Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix dockerfile not working #647

Closed
wants to merge 4 commits into from
Closed

Fix dockerfile not working #647

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
85188e4
Create docker-image.yml
zsnmwy May 28, 2023
79eaf56
FIX: Docker Image
zsnmwy May 28, 2023
ff62ce8
Update Dockerfile
zsnmwy May 29, 2023
09f651a
chore: add xz for alpine
zsnmwy May 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions .github/workflows/docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
name: Docker Image CI

on:
push:
branches: [ "main" ]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe just on tags like v124? because we may put bad code to the main branch

Copy link
Author

@zsnmwy zsnmwy May 29, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you can.

But it's hard to debug if I do not have the repo permission.
I have no permission to push images to your GHCR instance.
Github action has strict permission.

I recommend you copy the action from my existing file.

It can auto-build images based on tag, branch, and pull requests.
And will auto-comment the result to PR if the action trigger comes from PR.

That tags will be like that.

The PR Comments

pull_request:
branches: [ "main" ]

permissions:
packages: write

jobs:

build:

runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@v3
-
name: Set up QEMU
uses: docker/setup-qemu-action@v2
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Docker Login
# You may pin to the exact commit or the version.
# uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
uses: docker/[email protected]
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i need to put my own token for the CI right?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You don't need to change it.
GitHub provides some contexts for each task.
See https://docs.github.com/en/actions/learn-github-actions/contexts

That will auto-login to your GHCR instance.

- name: Build and push
uses: docker/build-push-action@v4
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ghcr.io/${{ github.repository_owner }}/esmd:latest
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i prefer ghcr.io/owner/esm.sh instead of ghcr.io/owner/esmd, can you pls change?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I don't want to change it anymore.
It's hard for me to debug the code because of the action permission.
You can merge it first and change it.

32 changes: 23 additions & 9 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,28 @@
# syntax=docker/dockerfile:1
FROM golang:1.18 AS build

WORKDIR /app
COPY . .
RUN apt-get update -y && apt-get install -y xz-utils
RUN useradd -u 1000 -m esm
RUN mkdir /esm && chown esm:esm /esm
RUN git clone https://github.com/esm-dev/esm.sh /esm/esm.sh
RUN git checkout v124
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

again, let's use the latest tag instead of main branch

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/gocrane/crane/blob/9776243d8f37f2766fa7f39ffb4b2470de922857/.github/workflows/build-images.yml#L90C12-L95

Reading the version information from git is better than manual changes each time.

RUN go build -o /esmd

USER esm
WORKDIR /esm
RUN go build -o bin/esmd esm.sh/main.go
FROM node:18-alpine3.16
ENV USER_ID=65535
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just wondered, can we remove the USER_ID and GROUP_ID perm?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you want the script to run as root, you can.

You can pass the -u 0:0 params to docker.
That will be run as root.

That full command is: docker run --rm -it -p 8077:80 -u 0:0 ghcr.io/zsnmwy/esmd:latest.

That's a security question.
See https://docs.docker.com/engine/security/rootless/

ENV GROUP_ID=65535
ENV USER_NAME=esm
ENV GROUP_NAME=esm

RUN echo "{\"port\":80,\"workDir\":\"/esm\"}" >> /esm/config.json
ENTRYPOINT ["/esm/bin/esmd", "--config", "config.json"]
RUN apk add --no-cache libc6-compat xz
RUN addgroup -g $GROUP_ID $GROUP_NAME && \
adduser --shell /sbin/nologin --disabled-password \
--uid $USER_ID --ingroup $GROUP_NAME $USER_NAME
RUN mkdir -p /usr/local/lib && chown -R $USER_NAME:$GROUP_NAME /usr/local
Comment on lines +15 to +19
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wath is for?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code is prepared for non-root users.
Create a user and give the right permissions.

You must add the lib libc6-compat.
If not the server will crash.


USER $USER_NAME

WORKDIR /home/esm
COPY --from=build /esmd /home/esm/esmd

RUN echo "{\"port\":80,\"workDir\":\"/home/esm/workdir\"}" >> /home/esm/config.json

ENTRYPOINT ["/home/esm/esmd", "--config", "config.json"]