[deploy] Allow for arm64

.github/actions/combine-build/action.yml

@@ -54,9 +54,13 @@ runs:
         username: ${{ inputs.aws_access_key_id }}
         password: ${{ inputs.aws_secret_access_key }}
 
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
     - name: Build The Combine
       run: >
         deploy/scripts/build.py
+        --arch amd64 arm64
         --components ${{ inputs.build_component }}
         --tag ${{ env.IMAGE_TAG }}
         --repo ${{ inputs.image_registry }}${{ inputs.image_registry_alias}}

.github/workflows/backend.yml

@@ -142,6 +142,9 @@ jobs:
   docker_build:
     if: ${{ github.event.type }} == "PullRequest"
     runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        arch: ["amd64", "arm64"]
     steps:
       # See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
       # configuring harden-runner and identifying allowed endpoints.
@@ -156,10 +159,14 @@ jobs:
             *.symcb.com:80
             api.nuget.org:443
             archive.ubuntu.com:80
+            auth.docker.io:443
             dc.services.visualstudio.com:443
             deb.debian.org:80
             github.com:443
             mcr.microsoft.com:443
+            ports.ubuntu.com:80
+            production.cloudflare.docker.com:443
+            registry-1.docker.io:443
             security.ubuntu.com:80
             ts-crl.ws.symantec.com:80
       # For subfolders, currently a full checkout is required.
@@ -168,11 +175,9 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
       - name: Build backend
         run: |
-          deploy/scripts/build.py --components backend
-        shell: bash
-      - name: Image digest
-        run: |
-          docker image inspect combine_backend:latest -f '{{json .Id}}'
+          deploy/scripts/build.py --components backend --arch ${{ matrix.arch }}
         shell: bash

.github/workflows/database.yml

@@ -11,6 +11,9 @@ jobs:
   docker_build:
     if: ${{ github.event.type }} == "PullRequest"
     runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        arch: ["amd64", "arm64"]
     steps:
       # See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
       # configuring harden-runner and identifying allowed endpoints.
@@ -30,11 +33,9 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
       - name: Build database image
         run: |
-          deploy/scripts/build.py --components database
-        shell: bash
-      - name: Image digest
-        run: |
-          docker image inspect combine_database:latest -f '{{json .Id}}'
+          deploy/scripts/build.py --components database --arch ${{ matrix.arch }}
         shell: bash

.github/workflows/deploy_qa.yml

@@ -2,7 +2,7 @@ name: "Deploy Update to QA Server"
 
 on:
   push:
-    branches: [master]
+    branches: [arm, master]
 
 permissions:
   contents: read
@@ -42,6 +42,7 @@ jobs:
             files.pythonhosted.org:443
             github.com:443
             mcr.microsoft.com:443
+            ports.ubuntu.com:80
             production.cloudflare.docker.com:443
             public.ecr.aws:443
             pypi.org:443

.github/workflows/deploy_release.yml

@@ -40,6 +40,7 @@ jobs:
             github.com:443
             mcr.microsoft.com:443
             production.cloudflare.docker.com:443
+            ports.ubuntu.com:80
             public.ecr.aws:443
             pypi.org:443
             registry-1.docker.io:443

.github/workflows/frontend.yml

@@ -111,6 +111,9 @@ jobs:
   docker_build:
     if: ${{ github.event.type }} == "PullRequest"
     runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        arch: ["amd64", "arm64"]
     steps:
       # See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
       # configuring harden-runner and identifying allowed endpoints.
@@ -123,6 +126,7 @@ jobs:
             auth.docker.io:443
             files.pythonhosted.org:443
             github.com:443
+            ports.ubuntu.com:80
             production.cloudflare.docker.com:443
             pypi.org:443
             registry-1.docker.io:443
@@ -131,11 +135,9 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
       - name: Build frontend
         run: |
-          deploy/scripts/build.py --components frontend
-        shell: bash
-      - name: Image digest
-        run: |
-          docker image inspect combine_frontend:latest -f '{{json .Id}}'
+          deploy/scripts/build.py --components frontend --arch ${{ matrix.arch }}
         shell: bash

.github/workflows/maintenance.yml

@@ -11,6 +11,9 @@ jobs:
   docker_build:
     if: ${{ github.event.type }} == "PullRequest"
     runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        arch: ["amd64", "arm64"]
     steps:
       # See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
       # configuring harden-runner and identifying allowed endpoints.
@@ -25,6 +28,7 @@ jobs:
             auth.docker.io:443
             files.pythonhosted.org:443
             github.com:443
+            ports.ubuntu.com:80
             production.cloudflare.docker.com:443
             public.ecr.aws:443
             pypi.org:443
@@ -36,11 +40,9 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
       - name: Build maintenance image
         run: |
-          deploy/scripts/build.py --components maintenance
-        shell: bash
-      - name: Image digest
-        run: |
-          docker image inspect combine_maint:latest -f '{{json .Id}}'
+          deploy/scripts/build.py --components maintenance --arch ${{ matrix.arch }}
         shell: bash

Backend/Dockerfile

@@ -7,7 +7,7 @@
 ############################################################
 
 # Docker multi-stage build
-FROM mcr.microsoft.com/dotnet/sdk:8.0.404-jammy AS builder
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0.404-jammy AS builder
 WORKDIR /app
 
 # Copy csproj and restore (fetch dependencies) as distinct layers.
@@ -33,8 +33,7 @@ ENV APP_FILES=${HOME}/.CombineFiles
 
 # Install system dependencies.
 RUN apt-get update \
-  && apt-get install -y \
-  ffmpeg \
+  && apt-get install -y ffmpeg \
   && rm -rf /var/lib/apt/lists/*
 
 # Create the home directory for the new app user.
@@ -47,7 +46,7 @@ RUN usermod  --uid 999 --gid app \
   --comment "Docker image user" \
   app
 
-## Set up application install directory.
+# Set up application install directory.
 RUN mkdir $APP_HOME && \
   mkdir $APP_FILES && \
   # Give access to the entire home folder so the backend can create files and folders there.

deploy/Dockerfile

@@ -3,6 +3,7 @@
 #
 # Supported Platforms:
 #   - Intel/AMD 64-bit
+#   - ARM 64-bit
 ############################################################
 
 FROM ubuntu:22.04
@@ -16,7 +17,8 @@ RUN apt-get update && \
   rm -rf /var/lib/apt/lists/*
 
 # Install kubectl and helm
-RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && \
+RUN MACH=$(case $(uname -m) in *86*) echo amd64;; *aarch*) echo arm64;; *arm*) echo arm64;; esac) && \
+  curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${MACH}/kubectl" && \
   install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl && \
   curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 && \
   chmod 700 get_helm.sh && \

deploy/scripts/build.py

@@ -206,6 +206,13 @@ def parse_args() -> Namespace:
         description="Build containerd container images for project.",
         formatter_class=RawFormatter,
     )
+    parser.add_argument(
+        "--arch",
+        choices=["amd64", "arm64"],
+        default=[],
+        help="Target cpu architecture(s).",
+        nargs="*",
+    )
     parser.add_argument(
         "--build-args", nargs="*", help="Build arguments to pass to the docker build."
     )
@@ -270,10 +277,12 @@ def main() -> None:
             if args.debug:
                 container_cmd.extend(["-D", "-l", "debug"])
             build_cmd = container_cmd + ["buildx", "build"]
-            push_cmd = container_cmd + ["push"]
+            build_cmd.append("--load" if args.repo is None else "--push")
         case _:
             logging.critical(f"Container CLI '{container_cmd[0]}' is not supported.")
             sys.exit(1)
+    if len(args.arch):
+        build_cmd.extend(["--platform", ",".join([f"linux/{arch}" for arch in args.arch])])
 
     # Setup build options
     if args.quiet:
@@ -306,7 +315,7 @@ def main() -> None:
         job_set[component] = JobQueue(component, debug=args.debug)
         logging.debug(f"Adding job {build_cmd + job_opts}")
         job_set[component].add_job(Job(build_cmd + job_opts, spec.dir))
-        if args.repo is not None:
+        if args.repo is not None and container_cmd[0] == "nerdctl":
             logging.debug(f"Adding job {push_cmd + [image_name]}")
             job_set[component].add_job(Job(push_cmd + [image_name], None))
         logging.info(f"Building component {component}")

deploy/scripts/install-combine.sh

@@ -78,11 +78,16 @@ install-kubernetes () {
   # Setup Kubernetes environment and WiFi Access Point
   cd ${DEPLOY_DIR}/ansible
 
+  # Set -e/--extra-vars for ansible-playbook
+  EXTRA_VARS="-e k8s_user=${whoami}"
   if [ -d "${DEPLOY_DIR}/airgap-images" ] ; then
-    ansible-playbook playbook_desktop_setup.yml -K -e k8s_user=`whoami` -e install_airgap_images=true $(((DEBUG == 1)) && echo "-vv")
-  else
-    ansible-playbook playbook_desktop_setup.yml -K -e k8s_user=`whoami` $(((DEBUG == 1)) && echo "-vv")
+    EXTRA_VARS="${EXTRA_VARS} -e install_airgap_images=true"
+  fi
+  if [ $ARM == 1 ] ; then
+    EXTRA_VARS="${EXTRA_VARS} -e cpu_arch=arm64"
   fi
+
+  ansible-playbook playbook_desktop_setup.yml -K ${EXTRA_VARS} $(((DEBUG == 1)) && echo "-vv")
 }
 
 # Set the KUBECONFIG environment variable so that the cluster can
@@ -138,7 +143,13 @@ install-the-combine () {
   cd ${DEPLOY_DIR}/scripts
   set-combine-env
   set-k3s-env
-  ./setup_combine.py --tag ${COMBINE_VERSION} --repo public.ecr.aws/thecombine --target desktop ${SETUP_OPTS} $(((DEBUG == 1)) && echo "--debug")
+  ./setup_combine.py \
+    $(((DEBUG == 1)) && echo "--debug") \
+    --repo public.ecr.aws/thecombine \
+    $(((ARM == 1)) && echo "--set global.cpuArch=arm64" ) \
+    --tag ${COMBINE_VERSION} \
+    --target desktop \
+    ${SETUP_OPTS}
   deactivate
 }
 
@@ -193,6 +204,7 @@ CONFIG_DIR=${HOME}/.config/combine
 mkdir -p ${CONFIG_DIR}
 SINGLE_STEP=0
 IS_SERVER=0
+ARM=0
 DEBUG=0
 
 # See if we need to continue from a previous install
@@ -207,6 +219,9 @@ fi
 while (( "$#" )) ; do
   OPT=$1
   case $OPT in
+    arm)
+      ARM=1
+      ;;
     clean)
       next-state "Pre-reqs"
       if [ -f ${CONFIG_DIR}/env ] ; then