From ca9e35d167d29262ffa55c798299d33ec85265ac Mon Sep 17 00:00:00 2001
From: "Phong X. Nguyen" <p.nguyen@yahooinc.com>
Date: Fri, 12 Jun 2026 04:49:53 +0000
Subject: [PATCH] Add Debian 13, Ubuntu 26.04 LTS, Rocky 10

---
 docker/debian13/Dockerfile               |  67 ++++++
 docker/rockylinux10/Dockerfile           | 225 ++++++++++++++++++
 docker/rockylinux10/build_h3_tools.sh    | 283 +++++++++++++++++++++++
 docker/rockylinux10/install_abi_tools.sh |  13 ++
 docker/ubuntu2604/Dockerfile             |  70 ++++++
 5 files changed, 658 insertions(+)
 create mode 100644 docker/debian13/Dockerfile
 create mode 100644 docker/rockylinux10/Dockerfile
 create mode 100644 docker/rockylinux10/build_h3_tools.sh
 create mode 100755 docker/rockylinux10/install_abi_tools.sh
 create mode 100644 docker/ubuntu2604/Dockerfile

diff --git a/docker/debian13/Dockerfile b/docker/debian13/Dockerfile
new file mode 100644
index 00000000..797c47fb
--- /dev/null
+++ b/docker/debian13/Dockerfile
@@ -0,0 +1,67 @@
+# syntax=docker/dockerfile:1
+
+FROM debian:13
+
+RUN <<EOF /bin/bash
+  set -ex
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get -y update
+  apt-get -y install build-essential llvm ccache \
+    make pkgconf bison flex g++ clang gettext libc++-dev autoconf automake \
+    libtool autotools-dev git distcc file wget openssl hwloc intltool-debian \
+    cmake ninja-build
+
+  apt-get -y install libssl-dev libexpat1-dev \
+    libpcre3-dev libcap-dev libhwloc-dev libunwind8 libunwind-dev zlib1g-dev \
+    libmaxminddb-dev libjemalloc-dev libluajit-5.1-dev liblzma-dev \
+    libhiredis-dev libncurses-dev libgeoip-dev libmagick++-dev \
+    libcjose-dev libcjose0 libjansson-dev libzstd-dev liblz4-dev
+
+  apt-get -y autoremove
+  apt-get -y clean
+EOF
+
+# Install nuraft for the stek_share plugin. Distros, unfortunately, do not
+# package these, so this has to be built by hand.
+RUN <<EOF
+  set -e
+
+  git clone https://github.com/eBay/NuRaft.git
+  cd NuRaft
+  ./prepare.sh
+
+  cmake \
+    -B build \
+    -G Ninja \
+    -DCMAKE_INSTALL_PREFIX=/opt/
+  cmake --build build
+  cmake --install build
+  cd ../
+  rm -rf NuRaft
+EOF
+
+# Add the CI's test user. N.B: 1200 is the uid that our jenkins user is
+# configured with, so that has to be used. Otherwise there will be permissions
+# issues.
+ARG username=jenkins
+ARG uid=1200
+RUN <<EOF
+  set -e
+  useradd \
+    --home-dir /home/${username} \
+    --groups users,sudo \
+    --uid ${uid} \
+    --shell /bin/bash \
+    --create-home \
+    ${username}
+  echo "${username} ALL=(ALL:ALL) NOPASSWD:ALL" >> /etc/sudoers
+  chown -R ${username} /home/${username}
+EOF
+
+# We put our custom packages in /opt.
+RUN <<EOF
+  set -e
+  mkdir -p /opt/bin
+  chmod 755 /opt/bin
+  echo 'PATH=/opt/bin:$PATH' | tee -a /etc/bash.bashrc
+EOF
diff --git a/docker/rockylinux10/Dockerfile b/docker/rockylinux10/Dockerfile
new file mode 100644
index 00000000..7830d589
--- /dev/null
+++ b/docker/rockylinux10/Dockerfile
@@ -0,0 +1,225 @@
+FROM rockylinux:10
+
+RUN <<EOF
+  set -e
+  dnf -y install epel-release dnf-plugins-core
+  dnf config-manager --set-enabled crb
+  dnf install -y https://rpms.remirepo.net/enterprise/remi-release-10.rpm
+  dnf repolist
+  dnf -y update
+
+  # Compilers
+  dnf -y install \
+    ccache make pkgconfig bison flex gcc-c++ clang cmake ninja-build \
+    autoconf automake libtool \
+    sudo git rpm-build file wget openssl hwloc nghttp2 libnghttp2-devel \
+    cargo go-toolset llvm-toolset
+
+  # Devel packages that ATS needs.
+  #
+  # --alowerasing for cur. See:
+  # https://bugs.launchpad.net/tripleo/+bug/1953156
+  dnf -y install --allowerasing \
+    openssl-devel expat-devel pcre-devel pcre2-devel libcap-devel \
+    hwloc-devel libunwind-devel xz-devel libcurl-devel ncurses-devel \
+    jemalloc-devel GeoIP-devel luajit-devel brotli-devel \
+    ImageMagick-devel ImageMagick-c++-devel hiredis-devel zlib-devel \
+    libmaxminddb-devel perl-ExtUtils-MakeMaker perl-Digest-SHA \
+    perl-URI perl-IPC-Cmd perl-Pod-Html perl-FindBin \
+    curl tcl-devel java libzstd-devel lz4-devel
+
+  # autest stuff
+  dnf -y install \
+    python3 httpd-tools procps-ng nmap-ncat python3-pip \
+    python3-gunicorn python3-requests python3-devel python3-psutil telnet golang
+EOF
+
+RUN <<EOF
+  set -e
+  pip3 install --upgrade pip
+  pip3 install pipenv httpbin
+  export XDG_BIN_HOME=/opt/bin
+  curl -LsSf https://astral.sh/uv/install.sh | sh
+EOF
+
+#-------------------------------------------------------------------------------
+# Install some custom build tools.
+#-------------------------------------------------------------------------------
+
+WORKDIR /root
+
+# We put our custom packages in /opt.
+RUN <<EOF
+  set -e
+  mkdir -p /opt/bin
+  chmod 755 /opt/bin
+  echo 'PATH=/opt/bin:$PATH' | tee -a /etc/profile.d/opt_bin.sh
+EOF
+ARG PATH=/opt/bin:$PATH
+
+#-------------------------------------------------------------------------------
+# Install the HTTP/3 build tools, including openssl-quic.
+#-------------------------------------------------------------------------------
+RUN <<EOF
+  set -e
+  dnf -y install libev-devel jemalloc-devel libxml2-devel \
+    c-ares-devel libevent-devel jansson-devel zlib-devel systemd-devel \
+    libpsl-devel libgsasl-devel libidn-devel openldap-devel
+EOF
+
+# go and rust will be installed by build_h3_tools.
+RUN dnf remove -y golang rust
+RUN dnf install -y cargo
+ARG h3_tools_dir=/root/build_h3_tools
+RUN mkdir -p ${h3_tools_dir}
+COPY /build_h3_tools.sh ${h3_tools_dir}/build_h3_tools.sh
+# This will install OpenSSL QUIC and related tools in /opt.
+RUN <<EOF
+  set -e
+  cd ${h3_tools_dir}
+  bash ${h3_tools_dir}/build_h3_tools.sh
+
+  # Removing the build dir is crucial to keeping the Docker image size
+  # reasonable.
+  rm -rf ${h3_tools_dir} /root/.rustup
+EOF
+
+#-------------------------------------------------------------------------------
+# Various CI Job and Test Requirements.
+#-------------------------------------------------------------------------------
+
+# Autests require some go applications.
+RUN <<EOF
+  set -e
+  echo 'export PATH=$PATH:/opt/go/bin' | tee -a /etc/profile.d/go.sh
+  echo 'export GOBIN=/opt/go/bin' | tee -a /etc/profile.d/go.sh
+
+  /opt/go/bin/go install github.com/summerwind/h2spec/cmd/h2spec@latest
+  cp /root/go/bin/h2spec /opt/go/bin/
+
+  /opt/go/bin/go install github.com/mccutchen/go-httpbin/v2/cmd/go-httpbin@v2.6.0
+  cp /root/go/bin/go-httpbin /opt/go/bin/
+EOF
+
+RUN update-crypto-policies --set LEGACY
+
+# Install nuraft for the stek_share plugin. Distros, unfortunately, do not
+# package these, so this has to be built by hand.
+RUN <<EOF
+  set -e
+
+  git clone https://github.com/eBay/NuRaft.git
+  cd NuRaft
+  ./prepare.sh
+
+  OPENSSL_PREFIX=/opt/openssl-quic
+  if [ -d "${OPENSSL_PREFIX}/lib" ]; then
+    OPENSSL_LIB="${OPENSSL_PREFIX}/lib"
+  elif [ -d "${OPENSSL_PREFIX}/lib64" ]; then
+    OPENSSL_LIB="${OPENSSL_PREFIX}/lib64"
+  else
+    echo "Could not find the OpenSSL install library directory."
+    exit 1
+  fi
+  cmake \
+    -B build \
+    -G Ninja \
+    -DCMAKE_INSTALL_PREFIX=/opt/ \
+    -DOPENSSL_LIBRARY_PATH=${OPENSSL_LIB} \
+    -DOPENSSL_INCLUDE_PATH=${OPENSSL_PREFIX}/include
+  cmake --build build
+  cmake --install build
+  cd ../
+  rm -rf NuRaft
+EOF
+
+# Add the CI's jenkins user.
+# N.B: 1200 is the uid that our jenkins user is configured with, so that has to
+# be used. Otherwise there will be permissions issues.
+ARG username=jenkins
+ARG uid=1200
+RUN <<EOF
+  set -e
+  useradd \
+    --home-dir /home/${username} \
+    --groups users,wheel \
+    --uid ${uid} \
+    --shell /bin/bash \
+    --create-home \
+    ${username}
+  echo "${username} ALL=(ALL:ALL) NOPASSWD:ALL" >> /etc/sudoers
+  chown -R ${username} /home/${username}
+EOF
+
+# Install lcov.
+RUN dnf install -y perl-IO-Compress
+ARG lcov_build_dir=/var/tmp/lcov_build_dir
+RUN mkdir -p ${lcov_build_dir}
+RUN <<EOF
+  set -e
+  cd ${lcov_build_dir}
+  git clone https://github.com/linux-test-project/lcov.git
+  cd lcov
+  # v1.15 is required for g++ version 9 compiled files.
+  git checkout v1.15
+  make install
+  cd /root
+  rm -rf ${lcov_build_dir}
+EOF
+
+# Install ABI checking tools.
+RUN dnf install -y ctags elfutils-libelf-devel wdiff
+COPY /install_abi_tools.sh /root/install_abi_tools.sh
+RUN bash /root/install_abi_tools.sh
+
+# Install some tools to test out of source builds.
+RUN <<EOF
+  set -e
+  set -x
+
+  # Retrieve the libswoc version we use in ATS.
+  cd /root/
+  mkdir libswoc
+  cd libswoc
+  swoc_version=1.5.13
+
+  # Now, checkout that version and install libswoc in /opt/libswoc
+  git clone https://github.com/apache/trafficserver-libswoc.git
+  cd trafficserver-libswoc
+  git checkout ${swoc_version}
+  pipenv install
+  pipenv run scons -j`nproc` all
+  arch=$(uname -m)
+  old_path=/root/libswoc/trafficserver-libswoc/_install/debug_posix-${arch}_default
+  cp -rf ${old_path} /opt/libswoc
+  chmod 755 /opt/libswoc
+  sed -i "s:${old_path}:/opt/libswoc:g" /opt/libswoc/lib/pkgconfig/*.pc
+  cd /root/
+  rm -rf /root/libswoc
+
+  # Retrieve the yaml-cpp version we use in ATS.
+  cd /root/
+  mkdir yaml-cpp
+  cd yaml-cpp
+  wget -O CMakeLists.txt https://raw.githubusercontent.com/apache/trafficserver/master/lib/yamlcpp/CMakeLists.txt
+  yaml_version=$(awk '/project/ {print $3}' CMakeLists.txt)
+
+  cd /root/yaml-cpp
+  git clone https://github.com/jbeder/yaml-cpp.git
+  cd yaml-cpp
+  git checkout ${yaml_version}
+  cmake -B build -G Ninja -DCMAKE_INSTALL_PREFIX=/opt/yaml-cpp
+  cmake --build build
+  cmake --install build
+  cd /root
+  rm -rf yaml-cpp
+EOF
+
+RUN <<EOF
+  set -e
+  # reinstall openssl-devel
+  dnf install -y openssl-devel
+  # Keep this at the end to clean up the yum cache to reduce the image file size.
+  dnf clean all
+EOF
+
diff --git a/docker/rockylinux10/build_h3_tools.sh b/docker/rockylinux10/build_h3_tools.sh
new file mode 100644
index 00000000..142ae0b9
--- /dev/null
+++ b/docker/rockylinux10/build_h3_tools.sh
@@ -0,0 +1,283 @@
+#!/usr/bin/env bash
+#
+#  Simple script to build OpenSSL and various tools with H3 and QUIC support.
+#  This probably needs to be modified based on platform.
+#
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+set -e
+
+
+# This is a slightly modified version of:
+# https://github.com/apache/trafficserver/blob/19dfdd4753232d0b77ca555f7ef5f5ba3d2ccae1/tools/build_h3_tools.sh
+#
+# This present script been modified from the latter in the following ways:
+#
+# * This version checks out specific commits of the repos so that people
+#   creating images from the corresponding Dockerfile do not get different
+#   versions of these over time.
+#
+# * It also doesn't run sudo since the Dockerfile will run this as root.
+#
+# * It also doesn't use a mktemp since the caller sets up a temporary directory
+#   that it later removes.
+
+# Update this as the draft we support updates.
+OPENSSL_BRANCH=${OPENSSL_BRANCH:-"openssl-3.1.4+quic"}
+
+# Set these, if desired, to change these to your preferred installation
+# directory
+BASE=${BASE:-"/opt"}
+OPENSSL_BASE=${OPENSSL_BASE:-"${BASE}/openssl-quic"}
+OPENSSL_PREFIX=${OPENSSL_PREFIX:-"${OPENSSL_BASE}-${OPENSSL_BRANCH}"}
+MAKE="make"
+
+CFLAGS=${CFLAGS:-"-O3 -g"}
+CXXFLAGS=${CXXFLAGS:-"-O3 -g"}
+
+if [ -e /etc/redhat-release ]; then
+    MAKE="gmake"
+    TMP_QUICHE_BSSL_PATH="${BASE}/boringssl/lib64"
+    echo "+-------------------------------------------------------------------------+"
+    echo "| You probably need to run this, or something like this, for your system: |"
+    echo "|                                                                         |"
+    echo "|   sudo yum -y install libev-devel jemalloc-devel python2-devel          |"
+    echo "|   sudo yum -y install libxml2-devel c-ares-devel libevent-devel         |"
+    echo "|   sudo yum -y install jansson-devel zlib-devel systemd-devel cargo      |"
+    echo "|                                                                         |"
+    echo "| Rust may be needed too, see https://rustup.rs for the details           |"
+    echo "+-------------------------------------------------------------------------+"
+    echo
+    echo
+elif [ -e /etc/debian_version ]; then
+    TMP_QUICHE_BSSL_PATH="${BASE}/boringssl/lib"
+    echo "+-------------------------------------------------------------------------+"
+    echo "| You probably need to run this, or something like this, for your system: |"
+    echo "|                                                                         |"
+    echo "|   sudo apt -y install libev-dev libjemalloc-dev python2-dev libxml2-dev |"
+    echo "|   sudo apt -y install libpython2-dev libc-ares-dev libsystemd-dev       |"
+    echo "|   sudo apt -y install libevent-dev libjansson-dev zlib1g-dev cargo      |"
+    echo "|                                                                         |"
+    echo "| Rust may be needed too, see https://rustup.rs for the details           |"
+    echo "+-------------------------------------------------------------------------+"
+    echo
+    echo
+fi
+
+if [ `uname -s` = "Darwin" ]; then
+    echo "+-------------------------------------------------------------------------+"
+    echo "| When building on a Mac, be aware that the Apple version of clang may    |"
+    echo "| fail to build curl due to the issue described here:                     |"
+    echo "| https://github.com/curl/curl/issues/11391#issuecomment-1623890325       |"
+    echo "+-------------------------------------------------------------------------+"
+fi
+
+if [ -z ${QUICHE_BSSL_PATH+x} ]; then
+   QUICHE_BSSL_PATH=${TMP_QUICHE_BSSL_PATH:-"${BASE}/boringssl/lib"}
+fi
+
+set -x
+if [ `uname -s` = "Linux" ]
+then
+  num_threads=$(nproc)
+elif [ `uname -s` = "FreeBSD" ]
+then
+  num_threads=$(sysctl -n hw.ncpu)
+else
+  # MacOS.
+  num_threads=$(sysctl -n hw.logicalcpu)
+fi
+
+# boringssl
+echo "Building boringssl..."
+
+# We need this go version.
+mkdir -p ${BASE}/go
+
+if [ `uname -m` = "arm64" -o `uname -m` = "aarch64" ]; then
+    ARCH="arm64"
+else
+    ARCH="amd64"
+fi
+
+if [ `uname -s` = "Darwin" ]; then
+    OS="darwin"
+elif [ `uname -s` = "FreeBSD" ]; then
+    OS="freebsd"
+else
+    OS="linux"
+fi
+
+wget https://go.dev/dl/go1.21.6.${OS}-${ARCH}.tar.gz
+rm -rf ${BASE}/go && tar -C ${BASE} -xf go1.21.6.${OS}-${ARCH}.tar.gz
+rm go1.21.6.${OS}-${ARCH}.tar.gz
+chmod -R a+rX ${BASE}
+
+GO_BINARY_PATH=${BASE}/go/bin/go
+if [ ! -d boringssl ]; then
+  git clone https://boringssl.googlesource.com/boringssl
+  cd boringssl
+  git checkout a1843d660b47116207877614af53defa767be46a
+  cd ..
+fi
+cd boringssl
+cmake \
+  -B build-shared \
+  -DGO_EXECUTABLE=${GO_BINARY_PATH} \
+  -DCMAKE_INSTALL_PREFIX=${BASE}/boringssl \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DCMAKE_CXX_FLAGS='-Wno-error=ignored-attributes' \
+  -DBUILD_SHARED_LIBS=1
+cmake \
+  -B build-static \
+  -DGO_EXECUTABLE=${GO_BINARY_PATH} \
+  -DCMAKE_INSTALL_PREFIX=${BASE}/boringssl \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DCMAKE_CXX_FLAGS='-Wno-error=ignored-attributes' \
+  -DBUILD_SHARED_LIBS=0
+cmake --build build-shared -j ${num_threads}
+cmake --build build-static -j ${num_threads}
+cmake --install build-shared
+cmake --install build-static
+chmod -R a+rX ${BASE}
+cd ..
+
+# Build quiche
+# Steps borrowed from: https://github.com/apache/trafficserver-ci/blob/main/docker/rockylinux8/Dockerfile
+echo "Building quiche"
+QUICHE_BASE="${BASE:-/opt}/quiche"
+[ ! -d quiche ] && git clone --recursive https://github.com/cloudflare/quiche.git
+cd quiche
+git checkout 0.20.1
+QUICHE_BSSL_PATH=${QUICHE_BSSL_PATH} QUICHE_BSSL_LINK_KIND=dylib cargo build -j4 --package quiche --release --features ffi,pkg-config-meta,qlog
+mkdir -p ${QUICHE_BASE}/lib/pkgconfig
+mkdir -p ${QUICHE_BASE}/include
+cp target/release/libquiche.a ${QUICHE_BASE}/lib/
+[ -f target/release/libquiche.so ] && cp target/release/libquiche.so ${QUICHE_BASE}/lib/
+cp quiche/include/quiche.h ${QUICHE_BASE}/include/
+cp target/release/quiche.pc ${QUICHE_BASE}/lib/pkgconfig
+chmod -R a+rX ${BASE}
+cd ..
+
+echo "Building OpenSSL with QUIC support"
+[ ! -d openssl-quic ] && git clone -b ${OPENSSL_BRANCH} --depth 1 https://github.com/quictls/openssl.git openssl-quic
+cd openssl-quic
+./config enable-tls1_3 --prefix=${OPENSSL_PREFIX}
+${MAKE} -j ${num_threads}
+${MAKE} install_sw
+chmod -R a+rX ${BASE}
+
+# The symlink target provides a more convenient path for the user while also
+# providing, in the symlink source, the precise branch of the OpenSSL build.
+ln -sf ${OPENSSL_PREFIX} ${OPENSSL_BASE}
+chmod -R a+rX ${BASE}
+cd ..
+
+# OpenSSL will install in /lib or lib64 depending upon the architecture.
+if [ -d "${OPENSSL_PREFIX}/lib" ]; then
+  OPENSSL_LIB="${OPENSSL_PREFIX}/lib"
+elif [ -d "${OPENSSL_PREFIX}/lib64" ]; then
+  OPENSSL_LIB="${OPENSSL_PREFIX}/lib64"
+else
+  echo "Could not find the OpenSSL install library directory."
+  exit 1
+fi
+LDFLAGS=${LDFLAGS:-"-Wl,-rpath,${OPENSSL_LIB}"}
+
+# Then nghttp3
+echo "Building nghttp3..."
+[ ! -d nghttp3 ] && git clone --depth 1 -b v1.2.0 https://github.com/ngtcp2/nghttp3.git
+cd nghttp3
+git submodule update --init
+autoreconf -if
+./configure \
+  --prefix=${BASE} \
+  PKG_CONFIG_PATH=${BASE}/lib/pkgconfig:${OPENSSL_LIB}/pkgconfig \
+  CFLAGS="${CFLAGS}" \
+  CXXFLAGS="${CXXFLAGS}" \
+  LDFLAGS="${LDFLAGS}" \
+  --enable-lib-only
+${MAKE} -j ${num_threads}
+${MAKE} install
+chmod -R a+rX ${BASE}
+cd ..
+
+# Now ngtcp2
+echo "Building ngtcp2..."
+[ ! -d ngtcp2 ] && git clone --depth 1 -b v1.4.0 https://github.com/ngtcp2/ngtcp2.git
+cd ngtcp2
+autoreconf -if
+./configure \
+  --prefix=${BASE} \
+  PKG_CONFIG_PATH=${BASE}/lib/pkgconfig:${OPENSSL_LIB}/pkgconfig \
+  CFLAGS="${CFLAGS}" \
+  CXXFLAGS="${CXXFLAGS}" \
+  LDFLAGS="${LDFLAGS}" \
+  --enable-lib-only
+${MAKE} -j ${num_threads}
+${MAKE} install
+chmod -R a+rX ${BASE}
+cd ..
+
+# Then nghttp2, with support for H3
+echo "Building nghttp2 ..."
+[ ! -d nghttp2 ] && git clone --depth 1 -b v1.60.0 https://github.com/tatsuhiro-t/nghttp2.git
+cd nghttp2
+git submodule update --init
+autoreconf -if
+if [ `uname -s` = "Darwin" ] || [ `uname -s` = "FreeBSD" ]
+then
+  # --enable-app requires systemd which is not available on Mac/FreeBSD.
+  ENABLE_APP=""
+else
+  ENABLE_APP="--enable-app"
+fi
+
+# Note for FreeBSD: This will not build h2load. h2load can be run on a remote machine.
+./configure \
+  --prefix=${BASE} \
+  PKG_CONFIG_PATH=${BASE}/lib/pkgconfig:${OPENSSL_LIB}/pkgconfig \
+  CFLAGS="${CFLAGS}" \
+  CXXFLAGS="${CXXFLAGS}" \
+  LDFLAGS="${LDFLAGS} -L${OPENSSL_LIB}" \
+  --enable-http3 \
+  ${ENABLE_APP}
+${MAKE} -j ${num_threads}
+${MAKE} install
+chmod -R a+rX ${BASE}
+cd ..
+
+# Then curl
+echo "Building curl ..."
+[ ! -d curl ] && git clone --depth 1 -b curl-8_5_0 https://github.com/curl/curl.git
+cd curl
+# On mac autoreconf fails on the first attempt with an issue finding ltmain.sh.
+# The second runs fine.
+autoreconf -fi || autoreconf -fi
+./configure \
+  --prefix=${BASE} \
+  --with-ssl=${OPENSSL_PREFIX} \
+  --with-nghttp2=${BASE} \
+  --with-nghttp3=${BASE} \
+  --with-ngtcp2=${BASE} \
+  CFLAGS="${CFLAGS}" \
+  CXXFLAGS="${CXXFLAGS}" \
+  LDFLAGS="${LDFLAGS}"
+${MAKE} -j ${num_threads}
+${MAKE} install
+chmod -R a+rX ${BASE}
+cd ..
diff --git a/docker/rockylinux10/install_abi_tools.sh b/docker/rockylinux10/install_abi_tools.sh
new file mode 100755
index 00000000..a20b011e
--- /dev/null
+++ b/docker/rockylinux10/install_abi_tools.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -x
+
+rm -rf github
+mkdir github
+cd github
+git clone https://github.com/lvc/installer.git
+cd installer
+for i in abi-dumper abi-tracker abi-compliance-checker vtable-dumper abi-monitor; do
+  sudo make install prefix=/usr/local target=${i}
+done
+rm -rf github
diff --git a/docker/ubuntu2604/Dockerfile b/docker/ubuntu2604/Dockerfile
new file mode 100644
index 00000000..b2dcd884
--- /dev/null
+++ b/docker/ubuntu2604/Dockerfile
@@ -0,0 +1,70 @@
+FROM ubuntu:26.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN <<EOF
+    set -e
+
+    apt-get update
+
+    apt-get -y install build-essential llvm lld ccache \
+    make pkgconf bison flex g++ clang gettext libc++-dev autoconf automake \
+    libtool autotools-dev git distcc file wget openssl hwloc intltool-debian \
+    clang-tools-14 clang-14 cmake ninja-build
+
+    apt-get -y install libssl-dev libexpat1-dev \
+    libpcre3-dev libcap-dev libhwloc-dev libunwind8 libunwind-dev zlib1g-dev \
+    libjemalloc-dev libluajit-5.1-dev liblzma-dev \
+    libhiredis-dev libbrotli-dev libncurses-dev libgeoip-dev libmagick++-dev \
+    libmaxminddb-dev libcjose-dev libcjose0 libjansson-dev libzstd-dev liblz4-dev
+
+    apt-get -y autoremove
+    apt-get -y clean
+EOF
+
+# We put our custom packages in /opt.
+RUN <<EOF
+  set -e
+  mkdir -p /opt/bin
+  chmod 755 /opt/bin
+  echo 'PATH=/opt/bin:$PATH' | tee -a /etc/bash.bashrc
+EOF
+
+ARG PATH=/opt/bin:$PATH
+
+# Install nuraft for the stek_share plugin. Distros, unfortunately, do not
+# package these, so this has to be built by hand.
+RUN <<EOF
+  set -e
+
+  git clone https://github.com/eBay/NuRaft.git
+  cd NuRaft
+  ./prepare.sh
+
+  cmake \
+    -B build \
+    -G Ninja \
+    -DCMAKE_INSTALL_PREFIX=/opt/
+  cmake --build build
+  cmake --install build
+  cd ../
+  rm -rf NuRaft
+EOF
+
+# Add the CI's test user. N.B: 1200 is the uid that our jenkins user is
+# configured with, so that has to be used. Otherwise there will be permissions
+# issues.
+ARG username=jenkins
+ARG uid=1200
+RUN <<EOF
+  set -e
+  useradd \
+    --home-dir /home/${username} \
+    --groups users,sudo \
+    --uid ${uid} \
+    --shell /bin/bash \
+    --create-home \
+    ${username}
+  echo "${username} ALL=(ALL:ALL) NOPASSWD:ALL" >> /etc/sudoers
+  chown -R ${username} /home/${username}
+EOF