Containerise dependencies required to run tasks in dev workflow #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

banjoh wants to merge 17 commits into main from em/dockerize-wg-easy-dependencies

Member

banjoh commented Apr 25, 2025 •

edited

Loading

Add tasks to manage container dev environment
Update documentation to reflect new list of requirements

banjoh added 12 commits

April 23, 2025 19:59


          feat: Dockerfile containing all dependencies for tasks

6fe352f

Signed-off-by: Evans Mungai <[email protected]>


          download helmfile

48d112b

Signed-off-by: Evans Mungai <[email protected]>


          feat: Dockerfile containing all dependencies for tasks

b26044d

Signed-off-by: Evans Mungai <[email protected]>


          download helmfile

2ef4633

Signed-off-by: Evans Mungai <[email protected]>


          Merge branch 'em/dockerize-wg-easy-dependencies' of github.com:banjoh…

dac6b1f

…/platform-examples into em/dockerize-wg-easy-dependencies


          Add initial docker env taskfile

dfe10c3

Signed-off-by: Evans Mungai <[email protected]>


          Move docker tasks into wg-easy application

30c6a4c

Signed-off-by: Evans Mungai <[email protected]>


          Update dev documentation

3e5c1cd

Signed-off-by: Evans Mungai <[email protected]>


          Copy replicated auth token to container

30b7781

Signed-off-by: Evans Mungai <[email protected]>


          Update dev documentation

e26440e

Signed-off-by: Evans Mungai <[email protected]>


          Fix grammer

0e669a9

Signed-off-by: Evans Mungai <[email protected]>


          Add SHELL env required by replicated shell subcommand

0da51be

Signed-off-by: Evans Mungai <[email protected]>

chris-sanders requested changes

View reviewed changes

Member

chris-sanders left a comment

I started to call out everywhere that there is 'docker' and then realized you've labeled that as 'to follow' so I stopped since that's still wip.

applications/wg-easy/Taskfile.yaml Outdated

                 # GCP default configuration
                 GCP_PROJECT: '{{.GCP_PROJECT | default "replicated-qa"}}'
                 GCP_ZONE: '{{.GCP_ZONE | default "us-central1-a"}}'
                 VM_NAME: '{{.VM_NAME | default (printf "%s-dev" (or (env "GUSER") "user"))}}'
+                # Docker workflow configuration
+                IMAGE_NAME: ttl.sh/wg-easy-dev

Member

chris-sanders Apr 25, 2025

We really shouldn't be using ttl.sh here, it's fine for development but it needs to be available somewhere else for the actual workflow. Is this currently just for you to test and you intend to move it later?

Member Author

banjoh Apr 28, 2025

This is currently for test until we decide on

if we need to host this image. We need to weigh the need to host the image vs users needing to build the image which take a minute.
what OCI registry - docker hub? replicated? all of the above?

applications/wg-easy/Taskfile.yaml Outdated

                 # GCP default configuration
                 GCP_PROJECT: '{{.GCP_PROJECT | default "replicated-qa"}}'
                 GCP_ZONE: '{{.GCP_ZONE | default "us-central1-a"}}'
                 VM_NAME: '{{.VM_NAME | default (printf "%s-dev" (or (env "GUSER") "user"))}}'
+                # Docker workflow configuration

Member

chris-sanders Apr 25, 2025

Suggested change

      
              # Docker workflow configuration
          
              # Workflow container configuration

applications/wg-easy/Taskfile.yaml Outdated

Comment on lines 32 to 33

		IMAGE_NAME: ttl.sh/wg-easy-dev
		CONTAINER_NAME: wg-easy-dev

Member

chris-sanders Apr 25, 2025

In a helm chart you would expect to see:

repository: ttl.sh
Image: wg-easy-dev
tag: latest

Shouldn't we just use the same phrasing here? Maybe

DEV_CONTAINER_REPOSITORY
DEV_CONTAINER_IMAGE
DEV_CONTAINER_TAG

applications/wg-easy/container/Containerfile Outdated

    
            @@ -0,0 +1,68 @@
          
              # Base image for all shared Dockerfiles for taskfiles

Member

chris-sanders Apr 25, 2025

Why would this live in a subfolder "container" if it's the only thing in that sub-folder?
Do you expect there to be scripts that are added in the future for entrypoints and such that will live here too?

Member Author

banjoh Apr 28, 2025

I would like to add an entrypoint script for shell completions etc.

applications/wg-easy/container/Containerfile Outdated

Comment on lines 20 to 21

Member

chris-sanders Apr 25, 2025

Are we using these in the container?

Member Author

banjoh Apr 28, 2025

Only yq and jq. I think the rest can be removed.

applications/wg-easy/container/Containerfile

    
                  sudo \

                  # Install Helm

                  && curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash \

Member

chris-sanders Apr 25, 2025

Why is this all one big RUN line?
Doesn't this mean that you're forcing the cache to be invalidated if any of these things change rather than only updating the one change? Is there a benefit to it b/c I only see a downside of breaking normal caching behavior.

Member Author

banjoh Apr 28, 2025

Since we are not specifying any tool versions, would any of these tools change, leading to the layer being recreated? To update the tool versions, wouldn't it require docker build --no-cache anyway?

One, though negligible difference is the overall image size. Its smaller when using one layer. 1.23GB vs 1.18GB

applications/wg-easy/container/Containerfile Outdated

Comment on lines 57 to 60

    
              # Create a non-root user for better security

              RUN groupadd -r devuser \

                  && useradd -r -g devuser -m -s /bin/bash devuser \

                  && echo "devuser ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/devuser

Member

chris-sanders Apr 25, 2025

How does a non-root user provide security when you give it global passwordless sudo? This is root by a different name.

If podman already maps the root UID/GID to the user running the commands is this necessary at all?

Member Author

banjoh Apr 28, 2025

Elevated privileges are not required by any of the tasks. I'll clean that up

applications/wg-easy/container/Containerfile Outdated

    
                  && echo "devuser ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/devuser

              # Set working directory

              WORKDIR /app

Member

chris-sanders Apr 25, 2025

Personally I'd call this workspace or something. App is kind of an overloaded term, but I can take it or leave it I don't feel strongly about it.

applications/wg-easy/docs/development-workflow.md Outdated

    
              - **yq:** A command-line YAML processor. ([Installation Guide](https://github.com/mikefarah/yq#install))

              - **gcloud CLI:** Google Cloud command-line interface (optional, only required for GCP-specific tasks). ([Installation Guide](https://cloud.google.com/sdk/docs/install))

              - **Standard Unix Utilities:** `find`, `xargs`, `grep`, `awk`, `wc`, `tr`, `cp`, `mv`, `rm`, `mkdir`, `echo`, `sleep`, `test`, `eval` (typically available by default on Linux and macOS).

              - **Docker:** Container runtime for local development. ([Installation Guide](https://docs.docker.com/get-docker/))

Member

chris-sanders Apr 25, 2025

podman

scottrigby Apr 25, 2025

made a PR against this PR branch:

Default to Podman, allow Docker optionally #54

applications/wg-easy/taskfiles/container.yml Outdated

+                        -e USER=devuser \
+                        -e REPLICATED_API_TOKEN={{ .REPLICATED_API_TOKEN }} \
+                        -w /workspace \
+                        {{.IMAGE_NAME}}:{{.IMAGE_TAG}} bash -c 'trap "exit" TERM; while :; do sleep 0.1; done')

Member

chris-sanders Apr 25, 2025

Suggested change

      
                      {{.IMAGE_NAME}}:{{.IMAGE_TAG}} bash -c 'trap "exit" TERM; while :; do sleep 0.1; done')
          
                      {{.IMAGE_NAME}}:{{.IMAGE_TAG}} bash -c 'trap "exit 0" TERM INT; sleep infinity & wait')

There's no need to process something every .1 seconds just sleep forever, exit on the termination commands

Member Author

banjoh Apr 28, 2025

& wait was the bit I needed. I couldn't get SIGTERM to work with sleep infinity when running in the container

scottrigby mentioned this pull request

Default to Podman, allow Docker optionally #54

Merged


          Default to Podman, allow Docker optionally (#54)

a75abac

Signed-off-by: Scott Rigby <[email protected]>

banjoh changed the title ~~Dockerise dependencies required to run tasks in dev workflow~~ Containerise dependencies required to run tasks in dev workflow

banjoh added 4 commits

April 28, 2025 12:10


          Prepend DEV to dev container variables

e77f4f0

Signed-off-by: Evans Mungai <[email protected]>


          Changes as per review comments

68ecc8d

Signed-off-by: Evans Mungai <[email protected]>


          Add shell completions and some colour to terminal

cdcc991

Signed-off-by: Evans Mungai <[email protected]>


          Remove duplicate completion

a05d485

Signed-off-by: Evans Mungai <[email protected]>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet