From b411b24e4a42d909eba2bb0171c1bbb3929f6aa6 Mon Sep 17 00:00:00 2001 From: nohoster Date: Tue, 30 Jan 2024 11:58:59 -0600 Subject: [PATCH] Simplified docker image building --- .github/workflows/main-docker.yml | 136 +++++++++++++++++++++--------- Dockerfile | 16 ++-- Dockerfile.arm | 45 ---------- Dockerfile.armv7 | 43 ---------- 4 files changed, 103 insertions(+), 137 deletions(-) delete mode 100644 Dockerfile.arm delete mode 100644 Dockerfile.armv7 diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 4104dc2..56fcebd 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -1,59 +1,111 @@ -name: Docker Build +name: ci on: push: paths-ignore: - "**.md" branches: - - 'main' - + - "main" +env: + REGISTRY_IMAGE: ghcr.io/nohoster/redlib jobs: - build-docker: + build: runs-on: ubuntu-latest strategy: + fail-fast: false matrix: - config: - - { platform: 'linux/amd64', tag: 'latest', dockerfile: 'Dockerfile' } - - { platform: 'linux/arm64', tag: 'latest-arm', dockerfile: 'Dockerfile.arm' } - - { platform: 'linux/arm/v7', tag: 'latest-armv7', dockerfile: 'Dockerfile.armv7' } + platform: + - linux/amd64 + - linux/arm64 + - linux/arm/v7 steps: - - name: Checkout sources + - + name: Checkout uses: actions/checkout@v3 - - - name: Set up QEMU + - + name: Docker meta + id: meta + uses: docker/metadata-action@v4 + with: + images: ${{ env.REGISTRY_IMAGE }} + tags: | + type=sha + type=raw,value=latest,enable={{is_default_branch}} + - + name: Set up QEMU uses: docker/setup-qemu-action@v2 - with: - platforms: all - - - name: Set up Docker Buildx - id: buildx + - + name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 + - + name: Login to GitHub Container Registry + uses: docker/login-action@v2 with: - version: latest - - - name: Login to Quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_ROBOT_TOKEN }} - - - name: push README to Quay.io - uses: christian-korneck/update-container-description-action@v1 - env: - DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }} - with: - destination_container_repo: quay.io/redlib/redlib - provider: quay - readme_file: 'README.md' - - - name: Build and push - uses: docker/build-push-action@v5 + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + - + name: Build and push + id: build + uses: docker/build-push-action@v4 with: context: . - file: ./${{ matrix.config.dockerfile }} - platforms: ${{ matrix.config.platform }} - push: true - tags: quay.io/redlib/redlib:${{ matrix.config.tag }} - cache-from: type=gha - cache-to: type=gha,mode=max + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true + file: Dockerfile + - + name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + - + name: Upload digest + uses: actions/upload-artifact@v3 + with: + name: digests + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + merge: + runs-on: ubuntu-latest + needs: + - build + steps: + - + name: Download digests + uses: actions/download-artifact@v3 + with: + name: digests + path: /tmp/digests + - + name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + - + name: Docker meta + id: meta + uses: docker/metadata-action@v4 + with: + images: ${{ env.REGISTRY_IMAGE }} + tags: | + type=sha + type=raw,value=latest,enable={{is_default_branch}} + - + name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + - + name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) + - + name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} + diff --git a/Dockerfile b/Dockerfile index e1ee914..d0e7246 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,27 +1,28 @@ #################################################################################################### ## Builder #################################################################################################### -FROM rust:alpine AS builder -RUN apk add --no-cache musl-dev +FROM alpine:3.19 AS builder + +RUN apk add --no-cache cargo git g++ WORKDIR /redlib COPY . . -RUN cargo build --target x86_64-unknown-linux-musl --release +RUN cargo build --config net.git-fetch-with-cli=true --release #################################################################################################### ## Final image #################################################################################################### -FROM alpine:latest -# Import ca-certificates from builder +FROM alpine:3.19 + COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates COPY --from=builder /etc/ssl/certs /etc/ssl/certs # Copy our build -COPY --from=builder /redlib/target/x86_64-unknown-linux-musl/release/redlib /usr/local/bin/redlib +COPY --from=builder /redlib/target/release/redlib /usr/local/bin/redlib # Use an unprivileged user. RUN adduser --home /nonexistent --no-create-home --disabled-password redlib @@ -33,4 +34,5 @@ EXPOSE 8080 # Run a healthcheck every minute to make sure redlib is functional HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 -CMD ["redlib"] \ No newline at end of file +CMD ["redlib"] + diff --git a/Dockerfile.arm b/Dockerfile.arm deleted file mode 100644 index fd10a63..0000000 --- a/Dockerfile.arm +++ /dev/null @@ -1,45 +0,0 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM rust:alpine AS builder - -RUN apk add --no-cache g++ git - -WORKDIR /usr/src/redlib - -# cache dependencies in their own layer -COPY Cargo.lock Cargo.toml . -RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo install --config net.git-fetch-with-cli=true --path . && rm -rf ./src - -COPY . . - -# net.git-fetch-with-cli is specified in order to prevent a potential OOM kill -# in low memory environments. See: -# https://users.rust-lang.org/t/cargo-uses-too-much-memory-being-run-in-qemu/76531 -# This is tracked under issue #641. This also requires us to install git in the -# builder. -RUN cargo install --config net.git-fetch-with-cli=true --path . - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /usr/local/cargo/bin/redlib /usr/local/bin/redlib - -# Use an unprivileged user. -RUN adduser --home /nonexistent --no-create-home --disabled-password redlib -USER redlib - -# Tell Docker to expose port 8080 -EXPOSE 8080 - -# Run a healthcheck every minute to make sure redlib is functional -HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 - -CMD ["redlib"] diff --git a/Dockerfile.armv7 b/Dockerfile.armv7 deleted file mode 100644 index 782750e..0000000 --- a/Dockerfile.armv7 +++ /dev/null @@ -1,43 +0,0 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM --platform=$BUILDPLATFORM rust:slim AS builder - -ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER=arm-linux-gnueabihf-gcc -ENV CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc - -RUN apt-get update && apt-get -y install gcc-arm-linux-gnueabihf \ - binutils-arm-linux-gnueabihf \ - musl-tools - -RUN rustup target add armv7-unknown-linux-musleabihf - -WORKDIR /redlib - -COPY . . - -RUN cargo build --target armv7-unknown-linux-musleabihf --release - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /redlib/target/armv7-unknown-linux-musleabihf/release/redlib /usr/local/bin/redlib - -# Use an unprivileged user. -RUN adduser --home /nonexistent --no-create-home --disabled-password redlib -USER redlib - -# Tell Docker to expose port 8080 -EXPOSE 8080 - -# Run a healthcheck every minute to make sure redlib is functional -HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 - -CMD ["redlib"]