From b69d48c80299c8afda732d839d22c8eee274ebe6 Mon Sep 17 00:00:00 2001 From: perennial Date: Fri, 31 May 2024 13:06:49 +1000 Subject: [PATCH] Revert "Container pipeline overhaul (#59)" This reverts commit 3f4526debee9a4c5fc932c2c5fbe4025667d789f. --- .github/workflows/build-artifacts.yaml | 76 -------------- .github/workflows/main-docker.yml | 133 +++++++------------------ Dockerfile | 30 ++++-- Dockerfile.arm | 45 +++++++++ Dockerfile.armv7 | 43 ++++++++ 5 files changed, 146 insertions(+), 181 deletions(-) delete mode 100644 .github/workflows/build-artifacts.yaml create mode 100644 Dockerfile.arm create mode 100644 Dockerfile.armv7 diff --git a/.github/workflows/build-artifacts.yaml b/.github/workflows/build-artifacts.yaml deleted file mode 100644 index 695d1bff..00000000 --- a/.github/workflows/build-artifacts.yaml +++ /dev/null @@ -1,76 +0,0 @@ -name: Release Build - -on: - push: - paths-ignore: - - "*.md" - - "compose.*" - branches: - - "main" - release: - types: [published] - -env: - CARGO_TERM_COLOR: always - - CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: aarch64-linux-gnu-gcc - CC_aarch64_unknown_linux_musl: aarch64-linux-gnu-gcc - CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER: arm-linux-gnueabihf-gcc - CC_armv7_unknown_linux_musleabihf: arm-linux-gnueabihf-gcc - -jobs: - build: - name: Rust project - latest - runs-on: ubuntu-latest - strategy: - matrix: - target: - - x86_64-unknown-linux-musl - - aarch64-unknown-linux-musl - - armv7-unknown-linux-musleabihf - steps: - - uses: actions/checkout@v4 - - - uses: actions-rust-lang/setup-rust-toolchain@v1 - with: - target: ${{ matrix.target }} - - - if: matrix.target == 'x86_64-unknown-linux-musl' - run: | - sudo apt-get update - sudo apt-get install -y --no-install-recommends musl-tools - - - if: matrix.target == 'armv7-unknown-linux-musleabihf' - run: | - sudo apt update - sudo apt install -y gcc-arm-linux-gnueabihf musl-tools - - - if: matrix.target == 'aarch64-unknown-linux-musl' - run: | - sudo apt update - sudo apt install -y gcc-aarch64-linux-gnu musl-tools - - - name: Versions - id: version - run: echo "VERSION=$(cargo metadata --format-version 1 --no-deps | jq .packages[0].version -r | sed 's/^/v/')" >> "$GITHUB_OUTPUT" - - - name: Build - run: cargo build --release --target ${{ matrix.target }} - - - name: Package release - run: tar czf redlib-${{ matrix.target }}.tar.gz -C target/${{ matrix.target }}/release/ redlib - - - name: Upload release - uses: softprops/action-gh-release@v1 - with: - tag_name: ${{ steps.version.outputs.VERSION }} - name: ${{ steps.version.outputs.VERSION }} - ${{ github.event.head_commit.message }} - draft: true - files: | - redlib-${{ matrix.target }}.tar.gz - body: | - - ${{ github.event.head_commit.message }} ${{ github.sha }} - generate_release_notes: true - - - diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 9a10ac7f..4104dc21 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -1,112 +1,44 @@ -name: Container build +name: Docker Build on: - workflow_run: - workflows: ["Release Build"] - types: - - completed -env: - REGISTRY_IMAGE: quay.io/redlib/redlib + push: + paths-ignore: + - "**.md" + branches: + - 'main' jobs: - build: + build-docker: runs-on: ubuntu-latest strategy: - fail-fast: false matrix: - include: - - { platform: linux/amd64, target: x86_64-unknown-linux-musl} - - { platform: linux/arm64, target: aarch64-unknown-linux-musl} - - { platform: linux/arm/v7, target: armv7-unknown-linux-musleabihf} + config: + - { platform: 'linux/amd64', tag: 'latest', dockerfile: 'Dockerfile' } + - { platform: 'linux/arm64', tag: 'latest-arm', dockerfile: 'Dockerfile.arm' } + - { platform: 'linux/arm/v7', tag: 'latest-armv7', dockerfile: 'Dockerfile.armv7' } steps: - - - name: Checkout - uses: actions/checkout@v4 - - - name: Docker meta - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY_IMAGE }} - tags: | - type=sha - type=raw,value=latest,enable={{is_default_branch}} - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Login to Quay.io Container Registry - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_ROBOT_TOKEN }} - - - name: Build and push - id: build - uses: docker/build-push-action@v5 - with: - context: . - platforms: ${{ matrix.platform }} - labels: ${{ steps.meta.outputs.labels }} - outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true - file: Dockerfile - build-args: TARGET=${{ matrix.target }} - - - name: Export digest - run: | - mkdir -p /tmp/digests - digest="${{ steps.build.outputs.digest }}" - touch "/tmp/digests/${digest#sha256:}" - - - name: Upload digest - uses: actions/upload-artifact@v3 - with: - name: digests - path: /tmp/digests/* - if-no-files-found: error - retention-days: 1 - merge: - runs-on: ubuntu-latest - needs: - - build - steps: - - - name: Download digests - uses: actions/download-artifact@v3 + - name: Checkout sources + uses: actions/checkout@v3 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 with: - name: digests - path: /tmp/digests - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Docker meta - id: meta - uses: docker/metadata-action@v5 + platforms: all + + - name: Set up Docker Buildx + id: buildx + uses: docker/setup-buildx-action@v2 with: - images: ${{ env.REGISTRY_IMAGE }} - tags: | - type=sha - type=raw,value=latest,enable={{is_default_branch}} - - - name: Login to Quay.io Container Registry + version: latest + + - name: Login to Quay.io uses: docker/login-action@v3 with: registry: quay.io username: ${{ secrets.QUAY_USERNAME }} password: ${{ secrets.QUAY_ROBOT_TOKEN }} - - - name: Create manifest list and push - working-directory: /tmp/digests - run: | - docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ - $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) - - name: Push README to Quay.io + - name: push README to Quay.io uses: christian-korneck/update-container-description-action@v1 env: DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }} @@ -115,8 +47,13 @@ jobs: provider: quay readme_file: 'README.md' - - - name: Inspect image - run: | - docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} - + - name: Build and push + uses: docker/build-push-action@v5 + with: + context: . + file: ./${{ matrix.config.dockerfile }} + platforms: ${{ matrix.config.platform }} + push: true + tags: quay.io/redlib/redlib:${{ matrix.config.tag }} + cache-from: type=gha + cache-to: type=gha,mode=max diff --git a/Dockerfile b/Dockerfile index 314a784f..24c00e94 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,12 +1,29 @@ -FROM alpine:3.19 +#################################################################################################### +## Builder +#################################################################################################### +FROM rust:alpine AS builder -ARG TARGET +RUN apk add --no-cache musl-dev -RUN apk add --no-cache curl +WORKDIR /redlib -RUN curl -L https://github.com/redlib-org/redlib/releases/latest/download/redlib-${TARGET}.tar.gz | \ - tar xz -C /usr/local/bin/ +COPY . . +RUN cargo build --target x86_64-unknown-linux-musl --release + +#################################################################################################### +## Final image +#################################################################################################### +FROM alpine:latest + +# Import ca-certificates from builder +COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates +COPY --from=builder /etc/ssl/certs /etc/ssl/certs + +# Copy our build +COPY --from=builder /redlib/target/x86_64-unknown-linux-musl/release/redlib /usr/local/bin/redlib + +# Use an unprivileged user. RUN adduser --home /nonexistent --no-create-home --disabled-password redlib USER redlib @@ -16,5 +33,4 @@ EXPOSE 8080 # Run a healthcheck every minute to make sure redlib is functional HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider -q http://localhost:8080/settings || exit 1 -CMD ["redlib"] - +CMD ["redlib"] \ No newline at end of file diff --git a/Dockerfile.arm b/Dockerfile.arm new file mode 100644 index 00000000..fd10a633 --- /dev/null +++ b/Dockerfile.arm @@ -0,0 +1,45 @@ +#################################################################################################### +## Builder +#################################################################################################### +FROM rust:alpine AS builder + +RUN apk add --no-cache g++ git + +WORKDIR /usr/src/redlib + +# cache dependencies in their own layer +COPY Cargo.lock Cargo.toml . +RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo install --config net.git-fetch-with-cli=true --path . && rm -rf ./src + +COPY . . + +# net.git-fetch-with-cli is specified in order to prevent a potential OOM kill +# in low memory environments. See: +# https://users.rust-lang.org/t/cargo-uses-too-much-memory-being-run-in-qemu/76531 +# This is tracked under issue #641. This also requires us to install git in the +# builder. +RUN cargo install --config net.git-fetch-with-cli=true --path . + +#################################################################################################### +## Final image +#################################################################################################### +FROM alpine:latest + +# Import ca-certificates from builder +COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates +COPY --from=builder /etc/ssl/certs /etc/ssl/certs + +# Copy our build +COPY --from=builder /usr/local/cargo/bin/redlib /usr/local/bin/redlib + +# Use an unprivileged user. +RUN adduser --home /nonexistent --no-create-home --disabled-password redlib +USER redlib + +# Tell Docker to expose port 8080 +EXPOSE 8080 + +# Run a healthcheck every minute to make sure redlib is functional +HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 + +CMD ["redlib"] diff --git a/Dockerfile.armv7 b/Dockerfile.armv7 new file mode 100644 index 00000000..782750e2 --- /dev/null +++ b/Dockerfile.armv7 @@ -0,0 +1,43 @@ +#################################################################################################### +## Builder +#################################################################################################### +FROM --platform=$BUILDPLATFORM rust:slim AS builder + +ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER=arm-linux-gnueabihf-gcc +ENV CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc + +RUN apt-get update && apt-get -y install gcc-arm-linux-gnueabihf \ + binutils-arm-linux-gnueabihf \ + musl-tools + +RUN rustup target add armv7-unknown-linux-musleabihf + +WORKDIR /redlib + +COPY . . + +RUN cargo build --target armv7-unknown-linux-musleabihf --release + +#################################################################################################### +## Final image +#################################################################################################### +FROM alpine:latest + +# Import ca-certificates from builder +COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates +COPY --from=builder /etc/ssl/certs /etc/ssl/certs + +# Copy our build +COPY --from=builder /redlib/target/armv7-unknown-linux-musleabihf/release/redlib /usr/local/bin/redlib + +# Use an unprivileged user. +RUN adduser --home /nonexistent --no-create-home --disabled-password redlib +USER redlib + +# Tell Docker to expose port 8080 +EXPOSE 8080 + +# Run a healthcheck every minute to make sure redlib is functional +HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 + +CMD ["redlib"]