From b411b24e4a42d909eba2bb0171c1bbb3929f6aa6 Mon Sep 17 00:00:00 2001 From: nohoster Date: Tue, 30 Jan 2024 11:58:59 -0600 Subject: [PATCH 1/6] Simplified docker image building --- .github/workflows/main-docker.yml | 134 +++++++++++++++++++++--------- Dockerfile | 16 ++-- Dockerfile.arm | 45 ---------- Dockerfile.armv7 | 43 ---------- 4 files changed, 102 insertions(+), 136 deletions(-) delete mode 100644 Dockerfile.arm delete mode 100644 Dockerfile.armv7 diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 4104dc21..56fcebd5 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -1,59 +1,111 @@ -name: Docker Build +name: ci on: push: paths-ignore: - "**.md" branches: - - 'main' - + - "main" +env: + REGISTRY_IMAGE: ghcr.io/nohoster/redlib jobs: - build-docker: + build: runs-on: ubuntu-latest strategy: + fail-fast: false matrix: - config: - - { platform: 'linux/amd64', tag: 'latest', dockerfile: 'Dockerfile' } - - { platform: 'linux/arm64', tag: 'latest-arm', dockerfile: 'Dockerfile.arm' } - - { platform: 'linux/arm/v7', tag: 'latest-armv7', dockerfile: 'Dockerfile.armv7' } + platform: + - linux/amd64 + - linux/arm64 + - linux/arm/v7 steps: - - name: Checkout sources + - + name: Checkout uses: actions/checkout@v3 - - - name: Set up QEMU - uses: docker/setup-qemu-action@v2 + - + name: Docker meta + id: meta + uses: docker/metadata-action@v4 with: - platforms: all - - - name: Set up Docker Buildx - id: buildx + images: ${{ env.REGISTRY_IMAGE }} + tags: | + type=sha + type=raw,value=latest,enable={{is_default_branch}} + - + name: Set up QEMU + uses: docker/setup-qemu-action@v2 + - + name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 + - + name: Login to GitHub Container Registry + uses: docker/login-action@v2 with: - version: latest - - - name: Login to Quay.io - uses: docker/login-action@v3 + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + - + name: Build and push + id: build + uses: docker/build-push-action@v4 with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_ROBOT_TOKEN }} - - - name: push README to Quay.io - uses: christian-korneck/update-container-description-action@v1 - env: - DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }} + context: . + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true + file: Dockerfile + - + name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + - + name: Upload digest + uses: actions/upload-artifact@v3 with: - destination_container_repo: quay.io/redlib/redlib - provider: quay - readme_file: 'README.md' - - - name: Build and push - uses: docker/build-push-action@v5 + name: digests + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + merge: + runs-on: ubuntu-latest + needs: + - build + steps: + - + name: Download digests + uses: actions/download-artifact@v3 with: - context: . - file: ./${{ matrix.config.dockerfile }} - platforms: ${{ matrix.config.platform }} - push: true - tags: quay.io/redlib/redlib:${{ matrix.config.tag }} - cache-from: type=gha - cache-to: type=gha,mode=max + name: digests + path: /tmp/digests + - + name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + - + name: Docker meta + id: meta + uses: docker/metadata-action@v4 + with: + images: ${{ env.REGISTRY_IMAGE }} + tags: | + type=sha + type=raw,value=latest,enable={{is_default_branch}} + - + name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + - + name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) + - + name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} + diff --git a/Dockerfile b/Dockerfile index e1ee914c..d0e7246e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,27 +1,28 @@ #################################################################################################### ## Builder #################################################################################################### -FROM rust:alpine AS builder -RUN apk add --no-cache musl-dev +FROM alpine:3.19 AS builder + +RUN apk add --no-cache cargo git g++ WORKDIR /redlib COPY . . -RUN cargo build --target x86_64-unknown-linux-musl --release +RUN cargo build --config net.git-fetch-with-cli=true --release #################################################################################################### ## Final image #################################################################################################### -FROM alpine:latest -# Import ca-certificates from builder +FROM alpine:3.19 + COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates COPY --from=builder /etc/ssl/certs /etc/ssl/certs # Copy our build -COPY --from=builder /redlib/target/x86_64-unknown-linux-musl/release/redlib /usr/local/bin/redlib +COPY --from=builder /redlib/target/release/redlib /usr/local/bin/redlib # Use an unprivileged user. RUN adduser --home /nonexistent --no-create-home --disabled-password redlib @@ -33,4 +34,5 @@ EXPOSE 8080 # Run a healthcheck every minute to make sure redlib is functional HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 -CMD ["redlib"] \ No newline at end of file +CMD ["redlib"] + diff --git a/Dockerfile.arm b/Dockerfile.arm deleted file mode 100644 index fd10a633..00000000 --- a/Dockerfile.arm +++ /dev/null @@ -1,45 +0,0 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM rust:alpine AS builder - -RUN apk add --no-cache g++ git - -WORKDIR /usr/src/redlib - -# cache dependencies in their own layer -COPY Cargo.lock Cargo.toml . -RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo install --config net.git-fetch-with-cli=true --path . && rm -rf ./src - -COPY . . - -# net.git-fetch-with-cli is specified in order to prevent a potential OOM kill -# in low memory environments. See: -# https://users.rust-lang.org/t/cargo-uses-too-much-memory-being-run-in-qemu/76531 -# This is tracked under issue #641. This also requires us to install git in the -# builder. -RUN cargo install --config net.git-fetch-with-cli=true --path . - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /usr/local/cargo/bin/redlib /usr/local/bin/redlib - -# Use an unprivileged user. -RUN adduser --home /nonexistent --no-create-home --disabled-password redlib -USER redlib - -# Tell Docker to expose port 8080 -EXPOSE 8080 - -# Run a healthcheck every minute to make sure redlib is functional -HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 - -CMD ["redlib"] diff --git a/Dockerfile.armv7 b/Dockerfile.armv7 deleted file mode 100644 index 782750e2..00000000 --- a/Dockerfile.armv7 +++ /dev/null @@ -1,43 +0,0 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM --platform=$BUILDPLATFORM rust:slim AS builder - -ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER=arm-linux-gnueabihf-gcc -ENV CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc - -RUN apt-get update && apt-get -y install gcc-arm-linux-gnueabihf \ - binutils-arm-linux-gnueabihf \ - musl-tools - -RUN rustup target add armv7-unknown-linux-musleabihf - -WORKDIR /redlib - -COPY . . - -RUN cargo build --target armv7-unknown-linux-musleabihf --release - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /redlib/target/armv7-unknown-linux-musleabihf/release/redlib /usr/local/bin/redlib - -# Use an unprivileged user. -RUN adduser --home /nonexistent --no-create-home --disabled-password redlib -USER redlib - -# Tell Docker to expose port 8080 -EXPOSE 8080 - -# Run a healthcheck every minute to make sure redlib is functional -HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 - -CMD ["redlib"] From 356e1b12e4efbdae016cebd45be965f29b6d420b Mon Sep 17 00:00:00 2001 From: nohoster Date: Tue, 30 Jan 2024 12:04:27 -0600 Subject: [PATCH 2/6] minor name fix --- .github/workflows/main-docker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 56fcebd5..492cddb9 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -1,4 +1,4 @@ -name: ci +name: Container build on: push: From 7d2771acf4dcfb2b351e2fe0b105bce531fe6324 Mon Sep 17 00:00:00 2001 From: nohoster Date: Sat, 24 Feb 2024 16:16:10 -0600 Subject: [PATCH 3/6] Optimize container pipeline --- .github/workflows/build-artifacts.yaml | 68 ++++++++++++++++++++++++++ .github/workflows/main-docker.yml | 19 +++---- Dockerfile | 28 ++--------- 3 files changed, 83 insertions(+), 32 deletions(-) create mode 100644 .github/workflows/build-artifacts.yaml diff --git a/.github/workflows/build-artifacts.yaml b/.github/workflows/build-artifacts.yaml new file mode 100644 index 00000000..7b671a63 --- /dev/null +++ b/.github/workflows/build-artifacts.yaml @@ -0,0 +1,68 @@ +name: Release Build + +on: + push: + paths-ignore: + - "*.md" + - "compose.*" + branches: + - "main" + +env: + CARGO_TERM_COLOR: always + + CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: aarch64-linux-gnu-gcc + CC_aarch64_unknown_linux_musl: aarch64-linux-gnu-gcc + CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER: arm-linux-gnueabihf-gcc + CC_armv7_unknown_linux_musleabihf: arm-linux-gnueabihf-gcc + +jobs: + build: + name: Rust project - latest + runs-on: ubuntu-latest + strategy: + matrix: + target: + - x86_64-unknown-linux-musl + - aarch64-unknown-linux-musl + - armv7-unknown-linux-musleabihf + steps: + - uses: actions/checkout@v4 + + - uses: actions-rust-lang/setup-rust-toolchain@v1 + with: + target: ${{ matrix.target }} + + - if: matrix.target == 'x86_64-unknown-linux-musl' + run: | + sudo apt-get update + sudo apt-get install -y --no-install-recommends musl-tools + + - if: matrix.target == 'armv7-unknown-linux-musleabihf' + run: | + sudo apt update + sudo apt install -y gcc-arm-linux-gnueabihf musl-tools + + - if: matrix.target == 'aarch64-unknown-linux-musl' + run: | + sudo apt update + sudo apt install -y gcc-aarch64-linux-gnu musl-tools + + - name: Date + id: date + run: echo "DATE=$(date +%Y%m%d-%H%M)" >> "$GITHUB_OUTPUT" + + - name: Build + run: cargo build --release --target ${{ matrix.target }} + + - name: Package release + run: tar czf redlib-${{ matrix.target }}.tar.gz -C target/${{ matrix.target }}/release/ redlib + + - name: Upload release + uses: softprops/action-gh-release@v1 + with: + tag_name: ${{ steps.date.outputs.DATE }} + files: | + redlib-${{ matrix.target }}.tar.gz + + diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 492cddb9..e51dc4b6 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -1,23 +1,23 @@ name: Container build on: - push: - paths-ignore: - - "**.md" - branches: - - "main" + workflow_run: + workflows: ["Release Build"] + types: + - completed env: REGISTRY_IMAGE: ghcr.io/nohoster/redlib + jobs: build: runs-on: ubuntu-latest strategy: fail-fast: false matrix: - platform: - - linux/amd64 - - linux/arm64 - - linux/arm/v7 + include: + - { platform: linux/amd64, target: x86_64-unknown-linux-musl} + - { platform: linux/arm64, target: aarch64-unknown-linux-musl} + - { platform: linux/arm/v7, target: armv7-unknown-linux-musleabihf} steps: - name: Checkout @@ -54,6 +54,7 @@ jobs: labels: ${{ steps.meta.outputs.labels }} outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true file: Dockerfile + build-args: TARGET=${{ matrix.target }} - name: Export digest run: | diff --git a/Dockerfile b/Dockerfile index d0e7246e..034f5548 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,30 +1,12 @@ -#################################################################################################### -## Builder -#################################################################################################### - -FROM alpine:3.19 AS builder - -RUN apk add --no-cache cargo git g++ - -WORKDIR /redlib - -COPY . . - -RUN cargo build --config net.git-fetch-with-cli=true --release - -#################################################################################################### -## Final image -#################################################################################################### - FROM alpine:3.19 -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs +ARG TARGET + +RUN apk add --no-cache curl -# Copy our build -COPY --from=builder /redlib/target/release/redlib /usr/local/bin/redlib +RUN curl -L https://github.com/nohoster/redlib/releases/latest/download/redlib-${TARGET}.tar.gz | \ + tar xz -C /usr/local/bin/ -# Use an unprivileged user. RUN adduser --home /nonexistent --no-create-home --disabled-password redlib USER redlib From 5ff99e39e2fa6972c671287d0057c3c574dd93b3 Mon Sep 17 00:00:00 2001 From: nohoster Date: Sat, 24 Feb 2024 16:48:31 -0600 Subject: [PATCH 4/6] Change config to redlib-org account --- .github/workflows/build-artifacts.yaml | 8 ++++++- .github/workflows/main-docker.yml | 30 +++++++++++++------------- Dockerfile | 2 +- 3 files changed, 23 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build-artifacts.yaml b/.github/workflows/build-artifacts.yaml index 7b671a63..da7330be 100644 --- a/.github/workflows/build-artifacts.yaml +++ b/.github/workflows/build-artifacts.yaml @@ -47,11 +47,17 @@ jobs: run: | sudo apt update sudo apt install -y gcc-aarch64-linux-gnu musl-tools - + + # Using DATE-TIME for release name - name: Date id: date run: echo "DATE=$(date +%Y%m%d-%H%M)" >> "$GITHUB_OUTPUT" + # In case app version is prefered + # - name: Versions + # id: version + # run: echo "VERSION=$(cargo metadata --format-version 1 --no-deps | jq .packages[0].version -r | sed 's/^/v/')" >> "$GITHUB_OUTPUT" + - name: Build run: cargo build --release --target ${{ matrix.target }} diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index e51dc4b6..520269c7 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -6,7 +6,7 @@ on: types: - completed env: - REGISTRY_IMAGE: ghcr.io/nohoster/redlib + REGISTRY_IMAGE: quay.io/redlib/redlib jobs: build: @@ -21,11 +21,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Docker meta id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY_IMAGE }} tags: | @@ -33,21 +33,21 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} - name: Set up QEMU - uses: docker/setup-qemu-action@v2 + uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@v3 - name: Login to GitHub Container Registry - uses: docker/login-action@v2 + uses: docker/login-action@v3 with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_ROBOT_TOKEN }} - name: Build and push id: build - uses: docker/build-push-action@v4 + uses: docker/build-push-action@v5 with: context: . platforms: ${{ matrix.platform }} @@ -82,11 +82,11 @@ jobs: path: /tmp/digests - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@v3 - name: Docker meta id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY_IMAGE }} tags: | @@ -94,11 +94,11 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} - name: Login to GitHub Container Registry - uses: docker/login-action@v2 + uses: docker/login-action@v3 with: registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_ROBOT_TOKEN }} - name: Create manifest list and push working-directory: /tmp/digests diff --git a/Dockerfile b/Dockerfile index 034f5548..94125658 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG TARGET RUN apk add --no-cache curl -RUN curl -L https://github.com/nohoster/redlib/releases/latest/download/redlib-${TARGET}.tar.gz | \ +RUN curl -L https://github.com/redlib-org/redlib/releases/latest/download/redlib-${TARGET}.tar.gz | \ tar xz -C /usr/local/bin/ RUN adduser --home /nonexistent --no-create-home --disabled-password redlib From 8ee666e1883fa0b89e7e582a4fd08e9fd3f465c5 Mon Sep 17 00:00:00 2001 From: nohoster Date: Wed, 28 Feb 2024 17:45:21 -0600 Subject: [PATCH 5/6] Added README push to Quay.io --- .github/workflows/main-docker.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 520269c7..d807e669 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -105,6 +105,16 @@ jobs: run: | docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) + + - name: Oush README to Quay.io + uses: christian-korneck/update-container-description-action@v1 + env: + DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }} + with: + destination_container_repo: quay.io/redlib/redlib + provider: quay + readme_file: 'README.md' + - name: Inspect image run: | From ad7d81ac9ff71e0de2425b2bb54537a06a57419f Mon Sep 17 00:00:00 2001 From: nohoster Date: Sun, 3 Mar 2024 12:40:26 -0600 Subject: [PATCH 6/6] Fixes --- .github/workflows/build-artifacts.yaml | 21 +++++++++++---------- .github/workflows/main-docker.yml | 8 ++++---- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/.github/workflows/build-artifacts.yaml b/.github/workflows/build-artifacts.yaml index da7330be..57632efe 100644 --- a/.github/workflows/build-artifacts.yaml +++ b/.github/workflows/build-artifacts.yaml @@ -48,15 +48,9 @@ jobs: sudo apt update sudo apt install -y gcc-aarch64-linux-gnu musl-tools - # Using DATE-TIME for release name - - name: Date - id: date - run: echo "DATE=$(date +%Y%m%d-%H%M)" >> "$GITHUB_OUTPUT" - - # In case app version is prefered - # - name: Versions - # id: version - # run: echo "VERSION=$(cargo metadata --format-version 1 --no-deps | jq .packages[0].version -r | sed 's/^/v/')" >> "$GITHUB_OUTPUT" + - name: Versions + id: version + run: echo "VERSION=$(cargo metadata --format-version 1 --no-deps | jq .packages[0].version -r | sed 's/^/v/')" >> "$GITHUB_OUTPUT" - name: Build run: cargo build --release --target ${{ matrix.target }} @@ -66,9 +60,16 @@ jobs: - name: Upload release uses: softprops/action-gh-release@v1 + if: github.base_ref != 'main' && github.event_name == 'release' with: - tag_name: ${{ steps.date.outputs.DATE }} + tag_name: ${{ steps.version.outputs.VERSION }} + name: ${{ steps.version.outputs.VERSION }} - ${{ github.event.head_commit.message }} + draft: true files: | redlib-${{ matrix.target }}.tar.gz + body: | + - ${{ github.event.head_commit.message }} ${{ github.sha }} + generate_release_notes: true + diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index d807e669..9a10ac7f 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -38,7 +38,7 @@ jobs: name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - - name: Login to GitHub Container Registry + name: Login to Quay.io Container Registry uses: docker/login-action@v3 with: registry: quay.io @@ -93,10 +93,10 @@ jobs: type=sha type=raw,value=latest,enable={{is_default_branch}} - - name: Login to GitHub Container Registry + name: Login to Quay.io Container Registry uses: docker/login-action@v3 with: - registry: ghcr.io + registry: quay.io username: ${{ secrets.QUAY_USERNAME }} password: ${{ secrets.QUAY_ROBOT_TOKEN }} - @@ -106,7 +106,7 @@ jobs: docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) - - name: Oush README to Quay.io + - name: Push README to Quay.io uses: christian-korneck/update-container-description-action@v1 env: DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }}