Skip to content

Commit 917d755

Browse files
connorjwardconnorjward
authored
Build Docker images using root to avoid file permission issues (#4545)
1 parent 6b92a95 commit 917d755

File tree

3 files changed

+104
-43
lines changed

3 files changed

+104
-43
lines changed

‎.github/workflows/core.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -99,18 +99,6 @@ jobs:
9999
# Make sure the current directory is empty
100100
run: find . -delete
101101

102-
# Check that the Dockerfile is using the latest Ubuntu version.
103-
# The version is hardcoded into the Dockerfile so that the OS
104-
# for each release is fixed.
105-
- name: Check Dockerfile Ubuntu version
106-
run: |
107-
latest_version=$(grep "VERSION_ID=" /etc/os-release | cut -d '"' -f 2)
108-
docker_version=$(grep FROM docker/Dockerfile.vanilla | cut -d ':' -f 2)
109-
if [[ "$docker_version" != "$latest_version" ]]; then
110-
echo "Ubuntu version ${docker_version} in Dockerfile is out of date with latest version ${latest_version}"
111-
exit 1
112-
fi
113-
114102
# Use a different mirror to fetch apt packages from to get around
115103
# temporary outage.
116104
# (https://askubuntu.com/questions/1549622/problem-with-archive-ubuntu-com-most-of-the-servers-are-not-responding)
@@ -132,6 +120,20 @@ jobs:
132120
- name: Validate single source of truth
133121
run: ./firedrake-repo/scripts/check-config
134122

123+
# Check that the Dockerfile is using the latest Ubuntu version.
124+
# The version is hardcoded into the Dockerfile so that the OS
125+
# for each release is fixed.
126+
- name: Check Dockerfile Ubuntu version
127+
run: |
128+
latest_version=$(grep "VERSION_ID=" /etc/os-release | cut -d '"' -f 2)
129+
docker_version=$(grep FROM firedrake-repo/docker/Dockerfile.vanilla | cut -d ':' -f 2)
130+
echo "Latest version: $latest_version"
131+
echo "Docker version: $docker_version"
132+
if [[ "$docker_version" != "$latest_version" ]]; then
133+
echo "Ubuntu version ${docker_version} in Dockerfile is out of date with latest version ${latest_version}"
134+
exit 1
135+
fi
136+
135137
# Raise an error if any 'TODO RELEASE' comments remain
136138
- name: Check no 'TODO RELEASE' comments (release only)
137139
if: inputs.target_branch == 'release'

‎.github/workflows/docker_build.yml‎

Lines changed: 66 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,19 +46,73 @@ on:
4646
required: true
4747

4848
jobs:
49-
docker_build:
50-
name: "Build the ${{ inputs.target }} container"
51-
strategy:
52-
fail-fast: false
53-
runs-on: [self-hosted, "${{ inputs.os }}"]
49+
docker_build_linux:
50+
name: Build the ${{ inputs.target }} container (Linux)
51+
if: inputs.os == 'Linux'
52+
runs-on: [self-hosted, Linux]
53+
container: ubuntu:latest
5454
steps:
5555
- name: Pre-cleanup
5656
if: always()
57+
run: find . -delete
58+
59+
- name: Set up Docker
5760
run: |
58-
rm -rf ${{ runner.temp }}/digests
61+
apt-get update
62+
apt-get -y install docker.io
63+
64+
- name: Check out the repo
65+
uses: actions/checkout@v5
66+
67+
- name: Log in to Docker Hub
68+
uses: docker/login-action@v3
69+
with:
70+
username: ${{ secrets.DOCKERHUB_USER }}
71+
password: ${{ secrets.DOCKERHUB_TOKEN }}
72+
73+
- name: Set up Docker Buildx
74+
uses: docker/setup-buildx-action@v3
75+
76+
- name: Build and push ${{ inputs.target }}
77+
id: build
78+
uses: docker/build-push-action@v6
79+
with:
80+
platforms: ${{ inputs.platform }}
81+
file: ${{ inputs.dockerfile }}
82+
build-args: |
83+
ARCH=${{ inputs.arch }}
84+
BRANCH=${{ inputs.branch }}
85+
outputs: type=image,name=firedrakeproject/${{ inputs.target }},push-by-digest=true,name-canonical=true,push=true
86+
87+
- name: Export digest
88+
run: |
89+
: # Create a file in './digests' with name matching the pushed image hash
90+
mkdir digests
91+
digest="${{ steps.build.outputs.imageid }}"
92+
touch "digests/${digest#sha256:}"
93+
94+
- name: Upload digest
95+
uses: actions/upload-artifact@v4
96+
with:
97+
name: digests_${{ inputs.target }}_${{ inputs.os }}
98+
path: digests/*
99+
if-no-files-found: error
100+
retention-days: 1
101+
102+
- name: Post-cleanup
103+
if: always()
104+
run: find . -delete
105+
106+
docker_build_macos:
107+
name: Build the ${{ inputs.target }} container (macOS)
108+
if: inputs.os == 'macOS'
109+
runs-on: [self-hosted, macOS]
110+
steps:
111+
- name: Pre-cleanup
112+
if: always()
113+
run: find . -delete
59114

60115
- name: Add homebrew to PATH
61-
if: inputs.os == 'macOS'
62116
run: |
63117
: # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#adding-a-system-path
64118
echo "/opt/homebrew/bin" >> "$GITHUB_PATH"
@@ -88,21 +142,19 @@ jobs:
88142

89143
- name: Export digest
90144
run: |
91-
: # Create a file in <tempdir>/digests with name matching the pushed image hash
92-
rm -rf ${{ runner.temp }}/digests
93-
mkdir -p ${{ runner.temp }}/digests
145+
: # Create a file in digests with name matching the pushed image hash
146+
mkdir digests
94147
digest="${{ steps.build.outputs.imageid }}"
95-
touch "${{ runner.temp }}/digests/${digest#sha256:}"
148+
touch "digests/${digest#sha256:}"
96149
97150
- name: Upload digest
98151
uses: actions/upload-artifact@v4
99152
with:
100153
name: digests_${{ inputs.target }}_${{ inputs.os }}
101-
path: ${{ runner.temp }}/digests/*
154+
path: digests/*
102155
if-no-files-found: error
103156
retention-days: 1
104157

105158
- name: Post-cleanup
106159
if: always()
107-
run: |
108-
rm -rf ${{ runner.temp }}/digests
160+
run: find . -delete

‎.github/workflows/docker_merge.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,21 @@ on:
2828
jobs:
2929
docker_merge:
3030
runs-on: [self-hosted, Linux]
31+
container: ubuntu:latest
3132
steps:
3233
- name: Pre-cleanup
3334
if: always()
34-
run: rm -rf ${{ runner.temp }}/digests
35+
run: find . -delete
36+
37+
- name: Set up Docker
38+
run: |
39+
apt-get update
40+
apt-get -y install docker.io
3541
3642
- name: Download digests
3743
uses: actions/download-artifact@v4
3844
with:
39-
path: ${{ runner.temp }}/digests
45+
path: digests
4046
pattern: digests_${{ inputs.target }}_*
4147
merge-multiple: true
4248

@@ -49,26 +55,27 @@ jobs:
4955
- name: Set up Docker Buildx
5056
uses: docker/setup-buildx-action@v3
5157

52-
# NOTE: This action pushes a new image with the given tag but also updates
53-
# the 'latest' tag.
54-
- name: Merge and push the per-platform images
55-
working-directory: ${{ runner.temp }}/digests
58+
- name: Merge and push the per-platform images (release)
59+
if: inputs.tag_latest
60+
working-directory: digests
61+
run: |
62+
docker buildx imagetools create \
63+
-t firedrakeproject/${{ inputs.target }}:${{ inputs.tag }} \
64+
-t firedrakeproject/${{ inputs.target }}:latest \
65+
$(printf "firedrakeproject/${{ inputs.target }}@sha256:%s " *)
66+
67+
- name: Merge and push the per-platform images (dev)
68+
if: ${{ ! inputs.tag_latest }}
69+
working-directory: digests
5670
run: |
57-
if [[ "${{ inputs.tag_latest }}" == "true" ]]; then
58-
docker buildx imagetools create \
59-
-t firedrakeproject/${{ inputs.target }}:${{ inputs.tag }} \
60-
-t firedrakeproject/${{ inputs.target }}:latest \
61-
$(printf "firedrakeproject/${{ inputs.target }}@sha256:%s " *)
62-
else
63-
docker buildx imagetools create \
64-
-t firedrakeproject/${{ inputs.target }}:${{ inputs.tag }} \
65-
$(printf "firedrakeproject/${{ inputs.target }}@sha256:%s " *)
66-
fi
71+
docker buildx imagetools create \
72+
-t firedrakeproject/${{ inputs.target }}:${{ inputs.tag }} \
73+
$(printf "firedrakeproject/${{ inputs.target }}@sha256:%s " *)
6774
6875
- name: Inspect image
6976
run: |
7077
docker buildx imagetools inspect firedrakeproject/${{ inputs.target }}:${{ inputs.tag }}
7178
7279
- name: Post-cleanup
7380
if: always()
74-
run: rm -rf ${{ runner.temp }}/digests
81+
run: find . -delete

0 commit comments

Comments
 (0)