Forces binary production from Ubuntu:20.04

.github/workflows/publish-binary.yml

@@ -8,7 +8,7 @@ on:
         description: tag (ex. v0.8.3) to retrieve commit diff from
         required: true
       to:
-        description: tag (ex. v0.9.0) to generate release note and srtool runtimes from
+        description: tag (ex. v0.9.0) to generate release note and binaries from
         required: true
 
 jobs:
@@ -29,31 +29,42 @@ jobs:
     strategy:
       matrix:
         cpu: ["", "skylake", "znver3"]
-    env:
-      RUSTFLAGS: "-C target-cpu=${{ matrix.cpu }}"
     steps:
       - name: Checkout
         uses: actions/checkout@v3
-        with:
-          ref: ${{ github.event.inputs.to }}
-      - name: Setup Rust toolchain
-        run: rustup show
-      - name: Build Node
-        run: cargo build --profile=production --all
+      - name: Build production moonbeam
+        run: |
+          # Build moonbeam
+          # (we don't use volumes because of ownership/permissions issues)
+          docker build \
+            --tag prod \
+            --build-arg="COMMIT=${{ github.event.inputs.to }}" \
+            --build-arg="RUSTFLAGS=-C target-cpu=${{ matrix.cpu }}" \
+            - < docker/moonbeam-production.Dockerfile
+
+          # Copy moonbeam binary 
+          docker rm -f dummy 2> /dev/null | true
+          docker create -ti --name dummy prod bash
+          docker cp dummy:/moonbeam/moonbeam moonbeam
+          docker rm -f dummy
+
+          # Cleanup
+          docker rmi prod
+
       - name: Save parachain binary
         if: ${{ matrix.cpu == '' }}
         run: |
           mkdir -p build
-          cp target/production/moonbeam build/moonbeam
+          cp moonbeam build/moonbeam
       - name: Save parachain custom binary
         if: ${{ matrix.cpu != '' }}
         run: |
           mkdir -p build
-          cp target/production/moonbeam build/moonbeam-${{matrix.cpu}}
+          cp moonbeam build/moonbeam-${{matrix.cpu}}
       - name: Upload binary
         uses: actions/upload-artifact@v3.1.2
         with:
-          name: moonbeam
+          name: binaries
           path: build
 
   ####### Prepare the release draft #######
@@ -72,7 +83,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/download-artifact@v3.0.2
         with:
-          name: moonbeam
+          name: binaries
           path: build
       - name: Use Node.js 18.x
         uses: actions/setup-node@v3
@@ -101,30 +112,38 @@ jobs:
           release_name: Moonbeam ${{ github.event.inputs.to }}
           body_path: body.md
           draft: true
-      - name: Upload moonbeam
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  ####### Upload Binaries #######
+
+  upload-binaries:
+    runs-on: ubuntu-latest
+    needs: ["build-binary", "publish-draft-release"]
+    strategy:
+      matrix:
+        cpu: ["", "skylake", "znver3"]
+        node: ["moonbeam"]
+    steps:
+      - uses: actions/download-artifact@v3.0.2
         with:
-          upload_url: ${{ steps.create-release.outputs.upload_url }}
-          asset_path: build/moonbeam
-          asset_name: moonbeam
-          asset_content_type: application/octet-stream
-      - name: Upload moonbeam skylake
+          name: binaries
+          path: build
+      - name: Upload moonbeam
         uses: actions/upload-release-asset@v1
+        if: ${{ matrix.cpu == '' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ steps.create-release.outputs.upload_url }}
-          asset_path: build/moonbeam-skylake
-          asset_name: moonbeam-skylake
+          upload_url: ${{ needs.publish-draft-release.outputs.asset_upload_url }}
+          asset_path: build/${{matrix.node}}
+          asset_name: ${{matrix.node}}
           asset_content_type: application/octet-stream
-      - name: Upload moonbeam znver3
+      - name: Upload moonbeam custom binary
         uses: actions/upload-release-asset@v1
+        if: ${{ matrix.cpu != '' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ steps.create-release.outputs.upload_url }}
-          asset_path: build/moonbeam-znver3
-          asset_name: moonbeam-znver3
-          asset_content_type: application/octet-stream
+          upload_url: ${{ needs.publish-draft-release.outputs.asset_upload_url }}
+          asset_path: build/${{matrix.node}}-${{matrix.cpu}}
+          asset_name: ${{matrix.node}}-${{matrix.cpu}}
+          asset_content_type: application/octet-stream

docker/moonbeam-production.Dockerfile

@@ -0,0 +1,60 @@
+# Node for Moonbase Alphanet.
+#
+# Requires to run from repository root and to copy the binary in the build folder (part of the release workflow)
+
+FROM docker.io/library/ubuntu:20.04 AS builder
+
+# Branch or tag to build moonbeam from
+ARG COMMIT="master"
+ARG RUSTFLAGS=""
+ENV RUSTFLAGS=$RUSTFLAGS
+WORKDIR /
+
+RUN echo "*** Installing Basic dependencies ***"
+RUN apt-get update && apt-get install -y ca-certificates && update-ca-certificates
+RUN apt install --assume-yes git clang curl libssl-dev llvm libudev-dev make protobuf-compiler
+
+RUN set -e
+
+RUN echo "*** Installing Rust environment ***"
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+ENV PATH="/root/.cargo/bin:$PATH"
+RUN rustup default stable
+# rustup version are pinned in the rust-toolchain file
+
+RUN echo "*** Cloning Moonbeam ***"
+RUN git clone --depth=1 --branch $COMMIT https://github.com/purestake/moonbeam.git
+
+WORKDIR /moonbeam/moonbeam
+
+RUN echo "*** Building Moonbeam ***"
+RUN cargo build --profile=production --all
+
+FROM debian:bookworm-slim
+LABEL maintainer "alan@purestake.com"
+LABEL description="Binary for Moonbeam Nodes"
+
+RUN useradd -m -u 1000 -U -s /bin/sh -d /moonbeam moonbeam && \
+	mkdir -p /moonbeam/.local/share && \
+	mkdir /data && \
+	chown -R moonbeam:moonbeam /data && \
+	ln -s /data /moonbeam/.local/share/moonbeam && \
+	rm -rf /usr/sbin
+
+USER moonbeam
+
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder --chown=moonbeam /moonbeam/target/production/moonbeam /moonbeam/moonbeam
+
+RUN chmod uog+x /moonbeam/moonbeam
+
+# 30333 for parachain p2p
+# 30334 for relaychain p2p
+# 9933 for RPC call
+# 9944 for Websocket
+# 9615 for Prometheus (metrics)
+EXPOSE 30333 30334 9933 9944 9615
+
+VOLUME ["/data"]
+
+ENTRYPOINT ["/moonbeam/moonbeam"]