From 3f4526debee9a4c5fc932c2c5fbe4025667d789f Mon Sep 17 00:00:00 2001 From: nohoster <136514837+nohoster@users.noreply.github.com> Date: Mon, 4 Mar 2024 19:02:06 -0600 Subject: [PATCH] Container pipeline overhaul (#59) * Simplified docker image building * minor name fix * Optimize container pipeline * Change config to redlib-org account * Added README push to Quay.io * Fixes --- .github/workflows/build-artifacts.yaml | 75 ++++++++++++++ .github/workflows/main-docker.yml | 135 ++++++++++++++++++------- Dockerfile | 30 ++---- Dockerfile.arm | 45 --------- Dockerfile.armv7 | 43 -------- 5 files changed, 181 insertions(+), 147 deletions(-) create mode 100644 .github/workflows/build-artifacts.yaml delete mode 100644 Dockerfile.arm delete mode 100644 Dockerfile.armv7 diff --git a/.github/workflows/build-artifacts.yaml b/.github/workflows/build-artifacts.yaml new file mode 100644 index 0000000..57632ef --- /dev/null +++ b/.github/workflows/build-artifacts.yaml @@ -0,0 +1,75 @@ +name: Release Build + +on: + push: + paths-ignore: + - "*.md" + - "compose.*" + branches: + - "main" + +env: + CARGO_TERM_COLOR: always + + CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: aarch64-linux-gnu-gcc + CC_aarch64_unknown_linux_musl: aarch64-linux-gnu-gcc + CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER: arm-linux-gnueabihf-gcc + CC_armv7_unknown_linux_musleabihf: arm-linux-gnueabihf-gcc + +jobs: + build: + name: Rust project - latest + runs-on: ubuntu-latest + strategy: + matrix: + target: + - x86_64-unknown-linux-musl + - aarch64-unknown-linux-musl + - armv7-unknown-linux-musleabihf + steps: + - uses: actions/checkout@v4 + + - uses: actions-rust-lang/setup-rust-toolchain@v1 + with: + target: ${{ matrix.target }} + + - if: matrix.target == 'x86_64-unknown-linux-musl' + run: | + sudo apt-get update + sudo apt-get install -y --no-install-recommends musl-tools + + - if: matrix.target == 'armv7-unknown-linux-musleabihf' + run: | + sudo apt update + sudo apt install -y gcc-arm-linux-gnueabihf musl-tools + + - if: matrix.target == 'aarch64-unknown-linux-musl' + run: | + sudo apt update + sudo apt install -y gcc-aarch64-linux-gnu musl-tools + + - name: Versions + id: version + run: echo "VERSION=$(cargo metadata --format-version 1 --no-deps | jq .packages[0].version -r | sed 's/^/v/')" >> "$GITHUB_OUTPUT" + + - name: Build + run: cargo build --release --target ${{ matrix.target }} + + - name: Package release + run: tar czf redlib-${{ matrix.target }}.tar.gz -C target/${{ matrix.target }}/release/ redlib + + - name: Upload release + uses: softprops/action-gh-release@v1 + if: github.base_ref != 'main' && github.event_name == 'release' + with: + tag_name: ${{ steps.version.outputs.VERSION }} + name: ${{ steps.version.outputs.VERSION }} - ${{ github.event.head_commit.message }} + draft: true + files: | + redlib-${{ matrix.target }}.tar.gz + body: | + - ${{ github.event.head_commit.message }} ${{ github.sha }} + generate_release_notes: true + + + diff --git a/.github/workflows/main-docker.yml b/.github/workflows/main-docker.yml index 4104dc2..9a10ac7 100644 --- a/.github/workflows/main-docker.yml +++ b/.github/workflows/main-docker.yml @@ -1,44 +1,112 @@ -name: Docker Build +name: Container build on: - push: - paths-ignore: - - "**.md" - branches: - - 'main' + workflow_run: + workflows: ["Release Build"] + types: + - completed +env: + REGISTRY_IMAGE: quay.io/redlib/redlib jobs: - build-docker: + build: runs-on: ubuntu-latest strategy: + fail-fast: false matrix: - config: - - { platform: 'linux/amd64', tag: 'latest', dockerfile: 'Dockerfile' } - - { platform: 'linux/arm64', tag: 'latest-arm', dockerfile: 'Dockerfile.arm' } - - { platform: 'linux/arm/v7', tag: 'latest-armv7', dockerfile: 'Dockerfile.armv7' } + include: + - { platform: linux/amd64, target: x86_64-unknown-linux-musl} + - { platform: linux/arm64, target: aarch64-unknown-linux-musl} + - { platform: linux/arm/v7, target: armv7-unknown-linux-musleabihf} steps: - - name: Checkout sources - uses: actions/checkout@v3 - - - name: Set up QEMU - uses: docker/setup-qemu-action@v2 + - + name: Checkout + uses: actions/checkout@v4 + - + name: Docker meta + id: meta + uses: docker/metadata-action@v5 with: - platforms: all - - - name: Set up Docker Buildx - id: buildx - uses: docker/setup-buildx-action@v2 - with: - version: latest - - - name: Login to Quay.io + images: ${{ env.REGISTRY_IMAGE }} + tags: | + type=sha + type=raw,value=latest,enable={{is_default_branch}} + - + name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - + name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - + name: Login to Quay.io Container Registry uses: docker/login-action@v3 with: registry: quay.io username: ${{ secrets.QUAY_USERNAME }} password: ${{ secrets.QUAY_ROBOT_TOKEN }} + - + name: Build and push + id: build + uses: docker/build-push-action@v5 + with: + context: . + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true + file: Dockerfile + build-args: TARGET=${{ matrix.target }} + - + name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + - + name: Upload digest + uses: actions/upload-artifact@v3 + with: + name: digests + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + merge: + runs-on: ubuntu-latest + needs: + - build + steps: + - + name: Download digests + uses: actions/download-artifact@v3 + with: + name: digests + path: /tmp/digests + - + name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - + name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY_IMAGE }} + tags: | + type=sha + type=raw,value=latest,enable={{is_default_branch}} + - + name: Login to Quay.io Container Registry + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_ROBOT_TOKEN }} + - + name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) - - name: push README to Quay.io + - name: Push README to Quay.io uses: christian-korneck/update-container-description-action@v1 env: DOCKER_APIKEY: ${{ secrets.APIKEY__QUAY_IO }} @@ -47,13 +115,8 @@ jobs: provider: quay readme_file: 'README.md' - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: . - file: ./${{ matrix.config.dockerfile }} - platforms: ${{ matrix.config.platform }} - push: true - tags: quay.io/redlib/redlib:${{ matrix.config.tag }} - cache-from: type=gha - cache-to: type=gha,mode=max + - + name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} + diff --git a/Dockerfile b/Dockerfile index e1ee914..9412565 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,29 +1,12 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM rust:alpine AS builder +FROM alpine:3.19 -RUN apk add --no-cache musl-dev +ARG TARGET -WORKDIR /redlib +RUN apk add --no-cache curl -COPY . . +RUN curl -L https://github.com/redlib-org/redlib/releases/latest/download/redlib-${TARGET}.tar.gz | \ + tar xz -C /usr/local/bin/ -RUN cargo build --target x86_64-unknown-linux-musl --release - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /redlib/target/x86_64-unknown-linux-musl/release/redlib /usr/local/bin/redlib - -# Use an unprivileged user. RUN adduser --home /nonexistent --no-create-home --disabled-password redlib USER redlib @@ -33,4 +16,5 @@ EXPOSE 8080 # Run a healthcheck every minute to make sure redlib is functional HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 -CMD ["redlib"] \ No newline at end of file +CMD ["redlib"] + diff --git a/Dockerfile.arm b/Dockerfile.arm deleted file mode 100644 index fd10a63..0000000 --- a/Dockerfile.arm +++ /dev/null @@ -1,45 +0,0 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM rust:alpine AS builder - -RUN apk add --no-cache g++ git - -WORKDIR /usr/src/redlib - -# cache dependencies in their own layer -COPY Cargo.lock Cargo.toml . -RUN mkdir src && echo "fn main() {}" > src/main.rs && cargo install --config net.git-fetch-with-cli=true --path . && rm -rf ./src - -COPY . . - -# net.git-fetch-with-cli is specified in order to prevent a potential OOM kill -# in low memory environments. See: -# https://users.rust-lang.org/t/cargo-uses-too-much-memory-being-run-in-qemu/76531 -# This is tracked under issue #641. This also requires us to install git in the -# builder. -RUN cargo install --config net.git-fetch-with-cli=true --path . - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /usr/local/cargo/bin/redlib /usr/local/bin/redlib - -# Use an unprivileged user. -RUN adduser --home /nonexistent --no-create-home --disabled-password redlib -USER redlib - -# Tell Docker to expose port 8080 -EXPOSE 8080 - -# Run a healthcheck every minute to make sure redlib is functional -HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 - -CMD ["redlib"] diff --git a/Dockerfile.armv7 b/Dockerfile.armv7 deleted file mode 100644 index 782750e..0000000 --- a/Dockerfile.armv7 +++ /dev/null @@ -1,43 +0,0 @@ -#################################################################################################### -## Builder -#################################################################################################### -FROM --platform=$BUILDPLATFORM rust:slim AS builder - -ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER=arm-linux-gnueabihf-gcc -ENV CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc - -RUN apt-get update && apt-get -y install gcc-arm-linux-gnueabihf \ - binutils-arm-linux-gnueabihf \ - musl-tools - -RUN rustup target add armv7-unknown-linux-musleabihf - -WORKDIR /redlib - -COPY . . - -RUN cargo build --target armv7-unknown-linux-musleabihf --release - -#################################################################################################### -## Final image -#################################################################################################### -FROM alpine:latest - -# Import ca-certificates from builder -COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates -COPY --from=builder /etc/ssl/certs /etc/ssl/certs - -# Copy our build -COPY --from=builder /redlib/target/armv7-unknown-linux-musleabihf/release/redlib /usr/local/bin/redlib - -# Use an unprivileged user. -RUN adduser --home /nonexistent --no-create-home --disabled-password redlib -USER redlib - -# Tell Docker to expose port 8080 -EXPOSE 8080 - -# Run a healthcheck every minute to make sure redlib is functional -HEALTHCHECK --interval=1m --timeout=3s CMD wget --spider --q http://localhost:8080/settings || exit 1 - -CMD ["redlib"]