chore(Dockerfile): Refactor dockerfile to Debian Slim with no deps #613

alfrunes · 2024-05-27T09:24:53Z

No description provided.

mender-test-bot · 2024-05-27T09:25:12Z

@alfrunes, Let me know if you want to start the integration pipeline by mentioning me and the command "start pipeline".

my commands and options

You can trigger a pipeline on multiple prs with:

mentioning me and start pipeline --pr mender/127 --pr mender-connect/255

You can start a fast pipeline, disabling full integration tests with:

mentioning me and start pipeline --fast

You can trigger GitHub->GitLab branch sync with:

mentioning me and sync

You can cherry pick to a given branch or branches with:

mentioning me and:

 cherry-pick to:
 * 1.0.x
 * 2.0.x

lluiscampos

Okey, so we are finally going to publish mender-artifact on Docker too 👍

See below - we need to preserver the backwards compatibility build before merging this.

lluiscampos · 2024-05-27T13:17:24Z

Dockerfile

@@ -1,9 +1,10 @@
 # Keep golang version aligned with latest yocto release


We discussed this in the past. We cannot silently update the golang version.

However the intention now is to actually publish this image, so we cannot anymore lock to golang 1.17 here (obviously). So could you please extend your PR (scope creep coming!) with the following:

Add a new Dockerfile (f.eks Dockerfile.backcompat or something like that) which still build the binary with golang 1.17 and keeps this comment

Add a new CI job to just do docker build on this new Dockerfile

Having an extra Dockerfile for building for go1.17 seems a bit excessive. How about a simple gitlab job (build:yoctocompat) that runs go build in a golang:1.17 container?

Having an extra Dockerfile for building for go1.17 seems a bit excessive. How about a simple gitlab job (build:yoctocompat) that runs go build in a golang:1.17 container?

Actually I thought about that during this week of inactivity in this PR. It is not only better, but also aligned to other client repos when we had to do backwards compatibility jobs. Thanks

lluiscampos

Thank you! I am very happy to see this coming up together 🚀

Pre-approving, but please see my comments below

lluiscampos · 2024-06-06T07:29:39Z

.gitlab-ci.yml

  stage: build
+  before_script:
+    - docker login --username "$CI_REGISTRY_USER" --password "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"


If the password is not masked, this line would leak it. It is better to use

Suggested change

- docker login --username "$CI_REGISTRY_USER" --password "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"

- echo ${CI_REGISTRY_PASSWORD} | docker login --username ${CI_REGISTRY_USER} --password-stdin ${CI_REGISTRY}

I'm not sure I get it. Isn't it the same with the echo command? The variable is expanded there as well.

It won't be logged into stdout - (iow the CI logs). I cannot link to an LFF - but search for "GitLab CI secrets leak" in the LFF archive :)

.gitlab-ci.yml

Dockerfile

.gitlab-ci.yml

Signed-off-by: Alf-Rune Siqveland <[email protected]>

Needs to be overwritten in some circumstances, for example when building with coverage instrumentation. Signed-off-by: Alf-Rune Siqveland <[email protected]>

alfrunes · 2024-06-11T06:10:59Z

@lluiscampos I'm wondering if we should bump the build:make job to go1.23.4 since these binaries are not used inside Yocto. Otherwise, I'd remove the build:yoctocompat job since it would otherwise not be needed. What do you think?

lluiscampos · 2024-06-11T06:41:39Z

@lluiscampos I'm wondering if we should bump the build:make job to go1.23.4 since these binaries are not used inside Yocto. Otherwise, I'd remove the build:yoctocompat job since it would otherwise not be needed. What do you think?

Yes, there is no reason to keep build:make in older golang.

As a rule of thumb, we should have use golang versions: one specific for the new build:yoctocompat job (go 1.17, although in a matter of weeks we will be able to upgrade!), and then the latest for every other job and Dockerfiles 👍

alfrunes · 2024-06-11T06:55:53Z

@lluiscampos I'm wondering if we should bump the build:make job to go1.23.4 since these binaries are not used inside Yocto. Otherwise, I'd remove the build:yoctocompat job since it would otherwise not be needed. What do you think?

Oops, sorry (apparently my future self was talking here). I meant go1.22.4 of course 😅

Yes, there is no reason to keep build:make in older golang.

As a rule of thumb, we should have use golang versions: one specific for the new build:yoctocompat job (go 1.17, although in a matter of weeks we will be able to upgrade!), and then the latest for every other job and Dockerfiles 👍

Agreed! I'll update the build:make job as well 👍

Signed-off-by: Alf-Rune Siqveland <[email protected]>

reverts commit 634d64b Signed-off-by: Alf-Rune Siqveland <[email protected]>

alfrunes · 2024-06-11T13:05:47Z

@mender-test-bot start pipeline

mender-test-bot · 2024-06-11T13:06:11Z

Hello 😺 I created a pipeline for you here: Pipeline-1327329596

Build Configuration Matrix

Key	Value
AUDITLOGS_REV	master
BUILD_BEAGLEBONEBLACK	true
BUILD_CLIENT	true
BUILD_QEMUX86_64_BIOS_GRUB	true
BUILD_QEMUX86_64_BIOS_GRUB_GPT	true
BUILD_QEMUX86_64_UEFI_GRUB	true
BUILD_VEXPRESS_QEMU	true
BUILD_VEXPRESS_QEMU_FLASH	true
BUILD_VEXPRESS_QEMU_UBOOT_UEFI_GRUB	true
CREATE_ARTIFACT_WORKER_REV	master
DEPLOYMENTS_ENTERPRISE_REV	master
DEPLOYMENTS_REV	master
DEVICEAUTH_ENTERPRISE_REV	master
DEVICEAUTH_REV	master
DEVICECONFIG_REV	master
DEVICECONNECT_REV	master
DEVICEMONITOR_REV	master
GENERATE_DELTA_WORKER_REV	master
GUI_REV	master
INTEGRATION_REV	master
INVENTORY_ENTERPRISE_REV	master
INVENTORY_REV	master
IOT_MANAGER_REV	master
MENDER_ARTIFACT_REV	pull/613/head
MENDER_BINARY_DELTA_REV	master
MENDER_CLI_REV	master
MENDER_CONFIGURE_MODULE_REV	master
MENDER_CONNECT_REV	master
MENDER_CONVERT_REV	master
MENDER_GATEWAY_REV	master
MENDER_REV	master
MENDER_SETUP_REV	master
MENDER_SNAPSHOT_REV	master
MONITOR_CLIENT_REV	master
RUN_BACKEND_INTEGRATION_TESTS	true
RUN_INTEGRATION_TESTS	true
TENANTADM_REV	master
TEST_QEMUX86_64_BIOS_GRUB	true
TEST_QEMUX86_64_BIOS_GRUB_GPT	true
TEST_QEMUX86_64_UEFI_GRUB	true
TEST_VEXPRESS_QEMU	true
TEST_VEXPRESS_QEMU_FLASH	true
TEST_VEXPRESS_QEMU_UBOOT_UEFI_GRUB	true
USERADM_ENTERPRISE_REV	master
USERADM_REV	master
WORKFLOWS_ENTERPRISE_REV	master
WORKFLOWS_REV	master

lluiscampos · 2024-06-12T08:29:12Z

.gitlab-ci.yml

@@ -150,8 +150,6 @@ test:smoketests:linux:
    - ./mender-artifact-linux read test-rfs.mender
    - ./mender-artifact-linux validate test-rfs.mender
    - ./tests/test_compressions/test_supported_compressions.sh
-    # QA-507: lock mender-artifact to OpenSSL 1.1
-    - ldd ./mender-artifact-linux | grep libssl.so.1.1


We should not break compatibility this way. We need to plan it a bit. As discussed in person, we could offer two flavors in our Downloads page: one statically linked without pkcs11 and one dynamically linked for openssl3.

As this starts to be bigger than a nice to have PR, can we create a task for it? It involves the work here, plus having some sort of subdirs structure in the S3 bucket, and mender-docs.

alfrunes requested a review from lluiscampos May 27, 2024 09:25

lluiscampos requested changes May 27, 2024

View reviewed changes

alfrunes force-pushed the Dockerfile branch from a0f23c3 to e59cc69 Compare June 5, 2024 08:49

alfrunes requested a review from lluiscampos June 5, 2024 08:52

alfrunes force-pushed the Dockerfile branch from e59cc69 to e6b0074 Compare June 5, 2024 14:29

lluiscampos approved these changes Jun 6, 2024

View reviewed changes

alfrunes added 3 commits June 6, 2024 14:35

chore(Dockerfile): Refactor dockerfile to Debian Slim with no deps

b3587e8

Signed-off-by: Alf-Rune Siqveland <[email protected]>

ci: Add job for building with Yocto LTS golang version

c198a1e

Signed-off-by: Alf-Rune Siqveland <[email protected]>

ci: Update build:docker and publish image to Docker Hub

66d1ddd

Signed-off-by: Alf-Rune Siqveland <[email protected]>

alfrunes force-pushed the Dockerfile branch from e6b0074 to 66d1ddd Compare June 6, 2024 12:35

alfrunes requested a review from lluiscampos June 6, 2024 12:35

lluiscampos approved these changes Jun 7, 2024

View reviewed changes

chore(make): Expose go buildflags as a variable

ead6f3c

Needs to be overwritten in some circumstances, for example when building with coverage instrumentation. Signed-off-by: Alf-Rune Siqveland <[email protected]>

alfrunes force-pushed the Dockerfile branch 3 times, most recently from 4ffe851 to 3818d08 Compare June 11, 2024 12:05

alfrunes added 4 commits June 11, 2024 14:43

ci: Make pkcs11 tests use binaries built by host system

791bd1b

Signed-off-by: Alf-Rune Siqveland <[email protected]>

ci: Bump golang version to go1.22.4 for distributing binaries

b0fa4af

Signed-off-by: Alf-Rune Siqveland <[email protected]>

ci: Add missing Openssl dependencies to build jobs

95dd769

Signed-off-by: Alf-Rune Siqveland <[email protected]>

revert: Explicitly build binaries with OpenSSL 1.1

2919db0

reverts commit 634d64b Signed-off-by: Alf-Rune Siqveland <[email protected]>

alfrunes force-pushed the Dockerfile branch from 15b0e0e to 2919db0 Compare June 11, 2024 12:44

alfrunes requested a review from lluiscampos June 11, 2024 13:05

lluiscampos requested changes Jun 12, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(Dockerfile): Refactor dockerfile to Debian Slim with no deps #613

chore(Dockerfile): Refactor dockerfile to Debian Slim with no deps #613

alfrunes commented May 27, 2024

mender-test-bot commented May 27, 2024

lluiscampos left a comment

lluiscampos May 27, 2024

alfrunes Jun 5, 2024

lluiscampos Jun 6, 2024

lluiscampos left a comment •

edited

Loading

lluiscampos Jun 6, 2024

alfrunes Jun 6, 2024

lluiscampos Jun 7, 2024

alfrunes commented Jun 11, 2024

lluiscampos commented Jun 11, 2024

alfrunes commented Jun 11, 2024

alfrunes commented Jun 11, 2024

mender-test-bot commented Jun 11, 2024

lluiscampos Jun 12, 2024

		@@ -1,9 +1,10 @@
		# Keep golang version aligned with latest yocto release

	- docker login --username "$CI_REGISTRY_USER" --password "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
	- echo ${CI_REGISTRY_PASSWORD} \| docker login --username ${CI_REGISTRY_USER} --password-stdin ${CI_REGISTRY}

chore(Dockerfile): Refactor dockerfile to Debian Slim with no deps #613

Are you sure you want to change the base?

chore(Dockerfile): Refactor dockerfile to Debian Slim with no deps #613

Conversation

alfrunes commented May 27, 2024

mender-test-bot commented May 27, 2024

lluiscampos left a comment

Choose a reason for hiding this comment

lluiscampos May 27, 2024

Choose a reason for hiding this comment

alfrunes Jun 5, 2024

Choose a reason for hiding this comment

lluiscampos Jun 6, 2024

Choose a reason for hiding this comment

lluiscampos left a comment • edited Loading

Choose a reason for hiding this comment

lluiscampos Jun 6, 2024

Choose a reason for hiding this comment

alfrunes Jun 6, 2024

Choose a reason for hiding this comment

lluiscampos Jun 7, 2024

Choose a reason for hiding this comment

alfrunes commented Jun 11, 2024

lluiscampos commented Jun 11, 2024

alfrunes commented Jun 11, 2024

alfrunes commented Jun 11, 2024

mender-test-bot commented Jun 11, 2024

lluiscampos Jun 12, 2024

Choose a reason for hiding this comment

lluiscampos left a comment •

edited

Loading