New docker build strategy

.github/workflows/ci.yml

@@ -0,0 +1,158 @@
+---
+name: Build images and run tests and publish
+
+on:
+  pull_request:
+  push:
+      branches:
+          - main
+          - support/**
+      tags:
+          - "v*"
+  workflow_dispatch:  
+
+env:
+  BUILDKIT_PROGRESS: plain
+  FORCE_COLOR: 1
+
+# https://docs.github.com/en/actions/using-jobs/using-concurrency
+concurrency:
+    # only cancel in-progress jobs or runs for the current workflow - matches against branch & tags
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+
+  build:
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    outputs:
+      image: ${{ steps.bake_metadata.outputs.image }}
+
+    steps:
+      - name: Checkout Repo ⚡️
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        if: ${{ inputs.platforms != 'linux/amd64' }}
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry 🔑
+        uses: docker/login-action@v3
+        with:
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+
+      - uses: crazy-max/ghaction-github-runtime@v3
+      - name: Build and upload to ghcr.io 📤
+        id: build-upload
+        uses: docker/bake-action@v4
+        with:
+            push: true
+            # Using provenance to disable default attestation so it will build only desired images:
+            # https://github.com/orgs/community/discussions/45969
+            provenance: false
+            set: |
+                *.platform=linux/amd64
+                *.output=type=registry,name-canonical=true,push-by-digest=true
+                *.cache-from=type=gha
+                *.cache-to=type=gha,mode=max
+
+            files: |
+                docker-bake.hcl
+                build.json
+                .github/workflows/env.hcl
+
+      - name: Set output variables
+        id: bake_metadata
+        run: |
+            .github/workflows/extract-image-name.sh | tee -a "${GITHUB_OUTPUT}"
+        env:
+            BAKE_METADATA: ${{ steps.build-upload.outputs.metadata }}
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: build
+
+    steps:
+
+      - name: Checkout Repo ⚡️
+        uses: actions/checkout@v4
+
+      - name: Login to GitHub Container Registry 🔑
+        uses: docker/login-action@v3
+        with:
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run container checking libraries exist in the container
+        run: |
+          docker run --rm ${{ needs.build.outputs.image }} /bin/bash -c "which pw.x" >> /tmp/cat-output.txt
+          docker run --rm ${{ needs.build.outputs.image }} /bin/bash -c "which ph.x" >> /tmp/cat-output.txt
+          if cat /tmp/cat-output.txt | grep -q "/usr/local/bin/pw.x"; then
+            echo "pw.x found"
+          else
+            echo "pw.x not found"
+            exit 1
+          fi
+
+          if cat /tmp/cat-output.txt | grep -q "/usr/local/bin/ph.x"; then
+            echo "ph.x found"
+          else
+            echo "ph.x not found"
+            exit 1
+          fi
+
+  publish:
+      runs-on: ubuntu-latest
+      timeout-minutes: 30
+      needs: [build]
+      if: >-
+          github.repository == 'containers4hpc/quantum-espresso'
+          && (github.ref_type == 'tag' || github.ref_name == 'main')
+
+      steps:
+        - uses: actions/checkout@v4
+
+        - name: Login to GitHub Container Registry 🔑
+          uses: docker/login-action@v3
+          with:
+              registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+
+        - name: Read build variables
+          id: build_vars
+          run: |
+              vars=$(cat build.json | jq -c '[.variable | to_entries[] | {"key": .key, "value": .value.default}] | from_entries')
+              echo "vars=$vars" | tee -a "${GITHUB_OUTPUT}"
+
+        - name: Docker meta
+          id: meta
+          uses: docker/metadata-action@v5
+          env: ${{ fromJSON(steps.build_vars.outputs.vars) }}
+          with:
+              images: ghcr.io/${{ github.repository_owner }}/quantum-espresso
+              tags: |
+                  type=edge,enable={{is_default_branch}}
+                  type=raw,value={{tag}},enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }}
+                  type=raw,value=quantum-espresso-${{ env.QE_VERSION }},enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }}
+                  type=match,pattern=v(\d{4}\.\d{4}(-.+)?),group=1
+
+        - name: Push tags
+          uses: akhilerm/[email protected]
+          with:
+              src: ${{ needs.build.outputs.image }}
+              dst: ${{ steps.meta.outputs.tags }}

.github/workflows/env.hcl

@@ -0,0 +1,2 @@
+# env.hcl
+REGISTRY = "ghcr.io"

.github/workflows/extract-image-name.sh

@@ -0,0 +1,34 @@
+# Extract image names together with their sha256 digests
+# from the docker/bake-action metadata output.
+# These together uniquely identify newly built images.
+
+# The input to this script is a JSON string passed via BAKE_METADATA env variable
+# Here's example input (trimmed to relevant bits):
+# BAKE_METADATA: {
+#    "base": {
+#      "containerimage.descriptor": {
+#        "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+#        "digest": "sha256:8e57a52b924b67567314b8ed3c968859cad99ea13521e60bbef40457e16f391d",
+#        "size": 6170,
+#      },
+#      "containerimage.digest": "sha256:8e57a52b924b67567314b8ed3c968859cad99ea13521e60bbef40457e16f391d",
+#      "image.name": "ghcr.io/pspgen/quantum-espresso"
+#    }
+#  }
+#
+# Example output (real output is on one line):
+#
+# image="ghcr.io/pspgen/quantum-espresso@sha256:79a0f984b9e03b733304fda809ad3e8eec8416992ff334052d75da00cadb8f12"
+# }
+#
+# This json output is later turned to environment variables using fromJson() GHA builtin
+# (e.g. BUILD_MACHINE_IMAGE=ghcr.io/pspgen/quantum-espresso@sha256:8e57a52b...)
+# and these are in turn read in the docker-compose.<target>.yml files for tests.
+
+if [[ -z ${BAKE_METADATA-} ]];then
+    echo "ERROR: Environment variable BAKE_METADATA is not set!"
+    exit 1
+fi
+
+image=$(echo "${BAKE_METADATA}" | jq -c '. as $base | to_entries[] | [(.value."image.name"|split(",")[0]),(.value."containerimage.digest")]|join("@")' | tr -d '"')
+echo "image=$image"

.gitignore

@@ -0,0 +1 @@
+_build/*

Dockerfile

@@ -1,11 +1,27 @@
-FROM containers4hpc/base-mpich314:0.1.0
-
-# Install QE 7.0 (pw.x only for now)
-# FOR PRODUCTION: PUT ALL IN THE SAME LINE TO AVOID HAVING LAYERS WITH A LOT OF FILES!
-RUN wget -q https://gitlab.com/QEF/q-e/-/archive/qe-7.0/q-e-qe-7.0.tar.gz \
-    && tar xzf q-e-qe-7.0.tar.gz
-RUN cd q-e-qe-7.0 \
-    && ./configure \
-    && make -j4 pw \
-    && make install \
-    && cd .. && rm -fr q-e-qe-*
+FROM build-base-image
+
+WORKDIR /qe-build
+
+ARG QE_VERSION
+
+# Compile QE
+RUN wget -c -O qe.tar.gz https://gitlab.com/QEF/q-e/-/archive/qe-${QE_VERSION}/q-e-qe-${QE_VERSION}.tar.gz && \
+    mkdir -p qe && \
+    tar xf qe.tar.gz -C qe --strip-components=1 && \
+    cd qe && \
+    ./configure \ 
+      LDFLAGS=-static && \
+    make -j4 pw ph && \
+    make install
+
+
+# Move binaries to a small image to reduce the size
+FROM runtime-base-image
+
+#RUN apt-get update && apt-get install -y \
+#    libquadmath0 \
+#  && rm -rf /var/lib/apt/lists/* \
+#  && apt-get clean all
+
+COPY --from=0 /usr/local/bin/* /usr/local/bin/
+

README.md

@@ -3,6 +3,3 @@
 The Quantum ESPRESSO v7.0 (only pw.x supported at the moment) is compiled with MPICH 3.1.4 which support ABI interface.
 Based on [`container4hpc/base-mpich314:0.1.0`](https://hub.docker.com/repository/docker/container4hpc/base-mpich314)
 
-# version
-
-[0.1.0](https://hub.docker.com/repository/docker/containers4hpc/qe-mpich314)

build.json

@@ -0,0 +1,13 @@
+{
+    "variable": {
+        "BUILD_BASE_IMAGE": {
+            "default": "docker.io/containers4hpc/base-mpich314:0.1.0"
+        },
+        "RUNTIME_BASE_IMAGE": {
+            "default": "phusion/baseimage:focal-1.2.0"
+        },
+        "QE_VERSION": {
+            "default": "7.0"
+        }
+    }
+}