Skip to content

Make the images available in ghcr.io #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
+163 −273
Open

Make the images available in ghcr.io #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9ab1160
Remove XCP-ng 7 support
glehmann Aug 1, 2025
783ce1a
Don't include the uid/gid of the host user in the image
glehmann Jul 24, 2025
76873f2
Use ghcr.io to store the images
glehmann Jul 24, 2025
e21ff80
DNF update, install and clean in the same layer
glehmann Jul 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 83 additions & 0 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,83 @@
name: Build and Push Docker Image to GHCR

on: push

permissions:
contents: read # Required to checkout the repo code
packages: write # Required to push packages to GHCR

jobs:
xcp-ng-build-env-82:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: docker/setup-buildx-action@v3
with:
driver: docker-container
- uses: docker/login-action@v3
if: github.ref == 'refs/heads/master'
with:
registry: ghcr.io
username: ${{ github.actor }} # Uses the GitHub user/org name that triggered the workflow
password: ${{ secrets.GITHUB_TOKEN }} # Automatically provided by GitHub
- uses: docker/build-push-action@v5 # Using v5 for latest features
with:
context: .
file: ./Dockerfile-8.x
push: ${{ github.ref == 'refs/heads/master' }}
tags: ghcr.io/${{ github.repository }}:8.2
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We likely want those official floating tags to be set only when run on master, maybe we set particular tags for PRs?
Also, timestamped tags as is common may be interesting to have.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is only configured on master.
Other tags may be useful, as well as building for PRs, but we must consider cleaning up the old images.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is only configured on master.

Actually it seems to be configured for main instead :)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, there would be a reason for allowing it to run not just on master: detecting pipeline errors before they reach master

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, that would be nice. Maybe push to the registry when on the master branch then.

cache-from: type=gha,scope=${{ github.ref_name }}-82 # Cache layers to speed up builds
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-82 # Store layers in cache for future builds
build-args: |
XCP_NG_BRANCH=8.2
platforms: |
linux/amd64

xcp-ng-build-env-83:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: docker/setup-buildx-action@v3
with:
driver: docker-container
- uses: docker/login-action@v3
if: github.ref == 'refs/heads/master'
with:
registry: ghcr.io
username: ${{ github.actor }} # Uses the GitHub user/org name that triggered the workflow
password: ${{ secrets.GITHUB_TOKEN }} # Automatically provided by GitHub
- uses: docker/build-push-action@v5 # Using v5 for latest features
with:
context: .
file: ./Dockerfile-8.x
push: ${{ github.ref == 'refs/heads/master' }}
tags: ghcr.io/${{ github.repository }}:8.3
cache-from: type=gha,scope=${{ github.ref_name }}-83 # Cache layers to speed up builds
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-83 # Store layers in cache for future builds
platforms: |
linux/amd64

# TODO: uncomment once we have a public xcp-ng 9.0 repository
# xcp-ng-build-env-90:
# runs-on: ubuntu-latest
# steps:
# - uses: actions/checkout@v4
# - uses: docker/setup-buildx-action@v3
# with:
# driver: docker-container
# - uses: docker/login-action@v3
# if: github.ref == 'refs/heads/master'
# with:
# registry: ghcr.io
# username: ${{ github.actor }} # Uses the GitHub user/org name that triggered the workflow
# password: ${{ secrets.GITHUB_TOKEN }} # Automatically provided by GitHub
# - uses: docker/build-push-action@v5 # Using v5 for latest features
# with:
# context: .
# file: ./Dockerfile-9.x
# platforms: |
# linux/amd64/v2
Comment on lines +78 to +79
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Explicit platform for 8.x likely does not hurt, if only for documentation purposes

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but for 8.x, the arch is linux/amd64

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

indeed, fixed!

# push: ${{ github.ref == 'refs/heads/master' }}
# tags: ghcr.io/${{ github.repository }}:9.0
# cache-from: type=gha,scope=${{ github.ref_name }}-90 # Cache layers to speed up builds
# cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-90 # Store layers in cache for future builds
78 changes: 0 additions & 78 deletions Dockerfile-7.x
View file
Open in desktop

This file was deleted.

65 changes: 26 additions & 39 deletions Dockerfile-8.x
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,38 +2,32 @@ ARG CENTOS_VERSION=7.5.1804

FROM centos:${CENTOS_VERSION}

ARG CUSTOM_BUILDER_UID=""
ARG CUSTOM_BUILDER_GID=""

# Remove all repositories
RUN rm /etc/yum.repos.d/*

# Add only the specific CentOS 7.5 repositories, because that's what XS used for the majority of packages
ARG CENTOS_VERSION
COPY files/CentOS-Vault.repo.in /etc/yum.repos.d/CentOS-Vault-7.5.repo
RUN sed -e "s/@CENTOS_VERSION@/${CENTOS_VERSION}/g" -i /etc/yum.repos.d/CentOS-Vault-7.5.repo
RUN sed -i -e "s/@CENTOS_VERSION@/${CENTOS_VERSION}/g" /etc/yum.repos.d/CentOS-Vault-7.5.repo

# Add our repositories
# Repository file depends on the target version of XCP-ng, and is pre-processed by build.sh
ARG XCP_NG_BRANCH=8.3
COPY files/xcp-ng.repo.8.x.in /etc/yum.repos.d/xcp-ng.repo
RUN sed -e "s/@XCP_NG_BRANCH@/${XCP_NG_BRANCH}/g" -i /etc/yum.repos.d/xcp-ng.repo
RUN sed -i -e "s/@XCP_NG_BRANCH@/${XCP_NG_BRANCH}/g" /etc/yum.repos.d/xcp-ng.repo

# Install GPG key
RUN curl -sSf https://xcp-ng.org/RPM-GPG-KEY-xcpng -o /etc/pki/rpm-gpg/RPM-GPG-KEY-xcpng

# Fix invalid rpmdb checksum error with overlayfs, see https://github.com/docker/docker/issues/10180
# (still needed?)
RUN yum install -y yum-plugin-ovl

# Use priorities so that packages from our repositories are preferred over those from CentOS repositories
RUN yum install -y yum-plugin-priorities

# Update
RUN yum update -y

# Common build requirements
RUN yum install -y \
RUN yum update -y \
# Fix invalid rpmdb checksum error with overlayfs, see https://github.com/docker/docker/issues/10180
# (still needed?)
&& yum install -y yum-plugin-ovl \
# Use priorities so that packages from our repositories are preferred over those from CentOS repositories
&& yum install -y yum-plugin-priorities \
# Common build requirements
&& yum install -y \
gcc \
gcc-c++ \
git \
Expand All @@ -44,37 +38,30 @@ RUN yum install -y \
sudo \
yum-utils \
epel-release \
epel-rpm-macros

# Niceties
RUN yum install -y \
epel-rpm-macros \
# Niceties
&& yum install -y \
vim \
wget \
which

# clean package cache to avoid download errors
RUN yum clean all
which \
# clean package cache to avoid download errors
&& yum clean all

# OCaml in XS may be older than in CentOS
RUN sed -i "/gpgkey/a exclude=ocaml*" /etc/yum.repos.d/Cent* /etc/yum.repos.d/epel*

# Set up the builder user
RUN bash -c ' \
OPTS=(); \
if [ -n "${CUSTOM_BUILDER_UID}" ]; then \
OPTS+=("-u" "${CUSTOM_BUILDER_UID}"); \
fi; \
if [ -n "${CUSTOM_BUILDER_GID}" ]; then \
OPTS+=("-g" "${CUSTOM_BUILDER_GID}"); \
if ! getent group "${CUSTOM_BUILDER_GID}" >/dev/null; then \
groupadd -g "${CUSTOM_BUILDER_GID}" builder; \
fi; \
fi; \
useradd "${OPTS[@]}" builder; \
' \
# create the builder user
RUN groupadd -g 1000 builder \
&& useradd -u 1000 -g 1000 builder \
&& echo "builder:builder" | chpasswd \
&& echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers

RUN mkdir -p /usr/local/bin
RUN curl -fsSL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" -o /usr/local/bin/gosu \
&& chmod +x /usr/local/bin/gosu
COPY files/init-container.sh /usr/local/bin/init-container.sh
COPY files/rpmmacros /home/builder/.rpmmacros
COPY files/entrypoint.sh /usr/local/bin/entrypoint.sh
COPY --chown=builder:builder files/rpmmacros /home/builder/.rpmmacros

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["bash"]
66 changes: 26 additions & 40 deletions Dockerfile-9.x
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,5 @@
FROM ghcr.io/almalinux/10-base:10.0

ARG CUSTOM_BUILDER_UID=""
ARG CUSTOM_BUILDER_GID=""

# Add our repositories
# temporary bootstrap repository
COPY files/xcp-ng-8.99.repo /etc/yum.repos.d/xcp-ng.repo
Expand All @@ -13,10 +10,9 @@ COPY files/Alma10-devel.repo /etc/yum.repos.d/
RUN curl -sSf https://xcp-ng.org/RPM-GPG-KEY-xcpng -o /etc/pki/rpm-gpg/RPM-GPG-KEY-xcpng

# Update
RUN dnf update -y

# Common build requirements
RUN dnf install -y \
RUN dnf update -y \
# Common build requirements
&& dnf install -y \
gcc \
gcc-c++ \
git \
Expand All @@ -26,54 +22,44 @@ RUN dnf install -y \
python3-rpm \
sudo \
dnf-plugins-core \
epel-release

# EPEL: needs epel-release installed first
RUN dnf install -y \
epel-release \
# EPEL: needs epel-release installed first
&& dnf install -y \
epel-rpm-macros \
almalinux-git-utils

# Niceties
RUN dnf install -y \
almalinux-git-utils \
# Niceties
&& dnf install -y \
bash-completion \
vim \
wget \
which

# clean package cache to avoid download errors
RUN yum clean all

# -release*, to be commented out to boostrap the build-env until it gets built
# FIXME: isn't it already pulled as almalinux-release when available?
RUN dnf install -y \
which \
# -release*, to be commented out to boostrap the build-env until it gets built
# FIXME: isn't it already pulled as almalinux-release when available?
&& dnf install -y \
xcp-ng-release \
xcp-ng-release-presets
xcp-ng-release-presets \
# clean package cache to avoid download errors
&& yum clean all

# enable repositories commonly required to build
RUN dnf config-manager --enable crb

# workaround sudo not working (e.g. in podman 4.9.3 in Ubuntu 24.04)
RUN chmod 0400 /etc/shadow

# Set up the builder user
RUN bash -c ' \
OPTS=(); \
if [ -n "${CUSTOM_BUILDER_UID}" ]; then \
OPTS+=("-u" "${CUSTOM_BUILDER_UID}"); \
fi; \
if [ -n "${CUSTOM_BUILDER_GID}" ]; then \
OPTS+=("-g" "${CUSTOM_BUILDER_GID}"); \
if ! getent group "${CUSTOM_BUILDER_GID}" >/dev/null; then \
groupadd -g "${CUSTOM_BUILDER_GID}" builder; \
fi; \
fi; \
useradd "${OPTS[@]}" builder; \
' \
# create the builder user
RUN groupadd -g 1000 builder \
&& useradd -u 1000 -g 1000 builder \
&& echo "builder:builder" | chpasswd \
&& echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers

RUN mkdir -p /usr/local/bin
RUN curl -fsSL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" -o /usr/local/bin/gosu \
&& chmod +x /usr/local/bin/gosu
COPY files/init-container.sh /usr/local/bin/init-container.sh

COPY files/entrypoint.sh /usr/local/bin/entrypoint.sh
# FIXME: check it we really need any of this
# COPY files/rpmmacros /home/builder/.rpmmacros
# COPY --chown=builder:builder files/rpmmacros /home/builder/.rpmmacros

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["bash"]
Comment on lines +64 to +65
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This actually seems to overlap with init-container.sh. IIUC, CMD ["bash"] provides a default that allows to avoid init-container.sh altogether (when not using run.py).
Wouldn't we rather want to refactor (as a preliminary step before this commit) init-container.sh into an entrypoint and a local_build.sh which would be the default CMD? Suggesting this here as I'm under the impression it would make that refactor easier to read that way, and this commit would just need to extend the entrypoint.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've used CMD ["bash"] to keep the possibility to run a container without run and open a shell without specifying it on the command line.
I also thought to refactor init-container.sh in the entry point, but that may not be trivial, because the entrypoint changes to the builder user when launching the command.
I thought it would be an interesting subject for another PR :-)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's often done to override CMD on commandline (and we can even override the entrypoint on CLI as well), and I thought that having the local-build command behaviour as default makes it easier to select the alernative choice (else launching the builder would require knowing its in-image path/name.

Copy link

@ydirson ydirson Jul 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because the entrypoint changes to the builder user when launching the command.

Yes there are things in init-container needing root perms, but it looks like the script is run as builder, they use sudo already.

Loading