feat: Allow Lambda provider to use any version of Linux (#584)

Previously we required Amazon Linux 2023 (and the error message erroneously said Amazon Linux 2). With this change, we will still be using Amazon Linux 2023 by default, but Ubuntu and Amazon Linux 2 will also be supported.

Note that this changes the default base image from `public.ecr.aws/lambda/nodejs:20-x86_64` to `public.ecr.aws/amazonlinux/amazonlinux:2023`. The new image contains all the packages in the old one plus a few more Python packages. The new image is a bit smaller so might load faster. The only difference should be nodejs 20 in `/var/lang` which also includes the Lambda runtime.

Resolves #510
Resolves #423

BREAKING CHANGE: Node.js is no longer included by default with Lambda runner images

.projenrc.js

@@ -119,6 +119,7 @@ releaseWorkflow.file.addDeletionOverride('on.push');
 
 // bundle docker images
 project.bundler.bundleTask.exec('cp -r src/providers/docker-images assets');
+project.bundler.bundleTask.exec('cp -r src/providers/lambda-*.sh assets/providers');
 
 // set proper line endings
 project.gitattributes.addAttributes('*.js', 'eol=lf');

src/image-builders/components.ts

@@ -509,7 +509,7 @@ export abstract class RunnerImageComponent {
       name = 'Lambda-Entrypoint';
 
       getCommands(os: Os, _architecture: Architecture) {
-        if (!os.is(Os.LINUX_AMAZON_2) && !os.is(Os.LINUX_AMAZON_2023) && !os.is(Os.LINUX_UBUNTU)) {
+        if (!os.isIn(Os._ALL_LINUX_VERSIONS)) {
           throw new Error(`Unsupported OS for Lambda entrypoint: ${os.name}`);
         }
 
@@ -519,20 +519,19 @@ export abstract class RunnerImageComponent {
       getAssets(_os: Os, _architecture: Architecture): RunnerImageAsset[] {
         return [
           {
-            source: path.join(__dirname, '..', '..', 'assets', 'docker-images', 'lambda', 'linux-x64', 'runner.js'),
-            target: '${LAMBDA_TASK_ROOT}/runner.js',
+            source: path.join(__dirname, '..', '..', 'assets', 'providers', 'lambda-bootstrap.sh'),
+            target: '/bootstrap.sh',
           },
           {
-            source: path.join(__dirname, '..', '..', 'assets', 'docker-images', 'lambda', 'linux-x64', 'runner.sh'),
-            target: '${LAMBDA_TASK_ROOT}/runner.sh',
+            source: path.join(__dirname, '..', '..', 'assets', 'providers', 'lambda-runner.sh'),
+            target: '/runner.sh',
           },
         ];
       }
 
       getDockerCommands(_os: Os, _architecture: Architecture): string[] {
         return [
-          'WORKDIR ${LAMBDA_TASK_ROOT}',
-          'CMD ["runner.handler"]',
+          'ENTRYPOINT ["bash", "/bootstrap.sh"]',
         ];
       }
     };

src/providers/lambda-bootstrap.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -euo pipefail
+
+while true
+do
+  # get data from lambda
+  HEADERS="$(mktemp)"
+  EVENT_DATA=$(curl -sS -LD "$HEADERS" "http://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/next")
+  REQUEST_ID=$(grep -Fi Lambda-Runtime-Aws-Request-Id "$HEADERS" | tr -d '[:space:]' | cut -d: -f2)
+
+  # execute runner and respond
+  if bash /runner.sh "$EVENT_DATA"; then
+    curl "http://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/$REQUEST_ID/response" -d ""
+  else
+    curl "http://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/$REQUEST_ID/error" -d "{\"errorMessage\": \"Runner failed with exit code $?\", \"errorType\": \"Error\", \"stackTrace\": []}"
+  fi
+
+  # cleanup
+  find /tmp -mindepth 1 -maxdepth 1 -exec rm -rf '{}' \;
+done

src/providers/lambda-runner.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# workaround for "Cannot get required symbol EVP_rc2_cbc from libssl"
+# lambda docker image for node.js comes with stripped down libssl.so pushed in LD_LIBRARY_PATH
+if [ -f /var/lang/lib/libssl.so ]; then
+  export LD_LIBRARY_PATH=/usr/lib64:$LD_LIBRARY_PATH
+fi
+
+# extract parameters
+OWNER=$(echo "$1" | jq -r .owner)
+REPO=$(echo "$1" | jq -r .repo)
+GITHUB_DOMAIN=$(echo "$1" | jq -r .githubDomain)
+RUNNER_TOKEN=$(echo "$1" | jq -r .token)
+RUNNER_NAME=$(echo "$1" | jq -r .runnerName)
+RUNNER_LABEL=$(echo "$1" | jq -r .label)
+REGISTRATION_URL=$(echo "$1" | jq -r .registrationUrl)
+
+# copy runner code (it needs a writable directory)
+cp -r /home/runner /tmp/
+cd /tmp/runner
+
+# setup home directory
+mkdir /tmp/home
+export HOME=/tmp/home
+
+# start runner
+if [ "${RUNNER_VERSION}" = "latest" ]; then RUNNER_FLAGS=""; else RUNNER_FLAGS="--disableupdate"; fi
+./config.sh --unattended --url "${REGISTRATION_URL}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL},cdkghr:started:`date +%s`" --name "${RUNNER_NAME}" ${RUNNER_FLAGS}
+echo Config done
+./run.sh
+echo Run done
+
+# print status for metrics
+STATUS=$(grep -Phors "finish job request for job [0-9a-f\-]+ with result: \K.*" _diag/ | tail -n1)
+[ -n "$STATUS" ] && echo CDKGHA JOB DONE "$RUNNER_LABEL" "$STATUS"

src/providers/lambda.ts

@@ -153,7 +153,7 @@ export class LambdaRunnerProvider extends BaseProvider implements IRunnerProvide
    *
    * You can add components to the image builder by calling `imageBuilder.addComponent()`.
    *
-   * The default OS is Amazon Linux 2 running on x64 architecture.
+   * The default OS is Amazon Linux 2023 running on x64 architecture.
    *
    * Included components:
    *  * `RunnerImageComponent.requiredPackages()`
@@ -163,24 +163,11 @@ export class LambdaRunnerProvider extends BaseProvider implements IRunnerProvide
    *  * `RunnerImageComponent.awsCli()`
    *  * `RunnerImageComponent.githubRunner()`
    *  * `RunnerImageComponent.lambdaEntrypoint()`
-   *
-   *  Base Docker image: `public.ecr.aws/lambda/nodejs:20-x86_64` or `public.ecr.aws/lambda/nodejs:20-arm64`
    */
   public static imageBuilder(scope: Construct, id: string, props?: RunnerImageBuilderProps) {
-    if (props?.os && !Os.LINUX_AMAZON_2.is(props.os) && !props?.baseDockerImage) {
-      // TODO we can support Ubuntu by building our own image https://docs.aws.amazon.com/lambda/latest/dg/nodejs-image.html#nodejs-image-clients
-      throw new Error('Lambda runner provider only supports Amazon Linux 2. Use a different provider or specify a custom `baseDockerImage` that supports your desired OS.');
-    }
-
-    let baseDockerImage = 'public.ecr.aws/lambda/nodejs:20-x86_64';
-    if (props?.architecture === Architecture.ARM64) {
-      baseDockerImage = 'public.ecr.aws/lambda/nodejs:20-arm64';
-    }
-
     return RunnerImageBuilder.new(scope, id, {
       os: Os.LINUX_AMAZON_2023,
-      architecture: props?.architecture ?? Architecture.X86_64,
-      baseDockerImage,
+      architecture: Architecture.X86_64,
       components: [
         RunnerImageComponent.requiredPackages(),
         RunnerImageComponent.runnerUser(),

test/default.integ.snapshot/github-runners-test.assets.json

@@ -40,28 +40,28 @@
         }
       }
     },
-    "68628bab8c925c01632702a86513d4b22840e7fbb138f290bab11c2c2d54c489": {
+    "2fc3b84da69dcc5adb6dc4721b50c1166474fa7e5fd5f242e833d12ac28e09d9": {
       "source": {
-        "path": "asset.68628bab8c925c01632702a86513d4b22840e7fbb138f290bab11c2c2d54c489.js",
+        "path": "asset.2fc3b84da69dcc5adb6dc4721b50c1166474fa7e5fd5f242e833d12ac28e09d9.sh",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "68628bab8c925c01632702a86513d4b22840e7fbb138f290bab11c2c2d54c489.js",
+          "objectKey": "2fc3b84da69dcc5adb6dc4721b50c1166474fa7e5fd5f242e833d12ac28e09d9.sh",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "66540a3450c33faeefad87df9de8684f624030603c76336933c519972d85a072": {
+    "7be6b27ef13a5bba7f44b1d9c6e50fc2c68fdb40d51cef42cee01f27c38842a9": {
       "source": {
-        "path": "asset.66540a3450c33faeefad87df9de8684f624030603c76336933c519972d85a072.sh",
+        "path": "asset.7be6b27ef13a5bba7f44b1d9c6e50fc2c68fdb40d51cef42cee01f27c38842a9.sh",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "66540a3450c33faeefad87df9de8684f624030603c76336933c519972d85a072.sh",
+          "objectKey": "7be6b27ef13a5bba7f44b1d9c6e50fc2c68fdb40d51cef42cee01f27c38842a9.sh",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
@@ -209,15 +209,15 @@
         }
       }
     },
-    "54ea0c28666f3fa077b83dbc9a02d3d6d3304dbd52deb343fc69e6a7ca821b0e": {
+    "8368627222f528d1ca1bdcdde41640c2fe68400d3d98ed2e5699e5ff524c02f3": {
       "source": {
         "path": "github-runners-test.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "54ea0c28666f3fa077b83dbc9a02d3d6d3304dbd52deb343fc69e6a7ca821b0e.json",
+          "objectKey": "8368627222f528d1ca1bdcdde41640c2fe68400d3d98ed2e5699e5ff524c02f3.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }