Refactor Images to Multi-Stage Builds #55
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Snyk Container found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
There was a problem hiding this comment.
Pull Request Overview
Refactors all container images to multi-stage builds, introducing non-root execution and shared build patterns.
- Adds builder/final stages across Dockerfiles with ARG-driven configuration.
- Introduces new helper scripts (e.g., installAutomake.sh) and build tooling (Makefile, metadata labels).
- Updates documentation (README) and adds license and Dependabot configuration.
Reviewed Changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 24 comments.
Show a summary per file
| File | Description |
|---|---|
| r-shiny/installAutomake.sh | New Automake install script used in shiny builder stage. |
| r-shiny/Dockerfile | Converted to multi-stage build; installs system deps, Automake, Shiny packages, copies built library. |
| r-model/Dockerfile | Multi-stage build for modeling stack (rstan, prophet). |
| r-geos/Dockerfile | Multi-stage build for geospatial stack; system libs and R packages. |
| r-batch/aws.config | Removed AWS config file (now handled differently). |
| r-batch/Dockerfile | Multi-stage build; adds AWS CLI, Java, database libs, R packages, final stage artifact copying. |
| r-base/installAutomake.sh | Adjusted fetch URL and chaining style for Automake install. |
| r-base/Dockerfile | Major refactor to multi-stage; user creation, system deps, R config, artifact promotion. |
| README.md | Updated descriptions, versions, and multi-stage notes. |
| Makefile | New build orchestration and version update automation. |
| LICENSE | Added GPL-2.0-or-later license text. |
| Jenkinsfile | Adds OCI labels (revision, created) during builds. |
| .github/dependabot.yml | Adds Dependabot config for r-base Dockerfile updates. |
Comments suppressed due to low confidence (2)
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 13 out of 13 changed files in this pull request and generated 9 comments.
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| FROM inwt/r-batch:${R_VERSION} | ||
|
|
||
| LABEL org.opencontainers.image.authors="Sebastian Warnholz, Jan Abel" \ | ||
| org.opencontainers.image.created="BUILD_DATE_TIME_PLACEHOLDER" \ | ||
| org.opencontainers.image.description="Build upon inwt/r-batch with Shiny & deps for web applications" \ | ||
| org.opencontainers.image.licenses="GPL-2.0-or-later" \ | ||
| org.opencontainers.image.revision="GIT_SHA_PLACEHOLDER" \ | ||
| org.opencontainers.image.source="https://github.com/INWTlab/r-docker" \ | ||
| org.opencontainers.image.title="inwt/r-base" \ | ||
| org.opencontainers.image.vendor="INWT Statistics" \ | ||
| org.opencontainers.image.version="${R_VERSION}" | ||
|
|
||
| # 1. Environment, Ports & User Setup | ||
| ARG USER_NAME | ||
| EXPOSE 3838 | ||
| ENV HOME=/app | ||
|
|
||
| # 2. Copy Artifacts from builder stage | ||
| COPY --from=shiny-builder /usr/local/lib/R/site-library/ /usr/local/lib/R/site-library/ | ||
|
|
There was a problem hiding this comment.
Runtime system libraries (libudunits2, libgdal, xdg-utils, automake binaries) installed only in the builder stage are not present in the final stage, so compiled packages (e.g. leaflet, sf dependencies, or others using GDAL/UDUNITS) may fail to load due to missing shared objects. Re-install the required runtime (non -dev if possible) libraries in this final stage or move their installation to this stage while keeping only build-only deps (e.g. -dev headers, automake for compilation) in the builder.
| FROM inwt/r-batch:${R_VERSION} | ||
|
|
||
| LABEL org.opencontainers.image.authors="Sebastian Warnholz, Jan Abel" \ | ||
| org.opencontainers.image.created="BUILD_DATE_TIME_PLACEHOLDER" \ | ||
| org.opencontainers.image.description="Build upon inwt/r-batch with rstan and prophet for modeling" \ | ||
| org.opencontainers.image.licenses="GPL-2.0-or-later" \ | ||
| org.opencontainers.image.revision="GIT_SHA_PLACEHOLDER" \ | ||
| org.opencontainers.image.source="https://github.com/INWTlab/r-docker" \ | ||
| org.opencontainers.image.title="inwt/r-model" \ | ||
| org.opencontainers.image.vendor="INWT Statistics" \ | ||
| org.opencontainers.image.version="${R_VERSION}" |
There was a problem hiding this comment.
rstan/prophet were built against system libraries (e.g. libnode-dev for V8 / HTTP handling) added only in the builder stage; those libraries are not present in the final stage, which can cause runtime linkage errors. Install the required runtime packages again (using non -dev variants if available) in this final stage or keep them in a shared base layer.
| FROM inwt/r-batch:${R_VERSION} | ||
|
|
||
| LABEL org.opencontainers.image.authors="Sebastian Warnholz, Jan Abel" \ | ||
| org.opencontainers.image.created="BUILD_DATE_TIME_PLACEHOLDER" \ | ||
| org.opencontainers.image.description="Build upon inwt/r-batch for geospatial data processing with GDAL" \ | ||
| org.opencontainers.image.licenses="GPL-2.0-or-later" \ | ||
| org.opencontainers.image.revision="GIT_SHA_PLACEHOLDER" \ | ||
| org.opencontainers.image.source="https://github.com/INWTlab/r-docker" \ | ||
| org.opencontainers.image.title="inwt/r-geos" \ | ||
| org.opencontainers.image.vendor="INWT Statistics" \ | ||
| org.opencontainers.image.version="${R_VERSION}" |
There was a problem hiding this comment.
Geospatial packages (sf, stars, terra, raster) need GDAL/GEOS/PROJ/UDUNITS shared libs at runtime, but those were installed only in the builder stage and are absent here. Re-install runtime libraries (prefer non -dev variants like libgdal30, libgeos-c1, libprojNN, libudunits2) in this final stage or split build vs runtime dependencies properly.
| FROM inwt/r-base:${R_VERSION} | ||
|
|
||
| LABEL org.opencontainers.image.authors="Sebastian Warnholz, Jan Abel" \ | ||
| org.opencontainers.image.created="BUILD_DATE_TIME_PLACEHOLDER" \ | ||
| org.opencontainers.image.description="Build Upon inwt/r-base with AWS CLI, Java and R Packages" \ | ||
| org.opencontainers.image.licenses="GPL-2.0-or-later" \ | ||
| org.opencontainers.image.revision="GIT_SHA_PLACEHOLDER" \ | ||
| org.opencontainers.image.source="https://github.com/INWTlab/r-docker" \ | ||
| org.opencontainers.image.title="inwt/r-batch" \ | ||
| org.opencontainers.image.vendor="INWT Statistics" \ | ||
| org.opencontainers.image.version="${R_VERSION}" |
There was a problem hiding this comment.
openjdk-8-jdk and other system libs (e.g. libmysqlclient-dev, libpq-dev) used for building packages are not installed in this final runtime stage; packages relying on Java (rJava, Arrow with JNI) or DB connectors may fail to load. Install the necessary runtime components (JRE/JDK + required libs) here or move them to a shared base final layer.
see #54