From 3f894604bbbedb97d81667d85110d43095cf2a77 Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Fri, 14 Jan 2022 13:05:16 -0800 Subject: [PATCH 1/7] Fix broken docker builds --- .github/workflows/build.yml | 7 +++++- .release/ci.hcl | 3 ++- .../linux/package/etc/consul.d/consul.env | 0 Dockerfile | 24 +++++++++++++++++-- 4 files changed, 30 insertions(+), 4 deletions(-) create mode 100644 .release/linux/package/etc/consul.d/consul.env diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 850f2b9b55..5d52c0f0df 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -4,7 +4,8 @@ on: push: # Sequence of patterns matched against refs/heads branches: [ - "main" + "main", + "fix-broken-dockerfile", // just needed for testing, remove before merge ] env: @@ -241,6 +242,10 @@ jobs: steps: - uses: actions/checkout@v2 + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 + with: + platforms: all - name: Docker Build (Action) uses: hashicorp/actions-docker-build@v1 with: diff --git a/.release/ci.hcl b/.release/ci.hcl index b248590b83..e795bb7677 100644 --- a/.release/ci.hcl +++ b/.release/ci.hcl @@ -14,7 +14,8 @@ project "consul" { "release/1.8.x", "release/1.9.x", "release/1.10.x", - "release/1.11.x" + "release/1.11.x", + "fix-broken-dockerfile", // just needed for testing, remove before merge ] } } diff --git a/.release/linux/package/etc/consul.d/consul.env b/.release/linux/package/etc/consul.d/consul.env new file mode 100644 index 0000000000..e69de29bb2 diff --git a/Dockerfile b/Dockerfile index 8d5931e91c..27ba2bbc98 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # This Dockerfile creates a production release image for the project using crt release flow. -FROM alpine:3.13 as default +FROM alpine:3.15.0 as default ARG VERSION ARG BIN_NAME @@ -24,7 +24,23 @@ LABEL org.opencontainers.image.authors="Consul Team " \ org.opencontainers.image.title="consul" \ org.opencontainers.image.description="Consul is a datacenter runtime that provides service discovery, configuration, and orchestration." -RUN apk add --no-cache dumb-init +# Set up certificates and base tools. +# libc6-compat is needed to symlink the shared libraries for ARM builds +RUN apk update +RUN apk add -v --no-cache \ + dumb-init \ + libc6-compat \ + iptables \ + tzdata \ + curl \ + ca-certificates \ + gnupg \ + iputils \ + libcap \ + openssl \ + su-exec \ + jq + # Create a consul user and group first so the IDs get set the same way, even as # the rest of this may change over time. RUN addgroup $BIN_NAME && \ @@ -36,6 +52,10 @@ RUN mkdir -p /consul/data && \ mkdir -p /consul/config && \ chown -R consul:consul /consul +# Set up nsswitch.conf for Go's "netgo" implementation which is used by Consul, +# otherwise DNS supercedes the container's hosts file, which we don't want. +RUN test -e /etc/nsswitch.conf || echo 'hosts: files dns' > /etc/nsswitch.conf + # Expose the consul data directory as a volume since there's mutable state in there. VOLUME /consul/data From 6600cf478713a32fe022544403fdaaf1291c8d9d Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Tue, 25 Jan 2022 17:09:42 -0800 Subject: [PATCH 2/7] Add docker target that pulls from releases.hashicorp.com --- Dockerfile | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 114 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 27ba2bbc98..7185f6f2a7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,17 +1,126 @@ -# This Dockerfile creates a production release image for the project using crt release flow. -FROM alpine:3.15.0 as default +# This Dockerfile contains multiple targets. +# Use 'docker build --target= .' to build one. +# e.g. `docker build --target=dev .` +# +# All non-dev targets have a VERSION argument that must be provided +# via --build-arg=VERSION= when building. +# e.g. --build-arg=1.11.2 +# +# `default` is the production docker image which cannot be built locally. +# For local dev and testing purposes, please build and use the `dev` docker image. + + +# Official docker image that includes binaries from releases.hashicorp.com. This +# downloads the release from releases.hashicorp.com and therefore requires that +# the release is published before building the Docker image. +FROM alpine:3.13 as official + +# This is the release of Consul to pull in. +ARG VERSION + +LABEL org.opencontainers.image.authors="Consul Team " \ + org.opencontainers.image.url="https://www.consul.io/" \ + org.opencontainers.image.documentation="https://www.consul.io/docs" \ + org.opencontainers.image.source="https://github.com/hashicorp/consul" \ + org.opencontainers.image.version=$VERSION \ + org.opencontainers.image.vendor="HashiCorp" \ + org.opencontainers.image.title="consul" \ + org.opencontainers.image.description="Consul is a datacenter runtime that provides service discovery, configuration, and orchestration." + +# This is the location of the releases. +ENV HASHICORP_RELEASES=https://releases.hashicorp.com + +# Create a consul user and group first so the IDs get set the same way, even as +# the rest of this may change over time. +RUN addgroup consul && \ + adduser -S -G consul consul + +# Set up certificates, base tools, and Consul. +# libc6-compat is needed to symlink the shared libraries for ARM builds +RUN set -eux && \ + apk add --no-cache ca-certificates curl dumb-init gnupg libcap openssl su-exec iputils jq libc6-compat iptables tzdata && \ + gpg --keyserver keyserver.ubuntu.com --recv-keys C874011F0AB405110D02105534365D9472D7468F && \ + mkdir -p /tmp/build && \ + cd /tmp/build && \ + apkArch="$(apk --print-arch)" && \ + case "${apkArch}" in \ + aarch64) consulArch='arm64' ;; \ + armhf) consulArch='arm' ;; \ + x86) consulArch='386' ;; \ + x86_64) consulArch='amd64' ;; \ + *) echo >&2 "error: unsupported architecture: ${apkArch} (see ${HASHICORP_RELEASES}/consul/${VERSION}/)" && exit 1 ;; \ + esac && \ + wget ${HASHICORP_RELEASES}/consul/${VERSION}/consul_${VERSION}_linux_${consulArch}.zip && \ + wget ${HASHICORP_RELEASES}/consul/${VERSION}/consul_${VERSION}_SHA256SUMS && \ + wget ${HASHICORP_RELEASES}/consul/${VERSION}/consul_${VERSION}_SHA256SUMS.sig && \ + gpg --batch --verify consul_${VERSION}_SHA256SUMS.sig consul_${VERSION}_SHA256SUMS && \ + grep consul_${VERSION}_linux_${consulArch}.zip consul_${VERSION}_SHA256SUMS | sha256sum -c && \ + unzip -d /tmp/build consul_${VERSION}_linux_${consulArch}.zip && \ + cp /tmp/build/consul /bin/consul && \ + if [ -f /tmp/build/EULA.txt ]; then mkdir -p /usr/share/doc/consul; mv /tmp/build/EULA.txt /usr/share/doc/consul/EULA.txt; fi && \ + if [ -f /tmp/build/TermsOfEvaluation.txt ]; then mkdir -p /usr/share/doc/consul; mv /tmp/build/TermsOfEvaluation.txt /usr/share/doc/consul/TermsOfEvaluation.txt; fi && \ + cd /tmp && \ + rm -rf /tmp/build && \ + gpgconf --kill all && \ + apk del gnupg openssl && \ + rm -rf /root/.gnupg && \ +# tiny smoke test to ensure the binary we downloaded runs + consul version + +# The /consul/data dir is used by Consul to store state. The agent will be started +# with /consul/config as the configuration directory so you can add additional +# config files in that location. +RUN mkdir -p /consul/data && \ + mkdir -p /consul/config && \ + chown -R consul:consul /consul + +# set up nsswitch.conf for Go's "netgo" implementation which is used by Consul, +# otherwise DNS supercedes the container's hosts file, which we don't want. +RUN test -e /etc/nsswitch.conf || echo 'hosts: files dns' > /etc/nsswitch.conf + +# Expose the consul data directory as a volume since there's mutable state in there. +VOLUME /consul/data + +# Server RPC is used for communication between Consul clients and servers for internal +# request forwarding. +EXPOSE 8300 + +# Serf LAN and WAN (WAN is used only by Consul servers) are used for gossip between +# Consul agents. LAN is within the datacenter and WAN is between just the Consul +# servers in all datacenters. +EXPOSE 8301 8301/udp 8302 8302/udp + +# HTTP and DNS (both TCP and UDP) are the primary interfaces that applications +# use to interact with Consul. +EXPOSE 8500 8600 8600/udp + +# Consul doesn't need root privileges so we run it as the consul user from the +# entry point script. The entry point script also uses dumb-init as the top-level +# process to reap any zombie processes created by Consul sub-processes. +COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh +ENTRYPOINT ["docker-entrypoint.sh"] + +# By default you'll get an insecure single-node development server that stores +# everything in RAM, exposes a web UI and HTTP endpoints, and bootstraps itself. +# Don't use this configuration for production. +CMD ["agent", "-dev", "-client", "0.0.0.0"] + + +# Production docker image that uses CI built binaries. +# Remember, this image cannot be built locally. +FROM alpine:3.13 as default ARG VERSION ARG BIN_NAME -# PRODUCT_NAME and PRODUCT_VERSION are the name of the software in releases.hashicorp.com +# PRODUCT_NAME and PRODUCT_VERSION are the name of the software on releases.hashicorp.com # and the version to download. Example: PRODUCT_NAME=consul PRODUCT_VERSION=1.2.3. ENV BIN_NAME=$BIN_NAME ENV VERSION=$VERSION -#ARG CONSUL_VERSION=$VERSION -#ARG PRODUCT_VERSION + ARG PRODUCT_REVISION ARG PRODUCT_NAME=$BIN_NAME + # TARGETOS and TARGETARCH are set automatically when --platform is provided. ARG TARGETOS TARGETARCH @@ -26,7 +135,6 @@ LABEL org.opencontainers.image.authors="Consul Team " \ # Set up certificates and base tools. # libc6-compat is needed to symlink the shared libraries for ARM builds -RUN apk update RUN apk add -v --no-cache \ dumb-init \ libc6-compat \ From ec3cf44240a0d5d48534f3b0b9edf4a775726b3f Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Tue, 25 Jan 2022 17:10:39 -0800 Subject: [PATCH 3/7] Remove testing build trigger --- .github/workflows/build.yml | 1 - .release/ci.hcl | 1 - 2 files changed, 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5d52c0f0df..6e2b3ef3a7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,7 +5,6 @@ on: # Sequence of patterns matched against refs/heads branches: [ "main", - "fix-broken-dockerfile", // just needed for testing, remove before merge ] env: diff --git a/.release/ci.hcl b/.release/ci.hcl index e795bb7677..3ada784f03 100644 --- a/.release/ci.hcl +++ b/.release/ci.hcl @@ -15,7 +15,6 @@ project "consul" { "release/1.9.x", "release/1.10.x", "release/1.11.x", - "fix-broken-dockerfile", // just needed for testing, remove before merge ] } } From 987e9d32582d59d4909ece4d712ed83bf931ea9b Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Tue, 25 Jan 2022 18:55:20 -0800 Subject: [PATCH 4/7] Remove trailing ,'s to keep commit history clean --- .github/workflows/build.yml | 2 +- .release/ci.hcl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6e2b3ef3a7..6f0989239b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -4,7 +4,7 @@ on: push: # Sequence of patterns matched against refs/heads branches: [ - "main", + "main" ] env: diff --git a/.release/ci.hcl b/.release/ci.hcl index 3ada784f03..b248590b83 100644 --- a/.release/ci.hcl +++ b/.release/ci.hcl @@ -14,7 +14,7 @@ project "consul" { "release/1.8.x", "release/1.9.x", "release/1.10.x", - "release/1.11.x", + "release/1.11.x" ] } } From da462557237646a5c549f9a457ace79e4ca291dd Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Wed, 26 Jan 2022 11:24:56 -0800 Subject: [PATCH 5/7] Update Dockerfile Co-authored-by: Evan Culver --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 7185f6f2a7..a7aeefe0d0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # # All non-dev targets have a VERSION argument that must be provided # via --build-arg=VERSION= when building. -# e.g. --build-arg=1.11.2 +# e.g. --build-arg VERSION=1.11.2 # # `default` is the production docker image which cannot be built locally. # For local dev and testing purposes, please build and use the `dev` docker image. From 5942e474cf899bd61fd6e94a8ff2079a22b4db45 Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Wed, 2 Feb 2022 17:41:56 -0800 Subject: [PATCH 6/7] Use docker mirror --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index a7aeefe0d0..3e365e117a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ # Official docker image that includes binaries from releases.hashicorp.com. This # downloads the release from releases.hashicorp.com and therefore requires that # the release is published before building the Docker image. -FROM alpine:3.13 as official +FROM docker.mirror.hashicorp.services/alpine:3.13 as official # This is the release of Consul to pull in. ARG VERSION @@ -108,7 +108,7 @@ CMD ["agent", "-dev", "-client", "0.0.0.0"] # Production docker image that uses CI built binaries. # Remember, this image cannot be built locally. -FROM alpine:3.13 as default +FROM docker.mirror.hashicorp.services/alpine:3.13 as default ARG VERSION ARG BIN_NAME From 0827c9422227720752d421eada1cf74c71685486 Mon Sep 17 00:00:00 2001 From: Michele Degges Date: Thu, 3 Feb 2022 13:10:42 -0800 Subject: [PATCH 7/7] chmod +x on the sh file --- .release/docker/docker-entrypoint.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 .release/docker/docker-entrypoint.sh diff --git a/.release/docker/docker-entrypoint.sh b/.release/docker/docker-entrypoint.sh old mode 100644 new mode 100755