Skip to content

oci: Parameterize Debian OCI Dockerfile for multiarch #33949

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
camscale merged 2 commits into from
Nov 2, 2023
Merged

oci: Parameterize Debian OCI Dockerfile for multiarch #33949

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ee8fcc
oci: Parameterize Debian OCI Dockerfile for multiarch
camscale Oct 23, 2023
1ca2200
oci: Optimize OCI image size and build time
camscale Nov 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion build.assets/charts/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,9 @@ FROM ubuntu:20.04 AS teleport

# Copy the deb archive
ARG DEB_PATH
COPY ${DEB_PATH?} /tmp/teleport.deb
ARG DEB_BASE
ARG TARGETARCH
COPY ${DEB_PATH:-${DEB_BASE}_${TARGETARCH}.deb} /tmp/teleport.deb

@tcsc tcsc Oct 31, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possibly out of scope for this, but is it worth pulling out this COPY & adding a mount point to the context dir so that we can install directly from there in the script?

@camscale camscale Nov 2, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's an option I guess, but I'm not sure it buys us much. We're still going to need to parameterise enough to select the right .deb file. I might be more inclined to pull the deb archive from the release server or S3 bucket inside the dockerfile.

But either way, this being a legacy component, I'll probably just leave it as is and let it disappear in 12 months when teleport 14 drops out of support (the last version we'll publish with legacy OCI images).

@fheinecke fheinecke Nov 2, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this removes a layer from the final image, which reduces the image size. Not 100% sure.

I might be more inclined to pull the deb archive from the release server or S3 bucket inside the dockerfile.

I had considered this when I rewrote this file. I think I chose not to do this because:

  • It is intended that developers can use this to build Teleport and produce an image from that build
  • It would have added some additional complexity to our Drone setup due to additional interdependencies

@camscale camscale Nov 2, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm, I think I flaked a little bit working on this. I saw the "FROM ..." at the end and assumed a standard multi-stage build, but at the same time I knew it was only for setting the FIPS entrypoint. But this is leaving the /tmp/teleport.deb file behind in the image. It would be good not to do this, and that's what the volume mount would give us, perhaps using https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/reference.md#run---mount RUN --mount. I'll try that out.

@camscale camscale Nov 2, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tcsc @fheinecke I've reworked this to use a bind mount for the deb file so it is no longer copied in, "bloating" the image. I also separated the installation of stuff with apt-get and the installation of the teleport .deb. This will allow caching of the apt-get layer which I'll make use of in the workflow building OSS and Enterprise (and FIPS) in the same workflow sequentially. Since most is cached, the subsequent builds are quite fast. Thank you both for prompting me on this - this is much better now.

@camscale camscale Nov 2, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since I've changed it materially, I would appreciate it if you could give it another look over.


# Install dumb-init and ca-certificates. The dumb-init package is to ensure
# signals and orphaned processes are are handled correctly. The ca-certificate
Expand Down