Skip to content

Commit a41711c

Browse files
v0lkanv0lkan
authored
Merge pull request #114 from csoylu/108-create-one-dockerfile-per-app
create one dockerfile per app
2 parents a132564 + a49d576 commit a41711c

File tree

8 files changed

+317
-59
lines changed

8 files changed

+317
-59
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,6 @@ jobs:
5757
fetch-depth: 0
5858
- name: Set up Go
5959
uses: actions/setup-go@v5
60-
with:
61-
go-version-file: 'go.mod'
62-
# Specify a compatible Go version for linting
63-
# go-version: '1.23'
6460
- name: golangci-lint
6561
uses: golangci/golangci-lint-action@v6
6662
with:

‎.github/workflows/dockerhub.yaml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: Build and Push to Docker Hub
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
env:
8+
# Use docker.io for Docker Hub if empty
9+
REGISTRY: docker.io
10+
# github.repository as <account>/<repo>
11+
IMAGE_NAME: ${{ github.repository }}
12+
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
13+
COSIGN_EXPERIMENTAL: 1
14+
DOCKER_CONTENT_TRUST: 1
15+
DOCKER_CONTENT_TRUST_SERVER: https://notary.docker.io
16+
17+
jobs:
18+
docker:
19+
runs-on: ubuntu-latest
20+
strategy:
21+
matrix:
22+
include:
23+
- dockerfile: kubernetes/dockerfiles/spike.Dockerfile
24+
image: spike/spike
25+
- dockerfile: kubernetes/dockerfiles/keeper.Dockerfile
26+
image: spike/keeper
27+
- dockerfile: kubernetes/dockerfiles/nexus.Dockerfile
28+
image: spike/nexus
29+
permissions:
30+
contents: read
31+
packages: write
32+
id-token: write # needed for signing the images with GitHub OIDC Token
33+
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@v4
37+
with:
38+
ref: ${{ github.event.release.tag_name }}
39+
40+
- name: Set up QEMU
41+
uses: docker/setup-qemu-action@v3
42+
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@v3
45+
46+
- name: Install cosign
47+
uses: sigstore/cosign-installer@v3.3.0
48+
49+
# Setup Docker Content Trust keys
50+
- name: Setup DCT
51+
if: github.event_name == 'release'
52+
env:
53+
DCT_DELEGATION_KEY: ${{ secrets.DCT_DELEGATION_KEY }}
54+
DCT_ROOT_KEY: ${{ secrets.DCT_ROOT_KEY }}
55+
run: |
56+
mkdir -p ~/.docker/trust/private
57+
echo "$DCT_DELEGATION_KEY" > ~/.docker/trust/private/$(echo -n "${{ env.REGISTRY }}/${{ matrix.image }}" | sha256sum | cut -d' ' -f1).key
58+
echo "$DCT_ROOT_KEY" > ~/.docker/trust/private/root_keys
59+
60+
# Login to Docker Hub
61+
- name: Log in to Docker Hub
62+
uses: docker/login-action@v3
63+
with:
64+
username: ${{ secrets.DOCKERHUB_USERNAME }}
65+
password: ${{ secrets.DOCKERHUB_TOKEN }}
66+
67+
# Extract metadata (tags, labels) for Docker
68+
- name: Extract metadata
69+
id: meta
70+
uses: docker/metadata-action@v5
71+
with:
72+
images: ${{ env.REGISTRY }}/${{ matrix.image }}
73+
tags: |
74+
type=semver,pattern={{version}},value=${{ github.event.release.tag_name }}
75+
type=semver,pattern={{major}}.{{minor}},value=${{ github.event.release.tag_name }}
76+
type=raw,value=latest
77+
type=sha
78+
# example tags in order: 1.2.3, 1.2, latest, sha-1234567890(git commit sha)
79+
80+
# Build and push Docker image
81+
- name: Build and push
82+
uses: docker/build-push-action@v5
83+
id: build-and-push
84+
with:
85+
context: .
86+
file: ${{ matrix.dockerfile }}
87+
platforms: linux/amd64,linux/arm64
88+
push: ${{ github.event_name == 'release' }}
89+
tags: ${{ steps.meta.outputs.tags }}
90+
labels: ${{ steps.meta.outputs.labels }}
91+
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:buildcache
92+
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:buildcache,mode=max
93+
provenance: mode=max
94+
95+
- name: Sign the images with GitHub OIDC (Cosign)
96+
if: github.event_name == 'release'
97+
env:
98+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
99+
TAGS: ${{ steps.meta.outputs.tags }}
100+
run: |
101+
echo "${TAGS}" | tr ',' '\n' | while read -r tag; do
102+
cosign sign --yes "${tag}@${DIGEST}"
103+
done
104+
105+
- name: Sign the images with DCT
106+
if: github.event_name == 'release'
107+
env:
108+
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DCT_REPOSITORY_PASSPHRASE }}
109+
TAGS: ${{ steps.meta.outputs.tags }}
110+
run: |
111+
echo "${TAGS}" | tr ',' '\n' | while read -r tag; do
112+
docker trust sign "$tag"
113+
done

‎Dockerfile‎

Lines changed: 0 additions & 55 deletions
This file was deleted.

‎kubernetes/README.MD‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# SPIKE Kubernetes Resources
2+
3+
This directory contains container and deployment-related files for the SPIKE project.
4+
5+
## Directory Structure
6+
7+
- `./dockerfiles/` - Contains Dockerfiles for all SPIKE components
8+
- `./build.sh` - Build script used by Dockerfiles for cross-compilation
9+
10+
## Building Container Images
11+
12+
### Basic Build
13+
14+
To build a SPIKE component container image:
15+
16+
```bash
17+
# General syntax
18+
docker build -t <component-name>:tag -f kubernetes/dockerfiles/<component-name>.Dockerfile .
19+
20+
# Examples
21+
docker build -t keeper:latest -f kubernetes/dockerfiles/keeper.Dockerfile .
22+
docker build -t nexus:latest -f kubernetes/dockerfiles/nexus.Dockerfile .
23+
docker build -t spike:latest -f kubernetes/dockerfiles/spike.Dockerfile .
24+
```
25+
26+
### Multi-Architecture Builds with Docker Buildx
27+
28+
For building multi-architecture images (e.g., for both amd64 and arm64):
29+
30+
```bash
31+
# Create a new builder instance if you haven't already
32+
docker buildx create --name spike-builder --use
33+
34+
# Build and push multi-arch image
35+
docker buildx build --platform linux/amd64,linux/arm64 \
36+
-t <registry>/<component-name>:tag \
37+
-f kubernetes/dockerfiles/<component-name>.Dockerfile \
38+
--push .
39+
40+
# Example for building and pushing to Docker Hub
41+
docker buildx build --platform linux/amd64,linux/arm64 \
42+
-t yourusername/spike-keeper:latest \
43+
-f kubernetes/dockerfiles/keeper.Dockerfile \
44+
--push .
45+
```
46+
47+
## Running Containers
48+
49+
```bash
50+
# Run with debug logging
51+
docker run --rm -e SPIKE_SYSTEM_LOG_LEVEL=DEBUG keeper:latest
52+
53+
# Run with mounted configuration
54+
docker run --rm -v /path/to/config:/config nexus:latest
55+
```
56+
57+
## Kubernetes Deployment
58+
59+
Sample Kubernetes manifests for deploying SPIKE components will be added in future releases.
60+
61+
## Notes
62+
63+
- All Dockerfiles use distroless base images for minimal attack surface
64+
- The keeper and spike components use the static distroless image
65+
- The nexus component uses the base distroless image due to CGO dependencies

‎kubernetes/build.sh‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
set -e
3+
4+
# Check if both arguments are provided
5+
if [ $# -ne 2 ]; then
6+
echo "Usage: $0 <arch> <app>"
7+
echo " arch: amd64 or arm64"
8+
echo " app: application name"
9+
exit 1
10+
fi
11+
12+
TARGETARCH=$1
13+
APP=$2
14+
15+
if [ "$TARGETARCH" = "amd64" ]; then
16+
CC=x86_64-linux-gnu-gcc go build -o $APP /workspace/app/$APP/cmd/main.go
17+
elif [ "$TARGETARCH" = "arm64" ]; then
18+
CC=aarch64-linux-gnu-gcc go build -o $APP /workspace/app/$APP/cmd/main.go
19+
else
20+
echo "Error: Supported architectures are amd64 and arm64"
21+
exit 1
22+
fi

‎kubernetes/dockerfiles/keeper.Dockerfile‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
FROM --platform=$BUILDPLATFORM golang:1.24.1 AS builder
2+
ARG BUILDPLATFORM
3+
ARG TARGETPLATFORM
4+
ARG TARGETOS
5+
ARG TARGETARCH
6+
7+
ENV GOOS=$TARGETOS \
8+
GOARCH=$TARGETARCH \
9+
GOEXPERIMENT=boringcrypto \
10+
CGO_ENABLED=0
11+
12+
WORKDIR /workspace
13+
14+
# Install cross-compilation tools
15+
RUN apt-get update && apt-get install -y \
16+
gcc-x86-64-linux-gnu \
17+
g++-x86-64-linux-gnu \
18+
gcc-aarch64-linux-gnu \
19+
g++-aarch64-linux-gnu \
20+
libc6-dev-arm64-cross \
21+
libc6-dev-amd64-cross
22+
23+
24+
# Download dependencies first (better layer caching)
25+
COPY go.mod go.sum ./
26+
RUN go mod download
27+
28+
# Copy the app source code
29+
COPY . .
30+
31+
# Build the app for the target architecture
32+
RUN echo "Building keeper on $BUILDPLATFORM targeting $TARGETPLATFORM"
33+
RUN ./kubernetes/build.sh ${TARGETARCH} keeper
34+
35+
# Target distroless base image for CGO_ENABLED apps
36+
# This image includes a basic runtime environment with libc and other minimal dependencies
37+
FROM gcr.io/distroless/static AS keeper
38+
COPY --from=builder /workspace/keeper /keeper
39+
ENTRYPOINT ["/keeper"]

‎kubernetes/dockerfiles/nexus.Dockerfile‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
FROM --platform=$BUILDPLATFORM golang:1.24.1 AS builder
2+
ARG BUILDPLATFORM
3+
ARG TARGETPLATFORM
4+
ARG TARGETOS
5+
ARG TARGETARCH
6+
7+
ENV GOOS=$TARGETOS \
8+
GOARCH=$TARGETARCH \
9+
GOEXPERIMENT=boringcrypto \
10+
CGO_ENABLED=1
11+
12+
WORKDIR /workspace
13+
14+
# Install cross-compilation tools
15+
RUN apt-get update && apt-get install -y \
16+
gcc-x86-64-linux-gnu \
17+
g++-x86-64-linux-gnu \
18+
gcc-aarch64-linux-gnu \
19+
g++-aarch64-linux-gnu \
20+
libc6-dev-arm64-cross \
21+
libc6-dev-amd64-cross
22+
23+
24+
# Download dependencies first (better layer caching)
25+
COPY go.mod go.sum ./
26+
RUN go mod download
27+
28+
# Copy the app source code
29+
COPY . .
30+
31+
# Build the app for the target architecture
32+
RUN echo "Building nexus on $BUILDPLATFORM targeting $TARGETPLATFORM"
33+
RUN ./kubernetes/build.sh ${TARGETARCH} nexus
34+
35+
# Target distroless base image for CGO_ENABLED apps
36+
# This image includes a basic runtime environment with libc and other minimal dependencies
37+
FROM gcr.io/distroless/base AS nexus
38+
COPY --from=builder /workspace/nexus /nexus
39+
ENTRYPOINT ["/nexus"]

‎kubernetes/dockerfiles/spike.Dockerfile‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
FROM --platform=$BUILDPLATFORM golang:1.24.1 AS builder
2+
ARG BUILDPLATFORM
3+
ARG TARGETPLATFORM
4+
ARG TARGETOS
5+
ARG TARGETARCH
6+
7+
ENV GOOS=$TARGETOS \
8+
GOARCH=$TARGETARCH \
9+
GOEXPERIMENT=boringcrypto \
10+
CGO_ENABLED=0
11+
12+
WORKDIR /workspace
13+
14+
# Install cross-compilation tools
15+
RUN apt-get update && apt-get install -y \
16+
gcc-x86-64-linux-gnu \
17+
g++-x86-64-linux-gnu \
18+
gcc-aarch64-linux-gnu \
19+
g++-aarch64-linux-gnu \
20+
libc6-dev-arm64-cross \
21+
libc6-dev-amd64-cross
22+
23+
24+
# Download dependencies first (better layer caching)
25+
COPY go.mod go.sum ./
26+
RUN go mod download
27+
28+
# Copy the app source code
29+
COPY . .
30+
31+
# Build the app for the target architecture
32+
RUN echo "Building spike on $BUILDPLATFORM targeting $TARGETPLATFORM"
33+
RUN ./kubernetes/build.sh ${TARGETARCH} spike
34+
35+
# Target distroless base image for CGO_ENABLED apps
36+
# This image includes a basic runtime environment with libc and other minimal dependencies
37+
FROM gcr.io/distroless/static AS spike
38+
COPY --from=builder /workspace/spike /spike
39+
ENTRYPOINT ["/spike"]

0 commit comments

Comments
 (0)