Revert "Container pipeline overhaul (redlib-org#59)"

This reverts commit 3f4526d.

.github/workflows/main-docker.yml

@@ -1,112 +1,44 @@
-name: Container build
+name: Docker Build
 
 on:
-  workflow_run:
-    workflows: ["Release Build"]
-    types:
-      - completed
-env:
-  REGISTRY_IMAGE: quay.io/redlib/redlib
+  push:
+    paths-ignore:
+      - "**.md"
+    branches:
+      - 'main'
 
 jobs:
-  build:
+  build-docker:
     runs-on: ubuntu-latest
     strategy:
-      fail-fast: false
       matrix:
-        include:
-          - { platform: linux/amd64, target: x86_64-unknown-linux-musl}
-          - { platform: linux/arm64, target: aarch64-unknown-linux-musl}
-          - { platform: linux/arm/v7, target: armv7-unknown-linux-musleabihf}
+        config:
+          - { platform: 'linux/amd64', tag: 'latest', dockerfile: 'Dockerfile' }
+          - { platform: 'linux/arm64', tag: 'latest-arm', dockerfile: 'Dockerfile.arm' }
+          - { platform: 'linux/arm/v7', tag: 'latest-armv7', dockerfile: 'Dockerfile.armv7' }
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY_IMAGE }}
-          tags: |
-            type=sha
-            type=raw,value=latest,enable={{is_default_branch}}
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to Quay.io Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
-      -
-        name: Build and push
-        id: build
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
-          file: Dockerfile
-          build-args: TARGET=${{ matrix.target }}
-      -
-        name: Export digest
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-      -
-        name: Upload digest
-        uses: actions/upload-artifact@v3
-        with:
-          name: digests
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-  merge:
-    runs-on: ubuntu-latest
-    needs:
-      - build
-    steps:
-      -
-        name: Download digests
-        uses: actions/download-artifact@v3
+      - name: Checkout sources
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
         with:
-          name: digests
-          path: /tmp/digests
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
+          platforms: all
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v2
         with:
-          images: ${{ env.REGISTRY_IMAGE }}
-          tags: |
-            type=sha
-            type=raw,value=latest,enable={{is_default_branch}}
-      -
-        name: Login to Quay.io Container Registry
+          version: latest
+
+      - name: Login to Quay.io
         uses: docker/login-action@v3
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_ROBOT_TOKEN }}
-      -
-        name: Create manifest list and push
-        working-directory: /tmp/digests
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
 
-      - name: Push README to Quay.io
+      - name: push README to Quay.io
         uses: christian-korneck/update-container-description-action@v1
         env:
           DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }}
@@ -115,8 +47,13 @@ jobs:
           provider: quay
           readme_file: 'README.md'
 
-      -
-        name: Inspect image
-        run: |
-          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
-          
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./${{ matrix.config.dockerfile }}
+          platforms: ${{ matrix.config.platform }}
+          push: true
+          tags: quay.io/redlib/redlib:${{ matrix.config.tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Dockerfile

@@ -1,12 +1,29 @@
-FROM alpine:3.19
+####################################################################################################
+## Builder
+####################################################################################################
+FROM rust:alpine AS builder
 
-ARG TARGET
+RUN apk add --no-cache musl-dev
 
-RUN apk add --no-cache curl
+WORKDIR /redlib
 
-RUN curl -L https://github.com/redlib-org/redlib/releases/latest/download/redlib-${TARGET}.tar.gz | \
-    tar xz -C /usr/local/bin/
+COPY . .
 
+RUN cargo build --target x86_64-unknown-linux-musl --release
+
+####################################################################################################
+## Final image
+####################################################################################################
+FROM alpine:latest
+
+# Import ca-certificates from builder
+COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
+
+# Copy our build
+COPY --from=builder /redlib/target/x86_64-unknown-linux-musl/release/redlib /usr/local/bin/redlib
+
+# Use an unprivileged user.
 RUN adduser --home /nonexistent --no-create-home --disabled-password redlib
 USER redlib
 
@@ -16,5 +33,4 @@ EXPOSE 8080
 # Run a healthcheck every minute to make sure redlib is functional
 HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider -q http://localhost:8080/settings || exit 1
 
-CMD ["redlib"]
-
+CMD ["redlib"]

Dockerfile.arm

@@ -0,0 +1,45 @@
+####################################################################################################
+## Builder
+####################################################################################################
+FROM rust:alpine AS builder
+
+RUN apk add --no-cache g++ git
+
+WORKDIR /usr/src/redlib
+
+# cache dependencies in their own layer
+COPY Cargo.lock Cargo.toml .
+RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo install --config net.git-fetch-with-cli=true --path . && rm -rf ./src
+
+COPY . .
+
+# net.git-fetch-with-cli is specified in order to prevent a potential OOM kill
+# in low memory environments. See:
+#     https://users.rust-lang.org/t/cargo-uses-too-much-memory-being-run-in-qemu/76531
+# This is tracked under issue #641. This also requires us to install git in the
+# builder.
+RUN cargo install --config net.git-fetch-with-cli=true --path .
+
+####################################################################################################
+## Final image
+####################################################################################################
+FROM alpine:latest
+
+# Import ca-certificates from builder
+COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
+
+# Copy our build
+COPY --from=builder /usr/local/cargo/bin/redlib /usr/local/bin/redlib
+
+# Use an unprivileged user.
+RUN adduser --home /nonexistent --no-create-home --disabled-password redlib
+USER redlib
+
+# Tell Docker to expose port 8080
+EXPOSE 8080
+
+# Run a healthcheck every minute to make sure redlib is functional
+HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1
+
+CMD ["redlib"]

Dockerfile.armv7

@@ -0,0 +1,43 @@
+####################################################################################################
+## Builder
+####################################################################################################
+FROM --platform=$BUILDPLATFORM rust:slim AS builder
+
+ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER=arm-linux-gnueabihf-gcc
+ENV CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc
+
+RUN apt-get update && apt-get -y install gcc-arm-linux-gnueabihf \
+    binutils-arm-linux-gnueabihf \
+    musl-tools
+
+RUN rustup target add armv7-unknown-linux-musleabihf
+
+WORKDIR /redlib
+
+COPY . .
+
+RUN cargo build --target armv7-unknown-linux-musleabihf --release
+
+####################################################################################################
+## Final image
+####################################################################################################
+FROM alpine:latest
+
+# Import ca-certificates from builder
+COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
+
+# Copy our build
+COPY --from=builder /redlib/target/armv7-unknown-linux-musleabihf/release/redlib /usr/local/bin/redlib
+
+# Use an unprivileged user.
+RUN adduser --home /nonexistent --no-create-home --disabled-password redlib
+USER redlib
+
+# Tell Docker to expose port 8080
+EXPOSE 8080
+
+# Run a healthcheck every minute to make sure redlib is functional
+HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1
+
+CMD ["redlib"]