From 818738539efe440a3b5fdee42ab4dc34c01ab4f4 Mon Sep 17 00:00:00 2001 From: Stephan Renatus Date: Fri, 16 Aug 2019 08:53:54 +0200 Subject: [PATCH] build: use docker for golang As discussed in #1639. Note that .dockerignore had to be changed as to *not* skip what's needed for the build: vendor, obviously, and .git for the compiled-in version information. parts: - .travis.yml: don't bother about golang anymore - docs/devel/DEVELOPMENT.md: update - Makefile: update hint Signed-off-by: Stephan Renatus --- .dockerignore | 3 +-- .travis.yml | 4 ---- Dockerfile | 21 +++++++++++++++++++++ Dockerfile.build | 13 +++++++++++++ Dockerfile.in | 13 ------------- Dockerfile_debug.in | 13 ------------- Dockerfile_rootless.in | 18 ------------------ Makefile | 26 +++++++++++++++----------- docs/devel/DEVELOPMENT.md | 7 +++---- 9 files changed, 53 insertions(+), 65 deletions(-) create mode 100644 Dockerfile create mode 100644 Dockerfile.build delete mode 100644 Dockerfile.in delete mode 100644 Dockerfile_debug.in delete mode 100644 Dockerfile_rootless.in diff --git a/.dockerignore b/.dockerignore index 593f4e69aa..2f88269126 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,2 +1 @@ -.git -vendor +/docs diff --git a/.travis.yml b/.travis.yml index d7979e746f..63fa15fad7 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,10 +1,6 @@ sudo: required -language: go -go_import_path: github.com/open-policy-agent/opa # This is needed for clang to be included so we can build libFuzzer targets dist: bionic -go: -- "1.12.8" script: make travis-all install: # AWS CLI is required for pushing the edge binaries to S3. diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000000..6b146c207d --- /dev/null +++ b/Dockerfile @@ -0,0 +1,21 @@ +# Copyright 2019 The OPA Authors. All rights reserved. +# Use of this source code is governed by an Apache2 +# license that can be found in the LICENSE file. +ARG BUILD_COMMIT +# we cant use build-args in `COPY --from=...` below, so work around this +# see: https://medium.com/@tonistiigi/advanced-multi-stage-build-patterns-6f741b852fae +FROM build-${BUILD_COMMIT} AS copy-src + +FROM gcr.io/distroless/base${VARIANT} +# make root (uid 0) default when not specified +ARG USER=0 +MAINTAINER Torin Sandall +COPY --from=copy-src /go/src/github.com/open-policy-agent/opa/opa_linux_amd64 /opa + +# Any non-zero number will do, and unfortunately a named user will not, +# as k8s pod securityContext runAsNonRoot can't resolve the user ID: +# https://github.com/kubernetes/kubernetes/issues/40958 +USER ${USER} + +ENTRYPOINT ["/opa"] +CMD ["run"] diff --git a/Dockerfile.build b/Dockerfile.build new file mode 100644 index 0000000000..ddd6d8c897 --- /dev/null +++ b/Dockerfile.build @@ -0,0 +1,13 @@ +# Copyright 2019 The OPA Authors. All rights reserved. +# Use of this source code is governed by an Apache2 +# license that can be found in the LICENSE file. + +# global ARG vars, see https://github.com/moby/moby/issues/37345 +ARG GOVERSION + +FROM golang:${GOVERSION} +ARG GOARCH=amd64 +WORKDIR /go/src/github.com/open-policy-agent/opa +COPY . . +RUN make deps build-linux build-darwin build-windows test perf check +RUN mkdir /out && cp opa_linux_${GOARCH} opa_darwin_${GOARCH} opa_windows_${GOARCH}.exe /out diff --git a/Dockerfile.in b/Dockerfile.in deleted file mode 100644 index a220d95741..0000000000 --- a/Dockerfile.in +++ /dev/null @@ -1,13 +0,0 @@ -# Copyright 2016 The OPA Authors. All rights reserved. -# Use of this source code is governed by an Apache2 -# license that can be found in the LICENSE file. - -FROM gcr.io/distroless/base - -MAINTAINER Torin Sandall - -ADD opa_linux_GOARCH /opa - -ENTRYPOINT ["/opa"] - -CMD ["run"] diff --git a/Dockerfile_debug.in b/Dockerfile_debug.in deleted file mode 100644 index 23a4846ddb..0000000000 --- a/Dockerfile_debug.in +++ /dev/null @@ -1,13 +0,0 @@ -# Copyright 2018 The OPA Authors. All rights reserved. -# Use of this source code is governed by an Apache2 -# license that can be found in the LICENSE file. - -FROM gcr.io/distroless/base:debug - -MAINTAINER Torin Sandall - -ADD opa_linux_GOARCH /opa - -ENTRYPOINT ["/opa"] - -CMD ["run"] diff --git a/Dockerfile_rootless.in b/Dockerfile_rootless.in deleted file mode 100644 index 86c5322f85..0000000000 --- a/Dockerfile_rootless.in +++ /dev/null @@ -1,18 +0,0 @@ -# Copyright 2016 The OPA Authors. All rights reserved. -# Use of this source code is governed by an Apache2 -# license that can be found in the LICENSE file. - -FROM gcr.io/distroless/base - -MAINTAINER Torin Sandall - -ADD opa_linux_GOARCH /opa - -# Any non-zero number will do, and unfortunately a named user will not, -# as k8s pod securityContext runAsNonRoot can't resolve the user ID: -# https://github.com/kubernetes/kubernetes/issues/40958 -USER 1 - -ENTRYPOINT ["/opa"] - -CMD ["run"] diff --git a/Makefile b/Makefile index 1299c3bbba..4cde15b719 100644 --- a/Makefile +++ b/Makefile @@ -5,7 +5,7 @@ VERSION := 0.14.0-dev GO := go -GOVERSION := 1.12.8 +GOVERSION := 1.12.9 GOARCH := $(shell go env GOARCH) GOOS := $(shell go env GOOS) @@ -37,8 +37,8 @@ export GO15VENDOREXPERIMENT # ###################################################### -# If you update the 'all' target check/update the 'travis-all' target to make -# sure they're consistent. +# If you update the 'all' target check/update the call in Dockerfile.build target +# to make sure they're consistent. .PHONY: all all: deps build test perf check @@ -138,7 +138,6 @@ wasm-clean: .PHONY: clean clean: wasm-clean - rm -f .Dockerfile_* rm -f opa_*_* rm -fr _test @@ -154,8 +153,16 @@ docs-%: # ###################################################### +.PHONY: travis-build +travis-build: wasm-build opa-wasm-test + # this image is used in `Dockerfile` for image-quick + docker build -t build-$(BUILD_COMMIT) --build-arg GOVERSION=$(GOVERSION) -f Dockerfile.build . + # the '/.' means "don't create the directory, copy its content only" + # note: we don't bother cleaning up the container + docker cp "$$(docker create build-$(BUILD_COMMIT)):/out/." . + .PHONY: travis-all -travis-all: deps build-linux build-darwin build-windows test fuzzit-local-regression perf check +travis-all: travis-build wasm-test fuzzit-local-regression .PHONY: build-linux build-linux: @@ -172,12 +179,9 @@ build-windows: .PHONY: image-quick image-quick: - sed -e 's/GOARCH/$(GOARCH)/g' Dockerfile.in > .Dockerfile_$(GOARCH) - sed -e 's/GOARCH/$(GOARCH)/g' Dockerfile_debug.in > .Dockerfile_debug_$(GOARCH) - sed -e 's/GOARCH/$(GOARCH)/g' Dockerfile_rootless.in > .Dockerfile_rootless_$(GOARCH) - docker build -t $(IMAGE):$(VERSION) -f .Dockerfile_$(GOARCH) . - docker build -t $(IMAGE):$(VERSION)-debug -f .Dockerfile_debug_$(GOARCH) . - docker build -t $(IMAGE):$(VERSION)-rootless -f .Dockerfile_rootless_$(GOARCH) . + docker build --build-arg BUILD_COMMIT=$(BUILD_COMMIT) -t $(IMAGE):$(VERSION) . + docker build --build-arg BUILD_COMMIT=$(BUILD_COMMIT) -t $(IMAGE):$(VERSION)-debug --build-arg VARIANT=:debug . + docker build --build-arg BUILD_COMMIT=$(BUILD_COMMIT) -t $(IMAGE):$(VERSION)-rootless --build-arg USER=1 . .PHONY: push push: diff --git a/docs/devel/DEVELOPMENT.md b/docs/devel/DEVELOPMENT.md index cefe276ecc..3b06a60e70 100644 --- a/docs/devel/DEVELOPMENT.md +++ b/docs/devel/DEVELOPMENT.md @@ -9,7 +9,7 @@ Requirements: - Git - GitHub account (if you are contributing) -- Go (version 1.11 is supported though older versions are likely to work) +- Go (version 1.12 is supported though older versions are likely to work) - GNU Make ## Getting Started @@ -139,8 +139,7 @@ code is kept in the repository so that commands such as `go get` work. ## Go -If you need to update the version of Go used to build OPA you must update two +If you need to update the version of Go used to build OPA you must update these files in the root of this repository: -* `.travis.yml` which is used to configure the Travis CI build environment. -* `Makefile`- which is used to produce releases locally. Update the `GOVERSION` variable. \ No newline at end of file +* `Makefile`- which is used to produce releases locally. Update the `GOVERSION` variable.