Attempt to build Euro-Office from tag

[adriangibanelbtactic]

I have attempted to build Euro-Office from an specific tag thanks to the current documentation.
Here there are my findings.

Introduction

Let's assume someone reads: https://github.com/Euro-Office/DocumentServer/blob/e1a544198d4fa70fe3725d0923c2d8cf1926eb67/build/README.md .

Build ( Attempt number 1 )

Let's try to build Euro-Office on our own.

The only published tag in DocumentServer is v9.3.1-tp.1 so we will go with it.

Let's assume we already have a system that enables use to run Docker seamlessly.
Let's also assume that the user has Github ssh keys setup properly.

mkdir eo-build-test
cd eo-build-test

git clone git@github.com:Euro-Office/DocumentServer.git
cd DocumentServer
git checkout v9.3.1-tp.1
# Ignore detached HEAD warning
git submodule update --init --recursive
cd build
docker buildx bake
docker buildx bake packages --set PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0

When running: docker buildx bake I am getting:

[+] Building 0.0s (1/1) FINISHED                                                                                                                                              docker:default
 => [internal] load local bake definitions                                                                                                                                              0.0s
ERROR: couldn't find a bake definition

Note: I ask in the community for a working commit hash that it's known to build. No reply received yet.

Build ( Attempt number 2 )

Let's go ahead with latest commit in main branch for now.

cd .. # Exit build/ directory

git checkout main -b explore_2026_04_22_commit
git submodule update --init --recursive
cd build

docker buildx bake

[+] Building 0.0s (1/1) FINISHED                                                                                                                                              docker:default
 => [internal] load local bake definitions                                                                                                                                              0.0s
 => => reading docker-bake.hcl 6.19kB / 6.19kB                                                                                                                                          0.0s
Your build is requesting privileges for following possibly insecure capabilities:

 - Read and write access to path /tmp
 - Read access to path ..

In order to not see this message in the future pass "--allow=fs=/tmp --allow=fs.read=.." to grant requested privileges.

Your full command with requested privileges:

docker buildx bake --allow=fs=/tmp --allow=fs.read=.. 

To disable filesystem entitlements checks, you can set BUILDX_BAKE_ENTITLEMENTS_FS=0 .

Do you want to grant requested privileges and continue? [y/N]

When I say y I get:

ERROR: Cache export is not supported for the docker driver.
Switch to a different driver, or turn on the containerd image store, and try again.
Learn more at https://docs.docker.com/go/build-cache-backends/

.

Docker driver setup

docker buildx create \
  --name container-builder \
  --driver docker-container \
  --use

docker buildx inspect --bootstrap

Build ( Attempt number 3 )

cd build # If needed

docker buildx bake

[+] Building 0.0s (1/1) FINISHED                                                                                                                          docker-container:container-builder
 => [internal] load local bake definitions                                                                                                                                              0.0s
 => => reading docker-bake.hcl 6.19kB / 6.19kB                                                                                                                                          0.0s
Your build is requesting privileges for following possibly insecure capabilities:

 - Read and write access to path /tmp
 - Read access to path ..

In order to not see this message in the future pass "--allow=fs=/tmp --allow=fs.read=.." to grant requested privileges.

Your full command with requested privileges:

docker buildx bake --allow=fs=/tmp --allow=fs.read=.. 

To disable filesystem entitlements checks, you can set BUILDX_BAKE_ENTITLEMENTS_FS=0 .

Do you want to grant requested privileges and continue? [y/N]

Let's enter y.

In the end I am getting:

 => => writing config sha256:21e506aca7a7123096ba35766b1dc0ea84bad75553ad77c901aaec77fddff2c7                                                                                           0.0s
 => => writing cache image manifest sha256:4247a779b34b226d43c535d7b0b110d647254dea1b3940099e3bf433bb0b8c30                                                                             0.0s
WARNING: No output specified for documentserver target(s) with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
WARNING: local cache import at /tmp/ghcr.io/euro-office/server skipped due to err: could not read /tmp/ghcr.io/euro-office/server/index.json: open /tmp/ghcr.io/euro-office/server/index.json: no such file or directory
WARNING: local cache import at /tmp/ghcr.io/euro-office/core-wasm skipped due to err: could not read /tmp/ghcr.io/euro-office/core-wasm/index.json: open /tmp/ghcr.io/euro-office/core-wasm/index.json: no such file or directory
WARNING: local cache import at /tmp/ghcr.io/euro-office/core skipped due to err: could not read /tmp/ghcr.io/euro-office/core/index.json: open /tmp/ghcr.io/euro-office/core/index.json: no such file or directory
WARNING: local cache import at /tmp/ghcr.io/euro-office/web-apps skipped due to err: could not read /tmp/ghcr.io/euro-office/web-apps/index.json: open /tmp/ghcr.io/euro-office/web-apps/index.json: no such file or directory
WARNING: local cache import at /tmp/ghcr.io/euro-office/example skipped due to err: could not read /tmp/ghcr.io/euro-office/example/index.json: open /tmp/ghcr.io/euro-office/example/index.json: no such file or directory
WARNING: local cache import at /tmp/ghcr.io/euro-office/sdkjs skipped due to err: could not read /tmp/ghcr.io/euro-office/sdkjs/index.json: open /tmp/ghcr.io/euro-office/sdkjs/index.json: no such file or directory
WARNING: local cache import at /tmp/ghcr.io/euro-office/documentserver skipped due to err: could not read /tmp/ghcr.io/euro-office/documentserver/index.json: open /tmp/ghcr.io/euro-office/documentserver/index.json: no such file or directory
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 5.811800125s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 5.836258107s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 5.848934149s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 5.868240154s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 5.902821609s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 5.982411914s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable
ERROR: (*service).Write failed: rpc error: code = Unavailable desc = ref layer-sha256:bd8de2e7f91597f74b94f31f8a72835874def5a57512b4a37f6021738c36f5a8 locked for 6.248264895s (since 2026-04-29 10:48:45.366259162 +0200 CEST m=+4547.988216497): unavailable

Please notice that I have plenty of space and that this is not a consequence of a 'No space left on device' problem.

echo $? is 0 so I guess we can assume this has built ok even of the rpc ERRORs but I would like to have some confirmation though.

Quick check (normal build)

du -sch /tmp/ghcr.io/euro-office/
13G     /tmp/ghcr.io/euro-office/
13G     total

Hopefully that's reused by the build packages step. Well, in the end it is.

Packages Build ( Attempt number 1 )

cd build # If needed

docker buildx bake packages --set PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0

[+] Building 0.0s (1/1) FINISHED                                                                                                                          docker-container:container-builder
 => [internal] load local bake definitions                                                                                                                                              0.0s
 => => reading docker-bake.hcl 6.19kB / 6.19kB                                                                                                                                          0.0s
ERROR: invalid override key PRODUCT_VERSION, expected target.name

This is failing so that this is a BUG related to the documentation.

Packages Build ( Attempt number 2 )

(One of the LLM suggestions was not useful.)

cd build # If needed

docker buildx bake packages \
  --set-variable PRODUCT_VERSION=9.3.1 \
  --set-variable BUILD_NUMBER=0

unknown flag: --set-variable

Usage:  docker buildx bake [OPTIONS] [TARGET...]

Run 'docker buildx bake --help' for more information

Packages Build ( Attempt number 3 )

cd build # If needed

PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0 \
docker buildx bake packages

[+] Building 0.0s (1/1) FINISHED                                                                                                                          docker-container:container-builder
 => [internal] load local bake definitions                                                                                                                                              0.0s
 => => reading docker-bake.hcl 6.19kB / 6.19kB                                                                                                                                          0.0s
Your build is requesting privileges for following possibly insecure capabilities:

 - Read and write access to path /tmp/ghcr.io/euro-office/web-apps
 - Read access to path ..

In order to not see this message in the future pass "--allow=fs=/tmp/ghcr.io/euro-office/web-apps --allow=fs.read=.." to grant requested privileges.

Your full command with requested privileges:

docker buildx bake --allow=fs=/tmp/ghcr.io/euro-office/web-apps --allow=fs.read=.. packages

To disable filesystem entitlements checks, you can set BUILDX_BAKE_ENTITLEMENTS_FS=0 .

Do you want to grant requested privileges and continue? [y/N]

y

This seems to be reusing a lot of stuff.

While building I also see:

WARN: InvalidDefaultArgInFrom: Default value for ARG ${PACKAGE_BASE} results in empty or invalid base image name (line 20)

The build finishes with:

=> => writing layer sha256:fae98a567d96a47db287c43fc3566780351e07d1b03416b3e34971f2536ef52a                                                                                            0.0s
 => => writing layer sha256:fd151db9eb84b01fefb022bc3d7468e206fca17b83f34d74bbe3bb142c627423                                                                                            0.0s
 => => writing config sha256:21e506aca7a7123096ba35766b1dc0ea84bad75553ad77c901aaec77fddff2c7                                                                                           0.0s
 => => writing cache image manifest sha256:4247a779b34b226d43c535d7b0b110d647254dea1b3940099e3bf433bb0b8c30                                                                             0.0s
 => [packages package  2/10] COPY document-server-package/ /document-server-package/                                                                                                    0.1s
 => [packages package  3/10] COPY server/Common/config/ /server-src/Common/config/                                                                                                      0.0s
 => [packages package  4/10] COPY server/schema/        /server-src/schema/                                                                                                             0.0s
 => [packages package  5/10] COPY server/license/       /server-src/license/                                                                                                            0.0s
 => [packages package  6/10] COPY server/LICENSE.txt    /server-src/                                                                                                                    0.0s
 => [packages package  7/10] COPY server/3rd-Party.txt  /server-src/                                                                                                                    0.0s
 => [packages package  8/10] COPY --chmod=755 build/scripts/build-packages.sh /build-packages.sh                                                                                        0.0s
 => [packages package  9/10] RUN /build-packages.sh                                                                                                                                   836.8s
 => [packages packages 1/1] COPY --from=package /packages/ /                                                                                                                            0.7s
 => [packages] exporting to client directory                                                                                                                                            7.5s
 => => copying files 1.26GB                                                                                                                                                             7.5s
WARNING: local cache import at /tmp/ghcr.io/euro-office/packages skipped due to err: could not lock /tmp/ghcr.io/euro-office/packages/index.json.lock: open /tmp/ghcr.io/euro-office/packages/index.json.lock: no such file or directory

 1 warning found (use docker --debug to expand):
 - InvalidDefaultArgInFrom: Default value for ARG ${PACKAGE_BASE} results in empty or invalid base image name (line 20)

echo $? is 0. Let's assume the build went ok.

Quick check (packages build)

du -sch deploy/packages/
1,2G    deploy/packages/
1,2G    total

find deploy/packages -iname '*deb' -o -iname '*rpm'
deploy/packages/euro-office-documentserver-9.3.1-0.x86_64.rpm
deploy/packages/euro-office-documentserver_9.3.1-0_amd64.deb

du -sch deploy/packages/euro-office-documentserver-9.3.1-0.x86_64.rpm
599M    deploy/packages/euro-office-documentserver-9.3.1-0.x86_64.rpm
599M    total

du -sch deploy/packages/euro-office-documentserver_9.3.1-0_amd64.deb
605M    deploy/packages/euro-office-documentserver_9.3.1-0_amd64.deb
605M    total

Doubt about actually building from tags

TAG defaults to latest inside of the hcl file.
Maybe we should override it with the correspondent tag so that you could build different tags (all of them go to /tmp) and then decide which one to package.

So... if I do:

cd /tmp/ghcr.io/euro-office/core
cat index.json | jq

I get:

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:1e4e11cd24c120173fa8b918d44c60c8af62f008b327772d15ae290138644771",
      "size": 3889,
      "annotations": {
        "org.opencontainers.image.ref.name": "latest"
      }
    }
  ]
}

so, yeah, the original build is saved as 'latest' within the OCI image layout export.

I think we actually need to force the original build to have an specific TAG.

In order words more work is needed.

Summary so far

• Typo found at https://github.com/Euro-Office/DocumentServer/tree/main/build. 'If the docker build stockes because of broken content in cache, for example with error:'. stockes should be fixed onto stops.
• I miss instructions on how to setup Docker-CE
• I miss instructions on the need of using Github ssh keys (due to how git submodules are set)
• Docker driver setup should be documented as a requisite. Instructions on how to set it up should also be there.
• No mention related to commit/tag checkout for a tag-based build.
• An alternative command to docker buildx bake which overrides TAG variable might be needed.
• An alternative command to PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0 docker buildx bake packages which overrides TAG variable might be needed.
• Document somewhere that having ERRORs when building might not be a problem. That you should use echo $? after a build.
• Documentation suggests docker buildx bake packages --set PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0 but that's failing for me.

Some doubts that I have

Before creating specific issues and their associated PRs where we could discuss those in more detail it would be nice if you could clarify me some doubts.

1.) Is it the Docker driver setup documented elsewhere that I might have missed?
2.) Apparently I have a OCI image layout export on /tmp/ghcr.io/euro-office. Is there any usual syntax so that its tag-aware?
3.) Do you maybe recommend a setup that doesn't export those OCI images locally but remotely? Or are those setups only expected in companies?
4.) Do I just override TAG by using TAG=value or do I use something else? ( This one I will figure it out in the end. )
5.) The docker buildx bake packages --set PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0 error is something related to my Docker setup? Or is it an actual documentation bug?
6.) Is it wise to recommend Docker-CE (instead of podman or similar) for this project? I had to include a warning for other of my projects when using RHEL based distributions. Or is it a project that would build/work as expected even if podman was used with it?

Thank you.

---

ANNEX - Typo found

https://github.com/Euro-Office/DocumentServer/tree/main/build

If the docker build stockes because of broken content in cache, for example with error:

I think it should be If the docker build stockes stops.

[rikled]

Hi @adriangibanelbtactic ,

thanks a lot for the thorough review. Indeed, the bake instructions and build process is a bit rought atm. To answer your questions:

1. No it is not added elsewhere. We need to do that
2. Not yet, but we could just change: cache-from = ["type=local,src=/tmp/${REGISTRY}/core"] to something like cache-from = ["type=local,src=/tmp/${REGISTRY}/core/${TAG}"]. What do you think?
3. local export is intentional and reasonable for solo developers, but the bake file is structured in a way that makes switching to remote cache quite easy. It's maybe worth documenting both options.
4. you can use the same way you did: TAG=my-tag PRODUCT_VERSION=9.3.1 BUILD_NUMBER=0 docker buildx bake packages
5. yes, indeed a documentation error.
6. we decided for docker because it is mostly what people are used to or are using anyways. I think we would be quite open to contributions in this regard to drive the podman support forward. But no efforts done so far in this regard yet.