build(docker): Build an image for sentry CI #1658

asottile-sentry · 2022-12-01T17:49:10Z

we're moving sentry's CI from depending on both gcr.io and ghcr.io to only ghcr.io

#skip-changelog

asottile-sentry · 2022-12-01T17:50:02Z

Dockerfile

-ARG DOCKER_ARCH=amd64
-


I deleted all the ARCH stuff here to make the dockerfile easier to build -- it now depend on the --platform argument to docker build instead of specifying the architecture as an --arg

.github/workflows/image.yml

@olksdr

@olksdr or I will take a closer look and re-approve afterwards.

olksdr

This looks good.
@asottile-sentry could you, please, merge master back and resolve the conflicts, so we could give another look and finally merge it in.

jan-auer · 2023-02-08T09:58:07Z

scripts/docker-build-linux.sh

@@ -15,11 +15,11 @@ BUILD_IMAGE="us.gcr.io/sentryio/relay:deps"



We should change the BUILD_IMAGE:

Use the GHCR or DockerHub instead of GCR

Use caches, but also build that image as part of this script

jan-auer · 2023-02-08T09:59:46Z

Makefile

@@ -30,6 +30,17 @@ build-linux-release: setup-git ## build linux release of the relay
 	objcopy --add-gnu-debuglink target/${TARGET}/release/relay{.debug,}
 .PHONY: build-linux-release

+collect-source-bundle: setup-git ## copy the built relay binary to current folder and collects debug bundles


Let's move this to a script. This allows us to:

Call this more naturally from other scripts

Use it in gocd deployments

Publish it to GH releases

jan-auer · 2023-02-08T10:12:38Z

.github/workflows/ci.yml

+      - name: ghcr.io login
+        run: docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io
+
+      - name: build-deps


Idea: These steps could be moved to a script that we can also use locally to:

Build / update the builder image

Build the binary to a local folder (should we introduce a build/ directory?)

Create the release docker container w/ the binary inside

In a close follow-up, we can then replace docker-build-linux.sh in the build_binary workflow with our new script.

jan-auer · 2023-02-08T15:28:09Z

After merging, we need to

Disable the GCB repository trigger
Update required status checks in this repo
Update freight checks by removing cloudbuild and adding required jobs:

"checks": [
  {
    "type": "github-apps",
    "config": {
      "repo": "getsentry/relay",
      "contexts": [
        "Integration Tests",
        "Test (macos-latest)",
        "Test (windows-latest)",
        "Test All Features (ubuntu-latest)",
        "Push GCR Docker Image"
      ]
    }
  }
]

jan-auer · 2023-02-08T15:46:59Z

scripts/build-docker-image.sh

+# Set the correct build target and update the arch if required.
+if [[ "$ARCH" = "amd64" ]]; then
+  BUILD_TARGET="x86_64-unknown-linux-gnu"
+elif [[ "$ARCH" = "arm64" ]]; then
+  BUILD_TARGET="aarch64-unknown-linux-gnu"
+elif [[ "$ARCH" = "aarch64" ]]; then
+  BUILD_TARGET="aarch64-unknown-linux-gnu"
+  ARCH="arm64"
+fi


Let's add an else branch that errors if no supported architecture is set, for instance:

Suggested change

# Set the correct build target and update the arch if required.

if [[ "$ARCH" = "amd64" ]]; then

BUILD_TARGET="x86_64-unknown-linux-gnu"

elif [[ "$ARCH" = "arm64" ]]; then

BUILD_TARGET="aarch64-unknown-linux-gnu"

elif [[ "$ARCH" = "aarch64" ]]; then

BUILD_TARGET="aarch64-unknown-linux-gnu"

ARCH="arm64"

fi

if [[ "$ARCH" == "aarch64 ]]; then

ARCH="arm64"

fi

if [[ "$ARCH" = "amd64" ]]; then

BUILD_TARGET="x86_64-unknown-linux-gnu"

elif [[ "$ARCH" = "arm64" ]]; then

BUILD_TARGET="aarch64-unknown-linux-gnu"

else

echo "ERROR Unsupported architecture"

exit 1

fi

@jan-auer changed to switch this one

asottile-sentry · 2023-02-08T15:53:50Z

.github/workflows/ci.yml

+      IMG_DEPS: ghcr.io/getsentry/relay-deps:${{ matrix.arch }}
+      # GITHUB_SHA in pull requests points to the merge commit
+      IMG_VERSIONED: ghcr.io/getsentry/relay:${{ github.event.pull_request.head.sha || github.sha }}
+      ARCH: ${{ matrix.arch }}


at a glance this looks unused, but it's actually used inside build-docker-image -- I would probably make it an argument to the script instead

asottile-sentry · 2023-02-08T15:54:27Z

.github/workflows/ci.yml

+      - name: Push to ghcr.io
+        run: |
+          set -euxo pipefail
+          docker login --username '${{ github.actor }}' --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io


this will fail for external contributors -- you'll probably want to gate this somehow on that

asottile-sentry · 2023-02-08T15:56:40Z

Dockerfile.builder

+    llvm-toolset-7.0-clang-devel \
+    && yum clean all \
+    && rm -rf /var/cache/yum \
+    && ln -s /usr/bin/cmake3 /usr/bin/cmake


typically /usr/bin is managed by the package manager, this should be a symlink to /usr/local/bin/cmake probably

asottile-sentry · 2023-02-08T15:57:53Z

Dockerfile.release

+ENV \
+    RELAY_UID=10001 \
+    RELAY_GID=10001
+
+# Create a new user and group with fixed uid/gid
+RUN groupadd --system relay --gid $RELAY_GID \
+    && useradd --system --gid relay --uid $RELAY_UID relay
+
+RUN mkdir /work /etc/relay \
+    && chown relay:relay /work /etc/relay


not necessary for this PR, but this is much easier to do with USER (and then not needing gosu at all)

asottile-sentry · 2023-02-08T15:59:12Z

scripts/build-docker-image.sh

+IMG_VERSIONED=${IMG_VERSIONED:-"relay:latest"}
+
+# Build a builder image with all the depdendencies.
+args=(--progress auto)


shouldn't be necessary?

it fails locally for me, when the args is empty

./scripts/build-docker-image.sh: line 32: args[@]: unbound variable

ah, ancient macos bash -- you might be able to use declare -a args

or put the real args into the array

asottile-sentry · 2023-02-08T16:00:18Z

scripts/build-docker-image.sh

+
+# Build the binary inside of the builder image.
+docker run \
+    -v "$(pwd):/work" \


$(pwd) => $PWD (var lookup is free compared to a subshell and subprocess)

I also like to be explicit and use --volume and state whether it's :ro or :rw (I don't even remember the default)

asottile-sentry · 2023-02-08T16:00:58Z

scripts/build-docker-image.sh

+# Fix permissions for shared directories
+USER_ID=$(id -u)
+GROUP_ID=$(id -g)
+sudo chown -R "${USER_ID}:${GROUP_ID}" target/


better: run the container with --user and then you don't need to do this. or utilize docker cp

… into asottile-relay-multiarch

asottile-sentry commented Dec 1, 2022

View reviewed changes

asottile-sentry changed the title ~~ref: build a multiarch relay image for sentry CI~~ ref: build a elay image for sentry CI Dec 1, 2022

asottile-sentry changed the title ~~ref: build a elay image for sentry CI~~ ref: build a relay image for sentry CI Dec 1, 2022

mattgauntseo-sentry reviewed Dec 1, 2022

View reviewed changes

.github/workflows/image.yml Outdated Show resolved Hide resolved

mattgauntseo-sentry reviewed Dec 1, 2022

View reviewed changes

.github/workflows/image.yml Outdated Show resolved Hide resolved

mattgauntseo-sentry approved these changes Dec 1, 2022

View reviewed changes

asottile-sentry marked this pull request as ready for review December 1, 2022 19:16

asottile-sentry requested a review from a team December 1, 2022 19:16

asottile-sentry added 2 commits December 2, 2022 11:44

ref: build a multiarch relay image for sentry CI

7d31856

skip arm64 for now, too slow

d14c031

asottile-sentry force-pushed the asottile-relay-multiarch branch from 60c6fc9 to d14c031 Compare December 2, 2022 16:44

iker-barriocanal previously approved these changes Dec 13, 2022

View reviewed changes

olksdr reviewed Jan 23, 2023

View reviewed changes

TBS1996 assigned asottile-sentry Jan 25, 2023

olksdr and others added 3 commits January 27, 2023 13:46

Merge branch 'master' into asottile-relay-multiarch

b980cc4

Replace cloudbuild with GH action

d268c73

move image into CI for using smart deps

1bc5a93

olksdr assigned olksdr and unassigned asottile-sentry Jan 30, 2023

use proper SHA

b83a70d

olksdr requested review from jan-auer and a team January 30, 2023 13:47

olksdr added 7 commits January 30, 2023 15:08

minor formatting

964f3fa

Add proper name to the build job

8f67143

Add relay-deps stage build

f5ff783

Test in docker build

5a72506

fix typo

1c7302a

small tweaks

57129d8

copy correct bin

46b1857

olksdr added 9 commits February 7, 2023 15:35

Add permissions to the job

537681a

Enable build and docker auth for gcr

9e73305

Add separate job for google registry

7801133

Add runs-on to the job

29e514d

Add a proper name to the job

c45a1a9

Merge branch 'master' into asottile-relay-multiarch

1e46294

Try to push image to gcr

8f07bb3

changet he condition in the check

407ccee

Remove checkout on image push job

90d3421

jan-auer reviewed Feb 8, 2023

View reviewed changes

ci(gha): Skip redundant checkouts

b58f526

jan-auer force-pushed the asottile-relay-multiarch branch from 69c8220 to b58f526 Compare February 8, 2023 11:07

olksdr and others added 4 commits February 8, 2023 16:09

review refactor

16acef9

Merge branch 'master' into asottile-relay-multiarch

5cf6cfb

set proper image base

21a8745

fix relay deps name

9b61897

ci

8a6d573

jan-auer approved these changes Feb 8, 2023

View reviewed changes

asottile-sentry commented Feb 8, 2023

View reviewed changes

olksdr and others added 7 commits February 9, 2023 08:29

Switch to case and use --user for docker run

b222a8b

Add chown back

5c6f9ce

fix(ci): Bring back git checkout for self-hosted

491d0cc

review comments

e419537

Merge branch 'asottile-relay-multiarch' of github.com:getsentry/relay…

e2baaf6

… into asottile-relay-multiarch

Add user for build container

91f8027

Merge branch 'master' into asottile-relay-multiarch

3c65807

jan-auer merged commit 13cc9e5 into master Feb 10, 2023

jan-auer deleted the asottile-relay-multiarch branch February 10, 2023 09:29

olksdr mentioned this pull request Mar 16, 2023

ci: switch to using GitHub artefacts instead of ghcr for PR testing #1918

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(docker): Build an image for sentry CI #1658

build(docker): Build an image for sentry CI #1658

asottile-sentry commented Dec 1, 2022 •

edited

Loading

asottile-sentry Dec 1, 2022

olksdr left a comment

jan-auer Feb 8, 2023

jan-auer Feb 8, 2023

jan-auer Feb 8, 2023

jan-auer commented Feb 8, 2023 •

edited

Loading

jan-auer Feb 8, 2023

olksdr Feb 9, 2023

asottile-sentry Feb 8, 2023

asottile-sentry Feb 8, 2023

asottile-sentry Feb 8, 2023

asottile-sentry Feb 8, 2023

asottile-sentry Feb 8, 2023

olksdr Feb 9, 2023

asottile-sentry Feb 9, 2023

asottile-sentry Feb 9, 2023

asottile-sentry Feb 8, 2023

asottile-sentry Feb 8, 2023

		@@ -15,11 +15,11 @@ BUILD_IMAGE="us.gcr.io/sentryio/relay:deps"

		ARG DOCKER_ARCH=amd64

build(docker): Build an image for sentry CI #1658

build(docker): Build an image for sentry CI #1658

Conversation

asottile-sentry commented Dec 1, 2022 • edited Loading

Choose a reason for hiding this comment

olksdr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jan-auer commented Feb 8, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

asottile-sentry commented Dec 1, 2022 •

edited

Loading

jan-auer commented Feb 8, 2023 •

edited

Loading