FR: SYSROOT generated by rules_distroless for hermetic CC complation

[thesayyn]

While working on a GLIBC related problem, i realized that rules_distroless could have made hermetic cc compilation so much easier by generating a sysroot out of the debian packages that are being fetched.

This is great for one single reason, what's actually going into the container is also what you are linking against!

I can imagine a bzlmod only API, as such

# Generate a sysroot using the apt extensions
apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")

apt.install("libc6-dev")

apt.sysroot(
    name = "sysroot_amd64"
    arch = "amd64"
)
 
apt.sysroot(
    name = "sysroot_arm64"
    arch = "arm64"
)
 
use_repo(apt, "sysroot_amd64", "sysroot_arm64")
 
# Use with toolchains_llvm
llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
llvm.sysroot(
    name = "llvm_toolchain_with_sysroot",
    targets = ["linux-x86_64"],
    label = "@sysroot_amd64//:sysroot",
)
llvm.sysroot(
    name = "llvm_toolchain_with_sysroot",
    targets = ["linux-arm64"],
    label = "@sysroot_arm64//:sysroot",
)

[JonathanPerry651]

This is a very cool idea

[jjmaestro]

This is awesome!! I was wondering about something like this as well! TIL about bazel-contrib/toolchains_llvm's sysroot!

Having something like this API would be amazing, I had to hack something together for a project I'm working on. Basically a custom Docker image from where I then create toolchains using bazelbuild/bazel-toolchains and I was going to eventually try something like this but much less nice, just create the image with rules_distroless + rules_oci and still have to call rbe_configs_gen.

This is neat and I'd love to have it! Hopefully other Cxx toolchains and other rules support something like this sysroot... and maybe Bazel itself would support it natively, it would be great to be able to create a sysroot(s) for the full linux hermetic dashboard. Currently it's very hard to setup, requires manual fiddling, etc. Being able to produce a sysroot and tell Bazel to use it for sandboxing would be 🔥