CI/Dockerfile: mirror microwaveprop pattern (static docker, retry login, amd64 buildx, BUILD_TIMESTAMP arg)
This commit is contained in:
parent
40ad28e97b
commit
4b54b88b9f
2 changed files with 107 additions and 17 deletions
|
|
@ -1,4 +1,4 @@
|
|||
name: Build and Deploy
|
||||
name: Build and Push
|
||||
|
||||
on:
|
||||
push:
|
||||
|
|
@ -22,9 +22,55 @@ jobs:
|
|||
- name: Checkout code
|
||||
uses: https://github.com/actions/checkout@v4
|
||||
|
||||
- name: Install Docker CLI
|
||||
- name: Install Docker CLI and buildx
|
||||
run: |
|
||||
apt-get update && apt-get install -y docker.io
|
||||
# Dodge apt entirely — the runner image's bookworm repos have been
|
||||
# failing GPG verification with "At least one invalid signature".
|
||||
# The static Docker client binary talks to the host's daemon socket
|
||||
# that act_runner mounts into the job container. buildx is needed
|
||||
# separately because the Dockerfile uses `--mount=type=cache`,
|
||||
# which is a BuildKit-only feature.
|
||||
curl -fsSL -o /tmp/docker.tgz \
|
||||
https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
|
||||
tar xzf /tmp/docker.tgz -C /tmp
|
||||
install -m 0755 /tmp/docker/docker /usr/local/bin/docker
|
||||
rm -rf /tmp/docker /tmp/docker.tgz
|
||||
|
||||
mkdir -p /usr/libexec/docker/cli-plugins
|
||||
curl -fsSL -o /usr/libexec/docker/cli-plugins/docker-buildx \
|
||||
https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
|
||||
chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
|
||||
|
||||
docker --version
|
||||
docker buildx version
|
||||
|
||||
- name: Wait for Docker daemon
|
||||
run: |
|
||||
# act_runner mounts the host docker socket into the job, but
|
||||
# the daemon side sometimes takes a moment to answer. Poll
|
||||
# `docker info` until it responds so the login/build steps
|
||||
# below don't race the socket and fail with "unable to
|
||||
# connect to docker".
|
||||
sock="${DOCKER_HOST:-unix:///var/run/docker.sock}"
|
||||
echo "Using DOCKER_HOST=${sock}"
|
||||
|
||||
for i in $(seq 1 30); do
|
||||
if docker info >/dev/null 2>&1; then
|
||||
echo "Docker daemon reachable after ${i}s"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for Docker daemon... ($i/30)"
|
||||
sleep 1
|
||||
done
|
||||
|
||||
echo "Docker daemon never became reachable — diagnostics:" >&2
|
||||
echo "--- ls -l /var/run/docker.sock ---" >&2
|
||||
ls -l /var/run/docker.sock 2>&1 || true
|
||||
echo "--- env | grep -i docker ---" >&2
|
||||
env | grep -i docker 2>&1 || true
|
||||
echo "--- docker info (verbose) ---" >&2
|
||||
docker info 2>&1 || true
|
||||
exit 1
|
||||
|
||||
- name: Generate image tag
|
||||
id: tag
|
||||
|
|
@ -35,19 +81,54 @@ jobs:
|
|||
echo "tag=${TAG}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Log in to container registry
|
||||
run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: https://github.com/docker/setup-buildx-action@v3
|
||||
run: |
|
||||
# Exponential backoff (2s, 4s, 8s) around docker login to
|
||||
# ride out transient registry blips without failing the
|
||||
# whole workflow.
|
||||
attempt=1
|
||||
max_attempts=3
|
||||
while : ; do
|
||||
if echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
||||
docker login "${{ secrets.REGISTRY_URL }}" \
|
||||
-u "${{ secrets.REGISTRY_USER }}" \
|
||||
--password-stdin; then
|
||||
exit 0
|
||||
fi
|
||||
if [ "$attempt" -ge "$max_attempts" ]; then
|
||||
echo "docker login failed after $attempt attempts" >&2
|
||||
exit 1
|
||||
fi
|
||||
delay=$((2 ** attempt))
|
||||
echo "docker login attempt $attempt failed; retrying in ${delay}s"
|
||||
sleep "$delay"
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: https://github.com/docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
platforms: linux/amd64
|
||||
provenance: false
|
||||
sbom: false
|
||||
tags: |
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main
|
||||
run: |
|
||||
IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
|
||||
TAG="${{ steps.tag.outputs.tag }}"
|
||||
BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
|
||||
|
||||
attempt=1
|
||||
max_attempts=3
|
||||
while : ; do
|
||||
if docker buildx build \
|
||||
--platform linux/amd64 \
|
||||
--provenance=false \
|
||||
--sbom=false \
|
||||
--build-arg BUILD_TIMESTAMP="${BUILD_TIMESTAMP}" \
|
||||
-t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" \
|
||||
--push \
|
||||
.; then
|
||||
exit 0
|
||||
fi
|
||||
if [ "$attempt" -ge "$max_attempts" ]; then
|
||||
echo "docker buildx build failed after $attempt attempts" >&2
|
||||
exit 1
|
||||
fi
|
||||
delay=$((2 ** attempt))
|
||||
echo "docker buildx build attempt $attempt failed; retrying in ${delay}s"
|
||||
sleep "$delay"
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
# syntax=docker/dockerfile:1.6
|
||||
# Build arguments
|
||||
ARG ELIXIR_VERSION=1.19.5
|
||||
ARG OTP_VERSION=28.3
|
||||
|
|
@ -44,6 +45,11 @@ RUN mix release
|
|||
# Runtime stage
|
||||
FROM ${RUNNER_IMAGE}
|
||||
|
||||
# Build timestamp baked in by CI (--build-arg BUILD_TIMESTAMP=...).
|
||||
# Only consumed in this final stage, so it never busts the earlier
|
||||
# compile cache.
|
||||
ARG BUILD_TIMESTAMP=unknown
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
RUN apt-get update -y && \
|
||||
apt-get install -y --no-install-recommends \
|
||||
|
|
@ -61,5 +67,8 @@ RUN chown -R elixir:root /app
|
|||
|
||||
COPY --from=builder --chown=elixir:root /app/_build/prod/rel/aprsme ./
|
||||
|
||||
RUN echo "${BUILD_TIMESTAMP}" > /app/BUILD_TIMESTAMP \
|
||||
&& chown elixir:root /app/BUILD_TIMESTAMP
|
||||
|
||||
USER elixir
|
||||
CMD ["/app/bin/server"]
|
||||
Loading…
Add table
Reference in a new issue