Container Image (#3)

* add docker build

* fix binary

* test sign

* test sign

* fix tag

* fix tag

* fix tag

* fix tag

* fix tag

* fix tag

* fix tag

* fix tag

* fix tag

* deactivate non-working image signing

.github/workflows/build.yaml

@@ -0,0 +1,69 @@
+name: Build Image
+
+on:
+  push:
+    branches:
+      - feat/container
+      - main
+      - dev
+    tags:        
+      - '*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            mtr.devops.telekom.de/caas/vcluster-backup
+            ghcr.io/eumel8/vcluster-backup/vcluster-backup
+          tags: |
+            type=ref,event=tag
+            type=ref,event=branch
+            type=ref,event=pr
+            type=raw,value=latest
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v2.2.0'
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to MTR
+        uses: docker/login-action@v3
+        with:
+          registry: mtr.devops.telekom.de
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        id: build-push
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            mtr.devops.telekom.de/caas/vcluster-backup:latest
+            ghcr.io/eumel8/vcluster-backup/vcluster-backup:latest
+            ${{ steps.meta.outputs.tags }}
+      - name: Sign Push
+        run: |
+          # doesn't work
+          #cosign sign --key env://COSIGN_KEY --tlog-upload=false ghcr.io/eumel8/vcluster-backup/vcluster-backup:dev
+          #cosign sign --yes --key env://COSIGN_KEY --tlog-upload=false ghcr.io/eumel8/vcluster-backup/vcluster-backup@${{ steps.build-push.outputs.digest }}
+          #cosign sign --yes --key env://COSIGN_KEY --tlog-upload=false mtr.devops.telekom.de/caas/vcluster-backup@${{ steps.build-push.outputs.digest }}
+        env:
+          COSIGN_KEY: ${{secrets.COSIGN_KEY}}
+          COSIGN_PASSWORD: ''

Dockerfile

@@ -0,0 +1,35 @@
+FROM golang:alpine AS builder
+
+RUN apk update && apk add --no-cache git
+
+WORKDIR /app
+
+COPY go.mod ./
+COPY go.sum ./
+RUN go mod download
+
+COPY *.go ./
+
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o vcluster-backup vcluster-backup.go
+
+RUN adduser \    
+    --disabled-password \    
+    --gecos "" \    
+    --home "/app" \    
+    --shell "/sbin/nologin" \    
+    --no-create-home \    
+    --uid 1000 \    
+    appuser
+
+FROM scratch
+LABEL org.opencontainers.image.authors="f.kloeker@telekom.de"
+LABEL version="1.0.0"
+LABEL description="Create backup K3s sqllite and push in S3"
+
+WORKDIR /app
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
+COPY --from=builder /app/vcluster-backup /app/vcluster-backup
+USER appuser
+CMD ["/app/vcluster-backup"]
+

cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEN2LUwvs7XT7CIwzOnlMgUuDadH5e
+TNtL7qt65tegWPilQeuc6umEUzaRzNAn9xI6RkjkydFQ3u5TRgyReaOLzw==
+-----END PUBLIC KEY-----