Skip to content

Commit 81e292b

Browse files
ammarioammario
authored
Add dogfood image (#3350)
1 parent 8bcf23e commit 81e292b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+577
-3
lines changed

‎.github/workflows/dogfood.yaml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: dogfood
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
tags:
8+
- "*"
9+
paths:
10+
- "dogfood/**"
11+
pull_request:
12+
paths:
13+
- "dogfood/**"
14+
workflow_dispatch:
15+
16+
jobs:
17+
deploy:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Get branch name
21+
id: branch-name
22+
uses: tj-actions/branch-names@v5.4
23+
24+
- name: Set up QEMU
25+
uses: docker/setup-qemu-action@v2
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@v2
29+
30+
- name: Login to DockerHub
31+
uses: docker/login-action@v2
32+
with:
33+
username: ${{ secrets.DOCKERHUB_USERNAME }}
34+
password: ${{ secrets.DOCKERHUB_PASSWORD }}
35+
36+
- name: Build and push
37+
uses: docker/build-push-action@v3
38+
with:
39+
context: "{{defaultContext}}:dogfood"
40+
push: true
41+
tags: "codercom/oss-dogfood:${{ steps.branch-name.outputs.current_branch }},codercom/oss-dogfood:latest"
42+
cache-from: type=registry,ref=codercom/oss-dogfood:latest
43+
cache-to: type=inline

‎dogfood/Dockerfile

+310
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,310 @@
1+
FROM rust:slim AS rust-utils
2+
# Install rust helper programs
3+
# ENV CARGO_NET_GIT_FETCH_WITH_CLI=true
4+
env CARGO_INSTALL_ROOT=/tmp/
5+
RUN cargo install exa bat ripgrep typos-cli
6+
7+
FROM ubuntu AS go
8+
9+
RUN apt-get update && apt-get install --yes curl gcc
10+
# Install Go manually, so that we can control the version
11+
ARG GOBORING_VERSION=1.18b7
12+
RUN mkdir --parents /usr/local/go /usr/local/goboring
13+
14+
# Boring Go is needed to build FIPS-compliant binaries.
15+
RUN curl --silent --show-error --location \
16+
"https://storage.googleapis.com/go-boringcrypto/go${GOBORING_VERSION}.linux-amd64.tar.gz" \
17+
-o /usr/local/goboring.tar.gz
18+
19+
RUN tar --extract --gzip --directory=/usr/local/goboring --file=/usr/local/goboring.tar.gz --strip-components=1 && \
20+
ln -s /usr/local/goboring/bin/go /usr/local/bin/go
21+
22+
# Install Go utilities.
23+
ARG GOPATH="/tmp/"
24+
RUN mkdir --parents "$GOPATH" && \
25+
# moq for Go tests.
26+
go install github.com/matryer/moq@v0.2.3 && \
27+
# swag for Swagger doc generation
28+
go install github.com/swaggo/swag/cmd/swag@v1.7.4 && \
29+
# go-swagger tool to generate the go coder api client
30+
go install github.com/go-swagger/go-swagger/cmd/swagger@v0.28.0 && \
31+
# goimports for updating imports
32+
go install golang.org/x/tools/cmd/goimports@v0.1.7 && \
33+
# protoc-gen-go is needed to build sysbox from source
34+
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.26 && \
35+
# drpc support for v2
36+
go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.26 && \
37+
# migrate for migration support for v2
38+
go install github.com/golang-migrate/migrate/v4/cmd/migrate@v4.15.1 && \
39+
# goreleaser for compiling v2 binaries
40+
go install github.com/goreleaser/goreleaser@v1.6.1 && \
41+
# Install the latest version of gopls for editors that support
42+
# the language server protocol
43+
go install golang.org/x/tools/gopls@latest && \
44+
# gotestsum makes test output more readable
45+
go install gotest.tools/gotestsum@v1.7.0 && \
46+
# goveralls collects code coverage metrics from tests
47+
# and sends to Coveralls
48+
go install github.com/mattn/goveralls@v0.0.11 && \
49+
# kind for running Kubernetes-in-Docker, needed for tests
50+
go install sigs.k8s.io/kind@v0.10.0 && \
51+
# helm-docs generates our Helm README based on a template and the
52+
# charts and values files
53+
go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.5.0 && \
54+
# sqlc for Go code generation
55+
go install github.com/kyleconroy/sqlc/cmd/sqlc@v1.10.0 && \
56+
# gcr-cleaner-cli used by CI to prune unused images
57+
go install github.com/sethvargo/gcr-cleaner/cmd/gcr-cleaner-cli@v0.5.1 && \
58+
# ruleguard for checking custom rules, without needing to run all of
59+
# golangci-lint. Check the go.mod in the release of golangci-lint that
60+
# we're using for the version of go-critic that it embeds, then check
61+
# the version of ruleguard in go-critic for that tag.
62+
go install github.com/quasilyte/go-ruleguard/cmd/ruleguard@v0.3.13 && \
63+
# go-fuzz for fuzzy testing. they don't publish releases so we rely on latest.
64+
go install github.com/dvyukov/go-fuzz/go-fuzz@latest && \
65+
go install github.com/dvyukov/go-fuzz/go-fuzz-build@latest && \
66+
# go-releaser for building 'fat binaries' that work cross-platform
67+
go install github.com/goreleaser/goreleaser@v1.6.1
68+
69+
# Ubuntu 20.04 LTS (Focal Fossa)
70+
FROM ubuntu:focal
71+
72+
SHELL ["/bin/bash", "-c"]
73+
74+
# Updated certificates are necessary to use the teraswitch mirror.
75+
# This must be ran before copying in configuration since the config replaces
76+
# the default mirror with teraswitch.
77+
RUN apt-get update && apt-get install --yes ca-certificates
78+
79+
COPY files /
80+
81+
# Install packages from apt repositories
82+
ARG DEBIAN_FRONTEND="noninteractive"
83+
84+
RUN apt-get update --quiet && apt-get install --yes \
85+
apt-transport-https \
86+
apt-utils \
87+
bash \
88+
bash-completion \
89+
bats \
90+
bind9-dnsutils \
91+
build-essential \
92+
ca-certificates \
93+
crypto-policies \
94+
curl \
95+
fd-find \
96+
file \
97+
git \
98+
gnupg \
99+
graphviz \
100+
htop \
101+
httpie \
102+
inetutils-tools \
103+
iproute2 \
104+
iputils-ping \
105+
iputils-tracepath \
106+
jq \
107+
language-pack-en \
108+
less \
109+
lsb-release \
110+
man \
111+
meld \
112+
net-tools \
113+
openjdk-11-jdk-headless \
114+
openssh-server \
115+
openssl \
116+
pkg-config \
117+
protobuf-compiler \
118+
python3 \
119+
python3-pip \
120+
rsync \
121+
shellcheck \
122+
strace \
123+
sudo \
124+
tcptraceroute \
125+
termshark \
126+
traceroute \
127+
vim \
128+
wget \
129+
xauth \
130+
zip \
131+
ncdu \
132+
cargo \
133+
asciinema \
134+
zsh \
135+
ansible \
136+
neovim \
137+
google-cloud-sdk \
138+
google-cloud-sdk-datastore-emulator \
139+
kubectl \
140+
postgresql-11 \
141+
containerd.io \
142+
docker-ce \
143+
docker-ce-cli \
144+
packer \
145+
terraform \
146+
buildah \
147+
conmon \
148+
containernetworking-plugins \
149+
crun \
150+
podman \
151+
skopeo \
152+
gh && \
153+
# Delete package cache to avoid consuming space in layer
154+
apt-get clean && \
155+
# Configure FIPS-compliant policies
156+
update-crypto-policies --set FIPS
157+
158+
# Install frontend utilities
159+
RUN apt-get update && \
160+
# Node.js (from nodesource) and Yarn (from yarnpkg)
161+
apt-get install --yes --quiet \
162+
nodejs yarn \
163+
# Install browsers for e2e testing
164+
google-chrome-stable microsoft-edge-beta && \
165+
# Pre-install system dependencies that Playwright needs. npx doesn't work here
166+
# for some reason. See https://github.com/microsoft/playwright-cli/issues/136
167+
npm i -g playwright@1.19.1 && playwright install-deps
168+
169+
# Ensure PostgreSQL binaries are in the users $PATH.
170+
RUN update-alternatives --install /usr/local/bin/initdb initdb /usr/lib/postgresql/11/bin/initdb 100 && \
171+
update-alternatives --install /usr/local/bin/postgres postgres /usr/lib/postgresql/11/bin/postgres 100
172+
173+
# Create links for injected dependencies
174+
RUN ln --symbolic /var/tmp/coder/coder-cli/coder /usr/local/bin/coder && \
175+
ln --symbolic /var/tmp/coder/code-server/bin/code-server /usr/local/bin/code-server
176+
177+
# Disable the PostgreSQL systemd service.
178+
# Coder uses a custom timescale container to test the database instead.
179+
RUN systemctl disable \
180+
postgresql
181+
182+
# Configure systemd services for CVMs
183+
RUN systemctl enable \
184+
docker \
185+
ssh
186+
187+
# Install tools with published releases, where that is the
188+
# preferred/recommended installation method.
189+
ARG CLOUD_SQL_PROXY_VERSION=1.26.0 \
190+
DIVE_VERSION=0.10.0 \
191+
DOCKER_GCR_VERSION=2.1.0 \
192+
GOLANGCI_LINT_VERSION=1.44.2 \
193+
GRYPE_VERSION=0.24.0 \
194+
HELM_VERSION=3.8.0 \
195+
KUBE_LINTER_VERSION=0.2.5 \
196+
KUBECTX_VERSION=0.9.4 \
197+
STRIPE_VERSION=1.7.4 \
198+
TERRAGRUNT_VERSION=0.34.1 \
199+
TRIVY_VERSION=0.23.0
200+
201+
# cloud_sql_proxy, for connecting to cloudsql instances
202+
# the upstream go.mod prevents this from being installed with go install
203+
RUN curl --silent --show-error --location --output /usr/local/bin/cloud_sql_proxy "https://storage.googleapis.com/cloudsql-proxy/v${CLOUD_SQL_PROXY_VERSION}/cloud_sql_proxy.linux.amd64" && \
204+
chmod a=rx /usr/local/bin/cloud_sql_proxy && \
205+
# dive for scanning image layer utilization metrics in CI
206+
curl --silent --show-error --location "https://github.com/wagoodman/dive/releases/download/v${DIVE_VERSION}/dive_${DIVE_VERSION}_linux_amd64.tar.gz" | \
207+
tar --extract --gzip --directory=/usr/local/bin --file=- dive && \
208+
# docker-credential-gcr is a Docker credential helper for pushing/pulling
209+
# images from Google Container Registry and Artifact Registry
210+
curl --silent --show-error --location "https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v${DOCKER_GCR_VERSION}/docker-credential-gcr_linux_amd64-${DOCKER_GCR_VERSION}.tar.gz" | \
211+
tar --extract --gzip --directory=/usr/local/bin --file=- docker-credential-gcr && \
212+
# golangci-lint performs static code analysis for our Go code
213+
curl --silent --show-error --location "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz" | \
214+
tar --extract --gzip --directory=/usr/local/bin --file=- --strip-components=1 "golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64/golangci-lint" && \
215+
# Anchore Grype for scanning container images for security issues
216+
curl --silent --show-error --location "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_amd64.tar.gz" | \
217+
tar --extract --gzip --directory=/usr/local/bin --file=- grype && \
218+
# Helm is necessary for deploying Coder
219+
curl --silent --show-error --location "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | \
220+
tar --extract --gzip --directory=/usr/local/bin --file=- --strip-components=1 linux-amd64/helm && \
221+
# kube-linter for linting Kubernetes objects, including those
222+
# that Helm generates from our charts
223+
curl --silent --show-error --location "https://github.com/stackrox/kube-linter/releases/download/${KUBE_LINTER_VERSION}/kube-linter-linux.tar.gz" | \
224+
tar --extract --gzip --directory=/usr/local/bin --file=- kube-linter && \
225+
# kubens and kubectx for managing Kubernetes namespaces and contexts
226+
curl --silent --show-error --location "https://github.com/ahmetb/kubectx/releases/download/v${KUBECTX_VERSION}/kubectx_v${KUBECTX_VERSION}_linux_x86_64.tar.gz" | \
227+
tar --extract --gzip --directory=/usr/local/bin --file=- kubectx && \
228+
curl --silent --show-error --location "https://github.com/ahmetb/kubectx/releases/download/v${KUBECTX_VERSION}/kubens_v${KUBECTX_VERSION}_linux_x86_64.tar.gz" | \
229+
tar --extract --gzip --directory=/usr/local/bin --file=- kubens && \
230+
# stripe for coder.com billing API
231+
curl --silent --show-error --location "https://github.com/stripe/stripe-cli/releases/download/v${STRIPE_VERSION}/stripe_${STRIPE_VERSION}_linux_x86_64.tar.gz" | \
232+
tar --extract --gzip --directory=/usr/local/bin --file=- stripe && \
233+
# terragrunt for running Terraform and Terragrunt files
234+
curl --silent --show-error --location --output /usr/local/bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" && \
235+
chmod a=rx /usr/local/bin/terragrunt && \
236+
# AquaSec Trivy for scanning container images for security issues
237+
curl --silent --show-error --location "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | \
238+
tar --extract --gzip --directory=/usr/local/bin --file=- trivy
239+
240+
# Add Vercel globally. We can't install it in packages.json, because it
241+
# includes Go files which make golangci-lint unhappy.
242+
RUN yarn global add --prefix=/usr/local \
243+
vercel \
244+
typescript \
245+
typescript-language-server && \
246+
yarn cache clean
247+
248+
# We use yq during "make deploy" to manually substitute out fields in
249+
# our helm values.yaml file. See https://github.com/helm/helm/issues/3141
250+
#
251+
# TODO: update to 4.x, we can't do this now because it included breaking
252+
# changes (yq w doesn't work anymore)
253+
# RUN curl --silent --show-error --location "https://github.com/mikefarah/yq/releases/download/v4.9.0/yq_linux_amd64.tar.gz" | \
254+
# tar --extract --gzip --directory=/usr/local/bin --file=- ./yq_linux_amd64 && \
255+
# mv /usr/local/bin/yq_linux_amd64 /usr/local/bin/yq
256+
257+
RUN curl --silent --show-error --location --output /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/3.3.0/yq_linux_amd64" && \
258+
chmod a=rx /usr/local/bin/yq
259+
260+
# Install GoLand.
261+
RUN mkdir --parents /usr/local/goland && \
262+
curl --silent --show-error --location "https://download.jetbrains.com/go/goland-2021.2.tar.gz" | \
263+
tar --extract --gzip --directory=/usr/local/goland --file=- --strip-components=1 && \
264+
ln --symbolic /usr/local/goland/bin/goland.sh /usr/local/bin/goland
265+
266+
# Install Antlrv4, needed to generate paramlang lexer/parser
267+
RUN curl --silent --show-error --location --output /usr/local/lib/antlr-4.9.2-complete.jar "https://www.antlr.org/download/antlr-4.9.2-complete.jar"
268+
ENV CLASSPATH="/usr/local/lib/antlr-4.9.2-complete.jar:${PATH}"
269+
270+
# Add coder user and allow use of docker/sudo
271+
RUN useradd coder \
272+
--create-home \
273+
--shell=/bin/bash \
274+
--groups=docker \
275+
--uid=1000 \
276+
--user-group
277+
278+
# Adjust OpenSSH config
279+
RUN echo "PermitUserEnvironment yes" >>/etc/ssh/sshd_config && \
280+
echo "X11Forwarding yes" >>/etc/ssh/sshd_config && \
281+
echo "X11UseLocalhost no" >>/etc/ssh/sshd_config
282+
283+
# We avoid copying the extracted directory since COPY slows to minutes when there
284+
# are a lot of small files.
285+
COPY --from=go /usr/local/goboring.tar.gz /usr/local/goboring.tar.gz
286+
RUN mkdir /usr/local/goboring && \
287+
tar --extract --gzip --directory=/usr/local/goboring --file=/usr/local/goboring.tar.gz --strip-components=1 && \
288+
ln -s /usr/local/goboring/bin/go /usr/local/bin/go
289+
COPY --from=go /tmp/bin /usr/local/bin
290+
291+
COPY --from=rust-utils /tmp/bin /usr/local/bin
292+
RUN mv /usr/local/bin/exa /usr/local/bin/ls
293+
RUN mv /usr/local/bin/bat /usr/local/bin/cat
294+
295+
USER coder
296+
297+
# Ensure go bins are in the 'coder' user's path. Note that no go bins are
298+
# installed in this docker file, as they'd be mounted over by the persistent
299+
# home volume.
300+
ENV PATH="/home/coder/go/bin:${PATH}"
301+
302+
# This setting prevents Go from using the public checksum database for
303+
# our module path prefixes. It is required because these are in private
304+
# repositories that require authentication.
305+
#
306+
# For details, see: https://golang.org/ref/mod#private-modules
307+
ENV GOPRIVATE="coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder"
308+
309+
# Increase memory allocation to NodeJS
310+
ENV NODE_OPTIONS="--max-old-space-size=8192"

‎dogfood/Makefile

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
.PHONY: docker-build docker-push
2+
3+
branch=$(shell git rev-parse --abbrev-ref HEAD)
4+
build_tag=codercom/oss-dogfood:${branch}
5+
6+
docker-build:
7+
DOCKER_BUILDKIT=1 docker build . -t ${build_tag}
8+
9+
docker-push: docker-build
10+
docker push ${build_tag}

‎dogfood/files/etc/apt/apt.conf.d/80-no-recommends

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// Do not install recommended packages by default
2+
APT::Install-Recommends "0";
3+
4+
// Do not install suggested packages by default (this is already
5+
// the Ubuntu default)
6+
APT::Install-Suggests "0";

‎dogfood/files/etc/apt/apt.conf.d/80-retries

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
APT::Acquire::Retries "3";

‎dogfood/files/etc/apt/preferences.d/docker

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Ignore all packages from this repository by default
2+
Package: *
3+
Pin: origin download.docker.com
4+
Pin-Priority: 1
5+
6+
# Docker Community Edition
7+
Package: docker-ce
8+
Pin: origin download.docker.com
9+
Pin-Priority: 500
10+
11+
# Docker command-line tool
12+
Package: docker-ce-cli
13+
Pin: origin download.docker.com
14+
Pin-Priority: 500
15+
16+
# containerd runtime
17+
Package: containerd.io
18+
Pin: origin download.docker.com
19+
Pin: version 1.5.11-1
20+
Pin-Priority: 500

0 commit comments

Comments
 (0)