Revisit our docker build strategy for CI #404
Assignees
Labels
task
Tasks break a project down into discrete steps
Comments
ian-noaa
added a commit
that referenced
this issue
Aug 5, 2024
We were updating the python tooling (`setuptools` & friends) in the builder layer but forgot to update them in the prod layer. This resulted in a `setuptools` vulnerability blocking CI. This PR: - updates `setuptools` & friends in the correct locations in the docker image - removes the docker build caching in CI as it wasn't doing anything. (I made #404 to address this) - Updates the security scanning step in CI to add more actionable output.
|
@JeffHamiltonNOAA noted that we should make sure that we keep |
|
The |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I disabled the build cache in CI in support of #402. However, upon disabling, I discovered that the build cache wasn't doing anything as the container build time remained ~30 minutes.
The purpose of the build cache was to ensure the eccodes layer was only rebuilt when we changed the eccodes version as it's expensive to rebuild. As it wasn't doing that, we should look into building an eccodes in its own image so that we can copy the binaries out and control the update frequency or build and package eccodes for multiple architectures. (ARM & AMD64)
The text was updated successfully, but these errors were encountered: