@@ -8,27 +8,23 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    container:
+    container: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-5.4:latest
-      image: ghcr.io/ocaml-tracing/ocaml-opentelemetry/ci-5.4:latest
-      options: --user root
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           submodules: recursive
 
-      - run: chown -R opam:opam .
-
       - name: Install local packages
-        run: su opam -c "opam exec -- dune build @install && opam exec -- dune install"
+        run: opam exec -- dune build @install && opam exec -- dune install
 
       - name: Build documentation
         run: |
-          su opam -c "opam exec -- odig odoc --cache-dir=_doc/ \
+          opam exec -- odig odoc --cache-dir=_doc/ \
             opentelemetry opentelemetry-client opentelemetry-lwt \
             opentelemetry-cohttp-lwt opentelemetry-client-ocurl \
             opentelemetry-client-ocurl-lwt opentelemetry-client-cohttp-lwt \
-            opentelemetry-client-cohttp-eio opentelemetry-logs"
+            opentelemetry-client-cohttp-eio opentelemetry-logs
 
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3

.github/workflows/main.yml

@@ -23,30 +23,25 @@ jobs:
             eio: true
 
     runs-on: ubuntu-latest
-    container:
+    container: ${{ matrix.container }}
-      image: ${{ matrix.container }}
-      options: --user root
 
     steps:
-      - name: Checkout code
+      - uses: actions/checkout@v6
-        uses: actions/checkout@v4
         with:
           submodules: recursive
 
-      - run: chown -R opam:opam .
-
       - name: Build
-        run: su opam -c "opam exec -- dune build @install -p opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-cohttp-lwt,opentelemetry-client-ocurl,opentelemetry-client-ocurl-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs"
+        run: opam exec -- dune build @install -p opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-cohttp-lwt,opentelemetry-client-ocurl,opentelemetry-client-ocurl-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs
 
       - name: Build eio packages
         if: ${{ matrix.eio }}
-        run: su opam -c "opam exec -- dune build @install -p opentelemetry-client-cohttp-eio"
+        run: opam exec -- dune build @install -p opentelemetry-client-cohttp-eio
 
       - name: Lint (protoc check)
-        run: su opam -c "opam exec -- dune build @lint"
+        run: opam exec -- dune build @lint
 
       - name: Check no generated files changed
         run: git diff --exit-code
 
       - name: Run tests
-        run: su opam -c "opam exec -- dune build @runtest"
+        run: opam exec -- dune build @runtest

Makefile

@@ -36,19 +36,7 @@ WATCH ?= @all
 watch:
 	@dune build $(WATCH) -w $(OPTS)
 
-# --- CI Docker images ---
+include deps/Makefile.ci
-CI_REGISTRY = ghcr.io/ocaml-tracing/ocaml-opentelemetry
-CI_VERSIONS = 4.08 4.14 5.4
-
-build-ci-docker:
-	@for v in $(CI_VERSIONS); do \
-		docker build -f deps/dockerfile.$$v -t $(CI_REGISTRY)/ci-$$v:latest . ; \
-	done
-
-upload-ci-docker: build-ci-docker
-	@for v in $(CI_VERSIONS); do \
-		docker push $(CI_REGISTRY)/ci-$$v:latest ; \
-	done || ( echo  "to login:  docker login ghcr.io -u <your-github-username>" ; exit 1 )
 
 VERSION=$(shell awk '/^version:/ {print $$2}' opentelemetry.opam)
 update_next_tag:

deps/Makefile.ci

@@ -0,0 +1,44 @@
+# CI Docker images — included by top-level Makefile
+CI_REGISTRY = ghcr.io/ocaml-tracing/ocaml-opentelemetry
+CI_VERSIONS = 4.08 4.14 5.4
+# To update: curl -s https://api.github.com/repos/ocaml/opam-repository/commits/master | jq -r .sha
+OPAM_REPO_COMMIT ?= 67472cd54293d750a62d6d4423024d55f77268b0
+CI_BASE_OS_PACKAGES = pkg-config libcurl4-openssl-dev libgmp-dev mccs
+
+CI_COMMON_PACKAGES = ptime hmap pbrt pbrt_yojson ambient-context mtime \
+    thread-local-storage lwt_ppx ambient-context-lwt \
+    cohttp cohttp-lwt cohttp-lwt-unix \
+    ezcurl ezcurl-lwt ocurl logs alcotest containers \
+    trace ocaml-protoc
+
+CI_PACKAGES_408 = $(CI_COMMON_PACKAGES) lwt.5.9.2
+CI_PACKAGES_414 = $(CI_COMMON_PACKAGES) lwt.5.9.2 ocamlformat.0.27.0
+CI_PACKAGES_54  = $(CI_COMMON_PACKAGES) lwt.6.1.1 \
+    ambient-context-eio cohttp-eio tls-eio ca-certs mirage-crypto-rng eio_main odig
+
+CI_BUILD = docker build -f deps/dockerfile.ocaml \
+    --build-arg OPAM_REPO_COMMIT=$(OPAM_REPO_COMMIT) \
+    --build-arg "BASE_OS_PACKAGES=$(CI_BASE_OS_PACKAGES)"
+
+build-ci-docker:
+	$(CI_BUILD) --build-arg OCAML_VERSION=4.08.1 --build-arg "BASE_PACKAGES=$(CI_PACKAGES_408)" -t $(CI_REGISTRY)/ci-4.08:latest .
+	$(CI_BUILD) --build-arg OCAML_VERSION=4.14.2 --build-arg "BASE_PACKAGES=$(CI_PACKAGES_414)" -t $(CI_REGISTRY)/ci-4.14:latest .
+	$(CI_BUILD) --build-arg OCAML_VERSION=5.4.1  --build-arg "BASE_PACKAGES=$(CI_PACKAGES_54)"  -t $(CI_REGISTRY)/ci-5.4:latest .
+
+CI_NON_EIO_PACKAGES = opentelemetry,opentelemetry-client,opentelemetry-lwt,opentelemetry-cohttp-lwt,opentelemetry-client-ocurl,opentelemetry-client-ocurl-lwt,opentelemetry-client-cohttp-lwt,opentelemetry-logs
+CI_RUN = docker run --rm -v $(PWD):/root/w -w /root/w
+
+run-ci:
+	@for v in $(CI_VERSIONS); do \
+		echo "=== OCaml $$v ===" ; \
+		$(CI_RUN) $(CI_REGISTRY)/ci-$$v:latest \
+			sh -c "opam exec -- dune build @install -p $(CI_NON_EIO_PACKAGES) && opam exec -- dune build @runtest" \
+		|| exit 1 ; \
+	done
+	$(CI_RUN) $(CI_REGISTRY)/ci-5.4:latest \
+		opam exec -- dune build @install -p opentelemetry-client-cohttp-eio
+
+upload-ci-docker: build-ci-docker
+	@for v in $(CI_VERSIONS); do \
+		docker push $(CI_REGISTRY)/ci-$$v:latest ; \
+	done || ( echo  "to login:  docker login ghcr.io -u <your-github-username>" ; exit 1 )

deps/dockerfile.4.08

@@ -1,33 +0,0 @@
-FROM ocaml/opam:ubuntu-24.04-ocaml-4.08
-
-USER root
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      pkg-config libcurl4-openssl-dev libgmp-dev mccs && \
-    rm -rf /var/lib/apt/lists/*
-USER opam
-
-RUN opam update
-
-WORKDIR /home/opam/src
-COPY --chown=opam:opam opentelemetry.opam .
-COPY --chown=opam:opam opentelemetry-client.opam .
-COPY --chown=opam:opam opentelemetry-lwt.opam .
-COPY --chown=opam:opam opentelemetry-cohttp-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-ocurl.opam .
-COPY --chown=opam:opam opentelemetry-client-ocurl-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-cohttp-lwt.opam .
-COPY --chown=opam:opam opentelemetry-logs.opam .
-
-RUN --mount=type=cache,target=/home/opam/.opam/download-cache,uid=1000,gid=1000 \
-    opam pin add -n opentelemetry . && \
-    opam pin add -n opentelemetry-client . && \
-    opam pin add -n opentelemetry-lwt . && \
-    opam pin add -n opentelemetry-cohttp-lwt . && \
-    opam pin add -n opentelemetry-client-ocurl . && \
-    opam pin add -n opentelemetry-client-ocurl-lwt . && \
-    opam pin add -n opentelemetry-client-cohttp-lwt . && \
-    opam pin add -n opentelemetry-logs . && \
-    opam install . --deps-only --with-test -y && \
-    opam install trace ocaml-protoc -y && \
-    opam clean -a -y

deps/dockerfile.4.14

@@ -1,33 +0,0 @@
-FROM ocaml/opam:ubuntu-24.04-ocaml-4.14
-
-USER root
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      pkg-config libcurl4-openssl-dev libgmp-dev mccs && \
-    rm -rf /var/lib/apt/lists/*
-USER opam
-
-RUN opam update
-
-WORKDIR /home/opam/src
-COPY --chown=opam:opam opentelemetry.opam .
-COPY --chown=opam:opam opentelemetry-client.opam .
-COPY --chown=opam:opam opentelemetry-lwt.opam .
-COPY --chown=opam:opam opentelemetry-cohttp-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-ocurl.opam .
-COPY --chown=opam:opam opentelemetry-client-ocurl-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-cohttp-lwt.opam .
-COPY --chown=opam:opam opentelemetry-logs.opam .
-
-RUN --mount=type=cache,target=/home/opam/.opam/download-cache,uid=1000,gid=1000 \
-    opam pin add -n opentelemetry . && \
-    opam pin add -n opentelemetry-client . && \
-    opam pin add -n opentelemetry-lwt . && \
-    opam pin add -n opentelemetry-cohttp-lwt . && \
-    opam pin add -n opentelemetry-client-ocurl . && \
-    opam pin add -n opentelemetry-client-ocurl-lwt . && \
-    opam pin add -n opentelemetry-client-cohttp-lwt . && \
-    opam pin add -n opentelemetry-logs . && \
-    opam install . --deps-only --with-test -y && \
-    opam install trace ocaml-protoc ocamlformat.0.27.0 -y && \
-    opam clean -a -y

deps/dockerfile.5.4

@@ -1,35 +0,0 @@
-FROM ocaml/opam:ubuntu-24.04-ocaml-5.4
-
-USER root
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      pkg-config libcurl4-openssl-dev libgmp-dev mccs && \
-    rm -rf /var/lib/apt/lists/*
-USER opam
-
-RUN opam update
-
-WORKDIR /home/opam/src
-COPY --chown=opam:opam opentelemetry.opam .
-COPY --chown=opam:opam opentelemetry-client.opam .
-COPY --chown=opam:opam opentelemetry-lwt.opam .
-COPY --chown=opam:opam opentelemetry-cohttp-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-ocurl.opam .
-COPY --chown=opam:opam opentelemetry-client-ocurl-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-cohttp-lwt.opam .
-COPY --chown=opam:opam opentelemetry-client-cohttp-eio.opam .
-COPY --chown=opam:opam opentelemetry-logs.opam .
-
-RUN --mount=type=cache,target=/home/opam/.opam/download-cache,uid=1000,gid=1000 \
-    opam pin add -n opentelemetry . && \
-    opam pin add -n opentelemetry-client . && \
-    opam pin add -n opentelemetry-lwt . && \
-    opam pin add -n opentelemetry-cohttp-lwt . && \
-    opam pin add -n opentelemetry-client-ocurl . && \
-    opam pin add -n opentelemetry-client-ocurl-lwt . && \
-    opam pin add -n opentelemetry-client-cohttp-lwt . && \
-    opam pin add -n opentelemetry-client-cohttp-eio . && \
-    opam pin add -n opentelemetry-logs . && \
-    opam install . --deps-only --with-test -y && \
-    opam install trace ocaml-protoc lwt.6.1.1 odig -y && \
-    opam clean -a -y

deps/dockerfile.ocaml

@@ -0,0 +1,37 @@
+ARG BASE_OS=ubuntu:24.04
+
+# --- Stage 1: base (shared, no OCaml) ---
+FROM $BASE_OS AS base
+ARG BASE_OS_PACKAGES=""
+ENV OPAMROOTISOK=1 OPAMYES=1 OPAMCONFIRMLEVEL=unsafe-yes
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates curl git unzip build-essential $BASE_OS_PACKAGES && \
+    rm -rf /var/lib/apt/lists/* && \
+    curl -fsSL https://github.com/ocaml/opam/releases/download/2.5.0/opam-2.5.0-x86_64-linux -o /usr/local/bin/opam && \
+    chmod +x /usr/local/bin/opam
+WORKDIR /root/w
+
+# --- Stage 2: opam-setup (builds the switch, discarded) ---
+FROM base AS opam-setup
+ARG OCAML_VERSION
+ARG OPAM_REPO_COMMIT=master
+ARG BASE_PACKAGES=""
+
+RUN git init /tmp/opam-repo && cd /tmp/opam-repo && \
+    git remote add origin https://github.com/ocaml/opam-repository.git && \
+    git fetch --depth 1 origin $OPAM_REPO_COMMIT && \
+    git checkout FETCH_HEAD
+
+RUN opam init --disable-sandboxing --bare --no-setup -k local /tmp/opam-repo && \
+    opam switch create /root/w --packages=ocaml-base-compiler.$OCAML_VERSION
+
+RUN opam install --no-depexts $BASE_PACKAGES && \
+    opam clean -a -y && \
+    rm -rf /tmp/opam-repo
+
+# --- Stage 3: final image (base + switch only) ---
+FROM base
+COPY --from=opam-setup /root/.opam /root/.opam
+COPY --from=opam-setup /root/w/_opam /root/w/_opam
+ENV OPAMSWITCH=/root/w PATH=/root/w/_opam/bin:$PATH
+WORKDIR /root/w