Rewrite Dockerfile and Circle for tagged builds

Our versioning is now based on git tags, rather than commit hashes on the `release` branch, and our Circle config and Docker setup both needed to be modified significantly to accomodate that.

Author: Mr0grog

.circleci/config.yml

@@ -1,4 +1,4 @@
-version: 2
+version: 2.1
 jobs:
   build:
     working_directory: ~/web-monitoring-diff
@@ -55,12 +55,12 @@ jobs:
     steps:
       - checkout
       - run: |
-          docker build -t envirodgi/web-monitoring-diff:$CIRCLE_SHA1 .
+          docker build -t envirodgi/web-monitoring-diff:${CIRCLE_SHA1} .
       - run:
           name: Save Image
           command: |
             mkdir /tmp/workspace
-            docker save --output /tmp/workspace/docker-image envirodgi/web-monitoring-diff:$CIRCLE_SHA1
+            docker save --output /tmp/workspace/docker-image envirodgi/web-monitoring-diff:${CIRCLE_SHA1}
       - persist_to_workspace:
           root: /tmp/workspace
           paths:
@@ -76,30 +76,50 @@ jobs:
           command: docker load --input /tmp/workspace/docker-image
       - run:
           name: Re-tag Image
-          command: docker image tag envirodgi/web-monitoring-diff:$CIRCLE_SHA1 envirodgi/web-monitoring-diff:latest
+          command: |
+            if [ -n "${CIRCLE_TAG}" ]; then
+                docker image tag envirodgi/web-monitoring-diff:${CIRCLE_SHA1} envirodgi/web-monitoring-diff:${CIRCLE_TAG:1}
+                docker image tag envirodgi/web-monitoring-diff:${CIRCLE_SHA1} envirodgi/web-monitoring-diff:latest
+            fi
       - run:
           name: Publish to Docker Hub
           command: |
             docker login -u $DOCKER_USER -p $DOCKER_PASS
-            docker push envirodgi/web-monitoring-diff:$CIRCLE_SHA1
-            docker push envirodgi/web-monitoring-diff:latest
+            docker push envirodgi/web-monitoring-diff:${CIRCLE_SHA1}
+            if [ -n "${CIRCLE_TAG}" ]; then
+                docker push envirodgi/web-monitoring-diff:${CIRCLE_TAG:1}
+                docker push envirodgi/web-monitoring-diff:latest
+            fi
 
 workflows:
-  version: 2
   build:
     jobs:
-      - build
-      - build_docker
-      # XXX: Temporarily disable while in the middle of extracting this package
-      # For this repo, we should probably publish based on tags:
+      # NOTE: because publishing runs on tags, we have to make sure all jobs
+      # it depends on also run on tags (by default, jobs do not run on tags,
+      # only branches).
+      #
+      # Also: {filters: {tags: {only: ...}}} may look deceiving, like it's only
+      # running for the tags. But what's actually happening here is that
+      # branches aren't being filtered (only tags are), so it's running for
+      # *all* branches and also for tags that start with "v".
+      #
+      # See more in:
       # https://circleci.com/docs/2.0/workflows/#executing-workflows-for-a-git-tag
-      # Use $CIRCLE_TAG to identify the tag being used:
-      # https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables
-      # - publish_docker:
-      #     requires:
-      #       - build
-      #       - build_docker
-      #     filters:
-      #       branches:
-      #         only:
-      #           - release
+      - build:
+          filters:
+            tags:
+              only: /^v.*/
+      - build_docker:
+          filters:
+            tags:
+              only: /^v.*/
+      # Publishing only happens for tags starting with "v", and no branches.
+      - publish_docker:
+          requires:
+            - build
+            - build_docker
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^v.*/

.dockerignore

@@ -1,2 +1,8 @@
 .env
-.git/
+
+# DO NOT IGNORE .git!
+# We use Versioneer set package version information from git tags, so .git must
+# be available for it to work. We handle cleaning up the container for release
+# by having a multi-stage build, where the final container image only includes
+# the built package.
+# .git/

.editorconfig

@@ -9,3 +9,6 @@ max_line_length = 79
 
 [*.rst]
 indent_size = 2
+
+[*.{yaml,yml}]
+indent_size = 2

Dockerfile

@@ -1,14 +1,34 @@
-# Use an official Python runtime as a parent image
-FROM python:3.7-slim
+##
+# `base` contains the only the core system-level dependencies needed to run
+# the diff server. `dev` builds on it by adding compile-time support for the
+# same packages so that we can build the Python dependencies that have C code,
+# like `lxml`.
+# We separate them out so that the final `release` image can layer on top of
+# this one without needing compiler-related packages.
+##
+FROM python:3.7-slim as base
 LABEL maintainer="[email protected]"
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git gcc g++ pkg-config libxml2-dev libxslt-dev libz-dev \
-    libssl-dev openssl libcurl4-openssl-dev
+    libxml2 libxslt1.1 libz1 openssl libcurl4
+
+
+##
+# `dev` is an intermediate image that is used for building compiled
+# dependencies or can be used as a development environment if you want to work
+# in a Docker container.
+##
+FROM base as dev
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git gcc g++ pkg-config \
+    # Compiler-support for the system dependencies in `base`
+    libxml2-dev libxslt-dev libz-dev libssl-dev libcurl4-openssl-dev
 
 # Set the working directory to /app
 WORKDIR /app
 
+RUN pip install --upgrade pip
 # Copy the requirements.txt alone into the container at /app
 # so that they can be cached more aggressively than the rest of the source.
 ADD requirements.txt /app
@@ -20,12 +40,22 @@ RUN pip install --trusted-host pypi.python.org -r requirements-experimental.txt
 
 # Copy the rest of the source.
 ADD . /app
+# ...and install!
+RUN pip install .[server] --no-binary lxml
 
-# Install package.
-RUN pip install .
 
-# Make port 80 available to the world outside this container.
-EXPOSE 80
+##
+# `release` is the final, release-ready image with only the necessary
+# dependencies to run all diffs and the diff server.
+##
+FROM base as release
+
+# Copy built python dependencies.
+COPY --from=dev /usr/local/lib/ /usr/local/lib/
+# Copy executables.
+COPY --from=dev /usr/local/bin /usr/local/bin
 
-# Run server on port 80 when the container launches.
-CMD ["web-monitoring-diff-server", "80"]
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+EXPOSE 80
+CMD ["web-monitoring-diff-server", "--port", "80"]