Build missing STS container libraries using original sources.

docs/storage-transfer.md

@@ -117,13 +117,25 @@ STS_AGENT_POOL=my-agents
 HOSTNAME=agent-host
 ```
 
-The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. The agent launcher is statically linked with the Google runtime glibc 2.27 (GRTE v5), which loads shared libraries from `/usr/grte/v5/lib64`. `sts-agent/Dockerfile` adds the glibc 2.27 libraries of Ubuntu 18.04 there.
+The image of Google lacks the shared glibc libraries that the `cryptography` package needs for certificate-based authentication. The agent launcher is statically linked with GRTE v5, the Google Run Time Environment based on glibc 2.27, which loads shared libraries from `/usr/grte/v5/lib64`. The libraries must come from the same GRTE build, because GRTE changes internal structures of the dynamic loader. `sts-agent/build-grte.sh` builds them from the GRTE v5 source at `https://third-party-mirror.googlesource.com/GRTEv5` in a temporary `ubuntu:18.04` container, and `sts-agent/Dockerfile` adds them to the image.
+
+Build the GRTE v5 libraries into `sts-agent/grte`:
+
+```bash
+cd sts-agent
+docker run --rm --security-opt apparmor=unconfined \
+    -v "$PWD/build-grte.sh:/build-grte.sh:ro" \
+    -v "$PWD/grte:/out" \
+    ubuntu:18.04 /build-grte.sh
+```
+
+`--security-opt apparmor=unconfined` is needed only where Docker cannot load its AppArmor profile, for example inside an LXC container.
 
 Build the image and start the agent:
 
 ```bash
-cd sts-agent
-sudo docker compose up -d --build
+docker compose build
+docker compose up -d
 ```
 
 The directories are mounted at the same paths as on the host. The transfer job refers to the source directory by that path, and `certificate_config.json` holds the host paths of the certificate and key.