Skip to content

Commit ec4df7b

Browse files
rpardinirpardini
committed
GitHub Actions: multiarch build, new -debug version, much lighter layers
1 parent 6b4a26e commit ec4df7b

File tree

5 files changed

+231
-12
lines changed

5 files changed

+231
-12
lines changed

‎.dockerignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,5 @@ LICENSE
66
README.md
77
docker_mirror_cache
88
docker_mirror_certs
9+
.github
10+
Makefile

‎.github/workflows/master-latest.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: master-latest
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
7+
jobs:
8+
multiarch-to-dockerhub-latest:
9+
runs-on: ubuntu-latest
10+
steps:
11+
12+
- name: Checkout
13+
uses: actions/checkout@v2
14+
15+
# Setup qEMU for arm64
16+
- name: Set up QEMU
17+
uses: docker/setup-qemu-action@v1
18+
with:
19+
platforms: arm64
20+
21+
# We use buildx instead of regular build so we can take advantage of Docker layer cache via GithubActions's cache
22+
# Also buildx offers multi-arch builds
23+
- name: Set up Docker Buildx
24+
id: buildx
25+
uses: docker/setup-buildx-action@v1
26+
27+
# Setup the Github Actions cache.
28+
- name: Cache Docker layers
29+
uses: actions/cache@v2
30+
with:
31+
path: /tmp/.buildx-cache
32+
key: ${{ runner.os }}-buildxarch-${{ github.sha }}
33+
restore-keys: |
34+
${{ runner.os }}-buildxarch-
35+
36+
- name: Login to DockerHub
37+
uses: docker/login-action@v1
38+
with:
39+
username: ${{ secrets.DOCKER_HUB_USERNAME }}
40+
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
41+
42+
# the arm64 is of course much slower due to qemu, so build and push amd64 **first**
43+
# due to the way manifests work, the gap between this and the complete push below
44+
# could result in pull failures or inconsistencies for arm64, such is life.
45+
# further duplicated by building both release and debug builds
46+
- name: Build and push amd64 Release Docker Image to DockerHub
47+
uses: docker/build-push-action@v2
48+
with:
49+
build-args: DEBUG_BUILD=0,BASE_IMAGE_SUFFIX=""
50+
builder: ${{ steps.buildx.outputs.name }}
51+
context: .
52+
file: ./Dockerfile
53+
platforms: linux/amd64
54+
tags: rpardini/docker-registry-proxy:latest
55+
push: true
56+
cache-from: type=local,src=/tmp/.buildx-cache/release
57+
# first run does not export the cache
58+
59+
- name: Build and push amd64 Debug Docker Image to DockerHub
60+
uses: docker/build-push-action@v2
61+
with:
62+
build-args: DEBUG_BUILD=1,BASE_IMAGE_SUFFIX="-debug"
63+
builder: ${{ steps.buildx.outputs.name }}
64+
context: .
65+
file: ./Dockerfile
66+
platforms: linux/amd64
67+
tags: rpardini/docker-registry-proxy:latest-debug
68+
push: true
69+
cache-from: type=local,src=/tmp/.buildx-cache/debug
70+
# first run does not export the cache
71+
72+
# Do it all again with both archs. the amd64 will be a huge cache hit
73+
# this will update the manifest have both arches
74+
- name: Build and push multiarch Release Docker Image to DockerHub
75+
uses: docker/build-push-action@v2
76+
with:
77+
build-args: DEBUG_BUILD=0,BASE_IMAGE_SUFFIX=""
78+
builder: ${{ steps.buildx.outputs.name }}
79+
context: .
80+
file: ./Dockerfile
81+
platforms: linux/arm64,linux/amd64
82+
tags: rpardini/docker-registry-proxy:latest
83+
push: true
84+
cache-from: type=local,src=/tmp/.buildx-cache/release
85+
cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/release
86+
87+
- name: Build and push multiarch Debug Docker Image to DockerHub
88+
uses: docker/build-push-action@v2
89+
with:
90+
build-args: DEBUG_BUILD=1,BASE_IMAGE_SUFFIX="-debug"
91+
builder: ${{ steps.buildx.outputs.name }}
92+
context: .
93+
file: ./Dockerfile
94+
platforms: linux/arm64,linux/amd64
95+
tags: rpardini/docker-registry-proxy:latest-debug
96+
push: true
97+
cache-from: type=local,src=/tmp/.buildx-cache/debug
98+
cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/debug
99+

‎.github/workflows/tags.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: tags
2+
3+
on:
4+
push:
5+
tags:
6+
- '*'
7+
8+
jobs:
9+
multiarch-to-dockerhub-tag:
10+
runs-on: ubuntu-latest
11+
steps:
12+
13+
- name: Checkout
14+
uses: actions/checkout@v2
15+
16+
# Parse the ref to get the clean tag name.
17+
- id: get_version
18+
uses: battila7/get-version-action@v2
19+
- run: echo Current tag ${{ steps.get_version.outputs.version }}
20+
21+
# Setup qEMU for arm64
22+
- name: Set up QEMU
23+
uses: docker/setup-qemu-action@v1
24+
with:
25+
platforms: arm64
26+
27+
# We use buildx instead of regular build so we can take advantage of Docker layer cache via GithubActions's cache
28+
# Also buildx offers multi-arch builds
29+
- name: Set up Docker Buildx
30+
id: buildx
31+
uses: docker/setup-buildx-action@v1
32+
33+
# Setup the Github Actions cache.
34+
- name: Cache Docker layers
35+
uses: actions/cache@v2
36+
with:
37+
path: /tmp/.buildx-cache
38+
key: ${{ runner.os }}-buildxarch-${{ github.sha }}
39+
restore-keys: |
40+
${{ runner.os }}-buildxarch-
41+
42+
- name: Login to DockerHub
43+
uses: docker/login-action@v1
44+
with:
45+
username: ${{ secrets.DOCKER_HUB_USERNAME }}
46+
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
47+
48+
# the arm64 is of course much slower due to qemu, so build and push amd64 **first**
49+
# due to the way manifests work, the gap between this and the complete push below
50+
# could result in pull failures or inconsistencies for arm64, such is life.
51+
# further duplicated by building both release and debug builds
52+
- name: Build and push amd64 Release Docker Image to DockerHub
53+
uses: docker/build-push-action@v2
54+
with:
55+
build-args: DEBUG_BUILD=0,BASE_IMAGE_SUFFIX=""
56+
builder: ${{ steps.buildx.outputs.name }}
57+
context: .
58+
file: ./Dockerfile
59+
platforms: linux/amd64
60+
tags: rpardini/docker-registry-proxy:${{ steps.get_version.outputs.version }}
61+
push: true
62+
cache-from: type=local,src=/tmp/.buildx-cache/release
63+
# first run does not export the cache
64+
65+
- name: Build and push amd64 Debug Docker Image to DockerHub
66+
uses: docker/build-push-action@v2
67+
with:
68+
build-args: DEBUG_BUILD=1,BASE_IMAGE_SUFFIX="-debug"
69+
builder: ${{ steps.buildx.outputs.name }}
70+
context: .
71+
file: ./Dockerfile
72+
platforms: linux/amd64
73+
tags: rpardini/docker-registry-proxy:${{ steps.get_version.outputs.version }}-debug
74+
push: true
75+
cache-from: type=local,src=/tmp/.buildx-cache/debug
76+
# first run does not export the cache
77+
78+
# Do it all again with both archs. the amd64 will be a huge cache hit
79+
# this will update the manifest have both arches
80+
- name: Build and push multiarch Release Docker Image to DockerHub
81+
uses: docker/build-push-action@v2
82+
with:
83+
build-args: DEBUG_BUILD=0,BASE_IMAGE_SUFFIX=""
84+
builder: ${{ steps.buildx.outputs.name }}
85+
context: .
86+
file: ./Dockerfile
87+
platforms: linux/arm64,linux/amd64
88+
tags: rpardini/docker-registry-proxy:${{ steps.get_version.outputs.version }}
89+
push: true
90+
cache-from: type=local,src=/tmp/.buildx-cache/release
91+
cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/release
92+
93+
- name: Build and push multiarch Debug Docker Image to DockerHub
94+
uses: docker/build-push-action@v2
95+
with:
96+
build-args: DEBUG_BUILD=1,BASE_IMAGE_SUFFIX="-debug"
97+
builder: ${{ steps.buildx.outputs.name }}
98+
context: .
99+
file: ./Dockerfile
100+
platforms: linux/arm64,linux/amd64
101+
tags: rpardini/docker-registry-proxy:${{ steps.get_version.outputs.version }}-debug
102+
push: true
103+
cache-from: type=local,src=/tmp/.buildx-cache/debug
104+
cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/debug
105+

‎Dockerfile‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,25 @@
11
# We start from my nginx fork which includes the proxy-connect module from tEngine
22
# Source is available at https://github.com/rpardini/nginx-proxy-connect-stable-alpine
3-
# This is not multiarch yet.
4-
ARG BASE_IMAGE="rpardini/nginx-proxy-connect-stable-alpine:nginx-1.18.0-alpine-3.12"
5-
FROM ${BASE_IMAGE}
3+
# This is already multi-arch!
4+
ARG BASE_IMAGE="rpardini/nginx-proxy-connect-stable-alpine:nginx-1.18.0-alpine-3.12.0"
5+
# Could be "-debug"
6+
ARG BASE_IMAGE_SUFFIX=""
7+
FROM ${BASE_IMAGE}${BASE_IMAGE_SUFFIX}
8+
9+
# apk packages that will be present in the final image both debug and release
10+
RUN apk add --no-cache --update bash ca-certificates-bundle coreutils openssl
611

712
# If set to 1, enables building mitmproxy, which helps a lot in debugging, but is super heavy to build.
813
ARG DEBUG_BUILD="1"
914
ENV DO_DEBUG_BUILD="$DEBUG_BUILD"
1015

11-
# Add openssl, bash and ca-certificates, then clean apk cache -- yeah complain all you want.
12-
# Also added deps for mitmproxy.
16+
# Build mitmproxy via pip. This is heavy, takes minutes do build and creates a 90mb+ layer. Oh well.
1317
RUN [[ "a$DO_DEBUG_BUILD" == "a1" ]] && { echo "Debug build ENABLED." \
14-
&& apk add --update openssl bash ca-certificates su-exec coreutils git g++ libffi libffi-dev libstdc++ openssl openssl-dev python3 python3-dev py3-pip py3-wheel \
18+
&& apk add --no-cache --update su-exec git g++ libffi libffi-dev libstdc++ openssl-dev python3 python3-dev py3-pip py3-wheel \
1519
&& LDFLAGS=-L/lib pip install mitmproxy==4.0.4 \
16-
&& apk del --purge git g++ libffi-dev openssl-dev python3-dev \
17-
&& rm -rf /var/cache/apk/* \
20+
&& apk del --purge git g++ libffi-dev openssl-dev python3-dev py3-pip py3-wheel \
1821
&& rm -rf ~/.cache/pip \
19-
; } || { echo "Debug build disabled." && apk add --update bash ca-certificates coreutils openssl && rm -rf /var/cache/apk/*; }
22+
; } || { echo "Debug build disabled." ; }
2023

2124
# Required for mitmproxy
2225
ENV LANG=en_US.UTF-8

‎entrypoint.sh‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ if [[ "a${VERIFY_SSL}" == "atrue" ]]; then
6868
cat << EOD > /etc/nginx/docker.verify.ssl.conf
6969
# We actually wanna be secure and avoid mitm attacks.
7070
# Fitting, since this whole thing is a mitm...
71-
# We'll accept any cert signed by a CA trusted by Mozilla (ca-certificates in alpine)
71+
# We'll accept any cert signed by a CA trusted by Mozilla (ca-certificates-bundle in alpine)
7272
proxy_ssl_verify on;
7373
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
7474
proxy_ssl_verify_depth 2;
@@ -88,9 +88,14 @@ CACHE_MAX_SIZE=${CACHE_MAX_SIZE:-32g}
8888
echo "proxy_cache_path /docker_mirror_cache levels=1:2 max_size=$CACHE_MAX_SIZE inactive=60d keys_zone=cache:10m use_temp_path=off;" > /etc/nginx/conf.d/cache_max_size.conf
8989

9090
# normally use non-debug version of nginx
91-
NGINX_BIN="nginx"
91+
NGINX_BIN="/usr/sbin/nginx"
9292

9393
if [[ "a${DEBUG}" == "atrue" ]]; then
94+
if [[ ! -f /usr/bin/mitmweb ]]; then
95+
echo "To debug, you need the -debug version of this image, eg: :latest-debug"
96+
exit 3
97+
fi
98+
9499
# in debug mode, change caching layer to listen on 444, so that mitmproxy can sit in the middle.
95100
echo " listen 444 ssl default_server;" > /etc/nginx/caching.layer.listen
96101

@@ -105,10 +110,15 @@ if [[ "a${DEBUG}" == "atrue" ]]; then
105110
fi
106111

107112
if [[ "a${DEBUG_NGINX}" == "atrue" ]]; then
113+
if [[ ! -f /usr/sbin/nginx-debug ]]; then
114+
echo "To debug, you need the -debug version of this image, eg: :latest-debug"
115+
exit 4
116+
fi
117+
108118
echo "Starting in DEBUG MODE (nginx)."
109119
echo "error_log /var/log/nginx/error.log debug;" > /etc/nginx/error.log.debug.warn
110120
# use debug binary
111-
NGINX_BIN="nginx-debug"
121+
NGINX_BIN="/usr/sbin/nginx-debug"
112122
fi
113123

114124
echo "Testing nginx config..."

0 commit comments

Comments
 (0)