Skip to content

Build docker images through CI #207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jking-aus merged 17 commits into from
Mar 25, 2025
Merged

Build docker images through CI #207

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
00dc610
define `ENTRYPOINT` in containers
antondlr Mar 23, 2025
83b5c2f
attempt at mvp
antondlr Mar 23, 2025
6ebc278
bump ubuntu version
antondlr Mar 23, 2025
ad2cbfb
strip it down
antondlr Mar 23, 2025
382da8f
nit: JSON arguments for `ENTRYPOINT`
antondlr Mar 23, 2025
445b5a6
modernise `apt` phrasing
antondlr Mar 23, 2025
b9d3950
bump rust for no reason
antondlr Mar 23, 2025
cbbd7e8
bump rust forreal now,
antondlr Mar 23, 2025
300d879
fix?
antondlr Mar 23, 2025
a055123
try different multiarch approach
antondlr Mar 23, 2025
d681c03
exit the matrix
antondlr Mar 23, 2025
b254868
fixes
antondlr Mar 23, 2025
512798d
multiarch take two
antondlr Mar 23, 2025
33edec0
cleanup
antondlr Mar 23, 2025
f66eb9c
only build x86; fix building multiarch manifest
antondlr Mar 23, 2025
0d317b2
cleanup branch triggers
antondlr Mar 23, 2025
65c2f75
auto-build `interop1` branch
antondlr Mar 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 47 additions & 67 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,9 @@ name: Docker build and push
on:
push:
branches:
- unstable
- stable
- interop1
tags:
- v*

Expand All @@ -14,24 +16,29 @@ concurrency:
env:
# Enable self-hosted runners for the sigp repo only.
SELF_HOSTED_RUNNERS: ${{ github.repository == 'sigp/anchor' }}
RUST_VERSION: '1.80.0'
SHORT_ARCH: 'amd64'
RUST_VERSION: '1.85.1'
# Deny warnings in CI
RUSTFLAGS: "-D warnings -C debuginfo=0"
# Prevent Github API rate limiting
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/anchor

jobs:
extract-version:
uses: ./.github/workflows/extract-version.yml


build-docker-multi-arch:
name: build-docker-anchor-${{ matrix.cpu_arch }}
runs-on: ${{ github.repository == 'sigp/anchor' && fromJson('["self-hosted", "linux", "release"]') || 'ubuntu-22.04' }}
build-docker:
name: build-docker
# TODO: we don't have self-hosted runners available for anchor at the moment
# runs-on: ${{ github.repository == 'sigp/anchor' && fromJson('["self-hosted", "linux", "release"]') || 'ubuntu-24.04' }}
runs-on: ubuntu-24.04
strategy:
matrix:
cpu_arch: [aarch64, x86_64]
# cpu_arch: [aarch64, x86_64]
cpu_arch: [x86_64]
include:
- profile: maxperf

Expand All @@ -44,81 +51,37 @@ jobs:
- name: Map aarch64 to arm64 short arch
if: startsWith(matrix.cpu_arch, 'aarch64')
run: echo "SHORT_ARCH=arm64" >> $GITHUB_ENV

- name: Map x86_64 to amd64 short arch
if: startsWith(matrix.cpu_arch, 'x86_64')
run: echo "SHORT_ARCH=amd64" >> $GITHUB_ENV


- name: Install Rust and Cargo
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
source $HOME/.cargo/env
echo "PATH=$HOME/.cargo/bin:$PATH" >> $GITHUB_ENV


- name: cargo install cross
run: |
cargo install cross

# - uses: actions/checkout@v4
# - name: Update Rust
# if: env.SELF_HOSTED_RUNNERS == 'false'
# run: rustup update stable
- name: Checkout sources
uses: actions/checkout@v4

- name: Get rust-version
id: get-rust-version
run: |
echo "RUST_VERSION=$(./.github/scripts/toml_reader.sh ./anchor/Cargo.toml package rust-version)" >> $GITHUB_ENV

- name: Get latest version of stable Rust
run: echo "rust version is ${{ env.RUST_VERSION }}"

- name: Retrieve Docker credentials from Vault
uses: hashicorp/vault-action@v2
with:
url: https://vault.sigp.io
method: github
githubToken: ${{ secrets.GH_TOKEN }}
secrets: |
spesi_kv/data/dev/docker/anchor DOCKER_USERNAME ;
spesi_kv/data/dev/docker/anchor DOCKER_PASSWORD
# - name: Retrieve Docker credentials from Vault
# uses: hashicorp/vault-action@v2
# with:
# url: https://vault.sigp.io
# method: github
# githubToken: ${{ secrets.GH_TOKEN }}
# secrets: |
# spesi_kv/data/dev/docker/anchor DOCKER_USERNAME ;
# spesi_kv/data/dev/docker/anchor DOCKER_PASSWORD

- name: Dockerhub login
run: |
echo "${DOCKER_PASSWORD}" | docker login --username ${DOCKER_USERNAME} --password-stdin

- name: Build binary
run: |
cargo install cross
env CROSS_PROFILE=${{ matrix.profile }} make build-${{ matrix.cpu_arch }}


- name: Set `make` command for anchor
run: |
echo "MAKE_CMD=build-${{ matrix.cpu_arch }}" >> $GITHUB_ENV

- name: Make bin dir
run: mkdir ./bin

- name: Move built binary into Docker scope
run: mv ./target/${{ matrix.cpu_arch }}-unknown-linux-gnu/${{ matrix.profile }}/anchor ./bin

- name: Install QEMU
- name: Setup QEMU
if: env.SELF_HOSTED_RUNNERS == 'false'
run: sudo apt-get update && sudo apt-get install -y qemu-user-static

- name: Set up Docker Buildx
uses: docker/setup-qemu-action@v3
- name: Setup Docker Buildx
if: env.SELF_HOSTED_RUNNERS == 'false'
uses: docker/setup-buildx-action@v3

- name: Build and push
uses: docker/build-push-action@v5
uses: docker/build-push-action@v6
with:
file: ./anchor/Dockerfile.cross
context: .
platforms: linux/${{ env.SHORT_ARCH }}
labels: |
git.revision=${{ github.sha }}
Expand All @@ -127,8 +90,25 @@ jobs:
git.repository=${{ github.repository }}
push: true
tags: |
${{ github.repository_owner}}/anchor:${{ env.VERSION }}-${{ env.SHORT_ARCH }}${{ env.VERSION_SUFFIX }}
${{ env.IMAGE_NAME }}:${{ env.VERSION }}${{ env.VERSION_SUFFIX}}-${{ env.SHORT_ARCH }}
build-args: |
RUST_VERSION=${{ env.RUST_VERSION }}
TARGETPLATFORM=linux/${{ env.SHORT_ARCH }}


docker-multiarch-manifest:
name: docker-multiarch-manifest
runs-on: ubuntu-24.04
needs: [build-docker, extract-version]
env:
# We need to enable experimental docker features in order to use `docker manifest`
DOCKER_CLI_EXPERIMENTAL: enabled
VERSION: ${{ needs.extract-version.outputs.VERSION }}
VERSION_SUFFIX: ${{ needs.extract-version.outputs.VERSION_SUFFIX }}
steps:
- name: Dockerhub login
run: |
echo "${DOCKER_PASSWORD}" | docker login --username ${DOCKER_USERNAME} --password-stdin
- name: Create and push multiarch manifest
Copy link
Contributor

@magick93 magick93 Mar 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure cross does this already - cross uses buildx internally.
You can try pulling the manifest from any of the images from https://hub.docker.com/repository/docker/magick93/anchor.

So I'm not sure if docker-multiarch-manifest is needed.

Copy link
Member Author

@antondlr antondlr Mar 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah it is, cross does indeed publish with a manifest but we want the regular (no arch defined) image tag to contain both architectures eventually.
in this stripped down, x86_only version we can skip it indeed and just add the tag. but this works for multiarch, just needs some commenting out.

Copy link
Member Author

@antondlr antondlr Mar 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah or do you mean you can push to the same tag and it will append instead of replace, if it's a different arch?
I'll play with it a bit, would be good to get rid of it.

Copy link
Member Author

@antondlr antondlr Mar 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tested it out; it overwrites the tag altogether.
so for multiarch there are two valid approaches:

  • build multiarch manifest manually (what we do here)
  • build all architectures in one task and push (with: platforms: linux/arm64,linux/amd64). this slows everything down even more though as both will be built on the same runner instance.

So yeah we can get rid of it, at a cost for actual multiarch builds.
I'm fine with both, do we aim for simplicity or speed?

Copy link
Member

@dknopik dknopik Mar 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If "simplicity" means 3hr builds, i'd vote for speed, at least for now :)

Copy link
Contributor

@magick93 magick93 Mar 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dknopik

If we consider purely from speed, for now, would the following be an improvement?

  • only build docker images on a tag
  • only run tests by default

Copy link
Contributor

@magick93 magick93 Mar 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@antondlr - It looks like I'm mistaken. The manifest is not implicitly appended. I've been experimenting on eleel using bake which is basically a wrapper around buildx and depending on which iteration on the matrix finishes last is what is written (overwritten) in the manifest. So I think explicitly updating or appending the manifest would be the reliable way to go.

Copy link
Member Author

@antondlr antondlr Mar 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah this is exactly what I found in testing, too.
also no appropriate config in docker/build-push-action to amend instead of replace :/
luckily it's a pretty fast task to execute!

run: |
docker buildx imagetools create -t ${IMAGE_NAME}:${VERSION}${VERSION_SUFFIX} \
${IMAGE_NAME}:${VERSION}${VERSION_SUFFIX}-amd64;
# ${IMAGE_NAME}:${VERSION}${VERSION_SUFFIX}-arm64;
9 changes: 5 additions & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
ARG RUST_VERSION=1.83.0
ARG RUST_VERSION=1.85.1
FROM rust:${RUST_VERSION}-bullseye AS builder
RUN apt-get update && apt-get -y upgrade && apt-get install -y cmake libclang-dev
RUN apt update && apt dist-upgrade -y && apt install -y cmake libclang-dev
COPY . anchor
ARG FEATURES
ARG PROFILE=release
Expand All @@ -10,8 +10,9 @@ ENV PROFILE=$PROFILE
ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_USE_GIT_CLI
RUN cd anchor && make

FROM ubuntu:22.04
RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \
FROM ubuntu:24.04
ENTRYPOINT ["/usr/local/bin/anchor"]
RUN apt update && apt dist-upgrade -y && apt install -y --no-install-recommends \
libssl-dev \
ca-certificates \
&& apt-get clean \
Expand Down
5 changes: 3 additions & 2 deletions Dockerfile.cross
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
# This image is meant to enable cross-architecture builds.
# It assumes the lighthouse binary has already been
# compiled for `$TARGETPLATFORM` and moved to `./bin`.
FROM --platform=$TARGETPLATFORM ubuntu:22.04
RUN apt-get update && apt-get install -y --no-install-recommends \
FROM --platform=$TARGETPLATFORM ubuntu:24.04
ENTRYPOINT ["/usr/local/bin/anchor"]
RUN apt update && apt dist-upgrade -y && apt install -y --no-install-recommends \
libssl-dev \
ca-certificates \
&& apt-get clean \
Expand Down
9 changes: 5 additions & 4 deletions Dockerfile.devnet
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
ARG RUST_VERSION=1.83.0
ARG RUST_VERSION=1.85.1
FROM rust:${RUST_VERSION}-bullseye AS builder
RUN apt-get update && apt-get -y upgrade && apt-get install -y cmake libclang-dev
RUN apt update && apt dist-upgrade -y && apt install -y cmake libclang-dev
COPY . anchor
ARG FEATURES=spec-minimal
ARG PROFILE=release
Expand All @@ -10,8 +10,9 @@ ENV PROFILE=$PROFILE
ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_USE_GIT_CLI
RUN cd anchor && make

FROM ubuntu:22.04
RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \
FROM ubuntu:24.04
ENTRYPOINT ["/usr/local/bin/anchor"]
RUN apt update && apt dist-upgrade -y && apt-get install -y --no-install-recommends \
libssl-dev \
ca-certificates \
jq \
Expand Down