Fix dockerfile not working by zsnmwy · Pull Request #647 · esm-dev/esm.sh

zsnmwy · 2023-05-29T06:28:58Z

The origin Dockerfile is not working.

Fix Dockerfile
Support building Docker Image and push to GHCR.
Support platforms: linux/amd64 linux/arm64

You can try docker run --rm -it -p 8077:80 ghcr.io/zsnmwy/esmd:latest.

zsnmwy · 2023-05-29T10:23:59Z

Share My K8S Config.

apiVersion: v1
kind: ConfigMap
metadata:
  name: esm-config
  namespace: esm
data:
  config.json: |
    {
      "port": 80,
      "tlsPort": 0,
      "nsPort": 8088,
      "buildConcurrency": 0,
      "workDir": "~/.esmd",
      "cache": "memory:default",
      "database": "bolt:~/.esmd/esm.db",
      "storage": "local:~/.esmd/storage",
      "logDir": "~/.esmd/log",
      "logLevel": "debug",
      "origin": "https://esm.example.com",
      "basePath": "/",
      "npmRegistry": "https://registry.npmmirror.com/",
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: esm
  namespace: esm
  labels:
    app.kubernetes.io/instance: esm
    app.kubernetes.io/name: esm
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: esm
      app.kubernetes.io/name: esm
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: esm
        app.kubernetes.io/name: esm
    spec:
      containers:
        - name: esm
          image: change to your image
          volumeMounts:
            - name: config-volume
              mountPath: /home/esm/config.json
              subPath: config.json
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          resources: {}
          livenessProbe:
            httpGet:
              path: /
              port: http
              scheme: HTTP
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /
              port: http
              scheme: HTTP
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
      volumes:
        - name: config-volume
          configMap:
            name: esm-config
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      serviceAccountName: default
      serviceAccount: default
      securityContext:
        runAsUser: 0
        runAsGroup: 0
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

---
apiVersion: v1
kind: Service
metadata:
  name: esm
  namespace: esm
  labels:
    app.kubernetes.io/instance: esm
    app.kubernetes.io/name: esm
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: http
  selector:
    app.kubernetes.io/instance: esm
    app.kubernetes.io/name: esm
  type: ClusterIP
  sessionAffinity: None
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  internalTrafficPolicy: Cluster

ije · 2023-05-29T11:38:36Z

Share My K8S Config.

apiVersion: v1
kind: ConfigMap
metadata:
  name: esm-config
  namespace: esm
data:
  config.json: |
    {
      "port": 80,
      "tlsPort": 0,
      "nsPort": 8088,
      "buildConcurrency": 0,
      "workDir": "~/.esmd",
      "cache": "memory:default",
      "database": "bolt:~/.esmd/esm.db",
      "storage": "local:~/.esmd/storage",
      "logDir": "~/.esmd/log",
      "logLevel": "debug",
      "origin": "https://esm.example.com",
      "basePath": "/",
      "npmRegistry": "https://registry.npmmirror.com/",
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: esm
  namespace: esm
  labels:
    app.kubernetes.io/instance: esm
    app.kubernetes.io/name: esm
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: esm
      app.kubernetes.io/name: esm
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: esm
        app.kubernetes.io/name: esm
    spec:
      containers:
        - name: esm
          image: change to your image
          volumeMounts:
            - name: config-volume
              mountPath: /home/esm/config.json
              subPath: config.json
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          resources: {}
          livenessProbe:
            httpGet:
              path: /
              port: http
              scheme: HTTP
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /
              port: http
              scheme: HTTP
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
      volumes:
        - name: config-volume
          configMap:
            name: esm-config
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      serviceAccountName: default
      serviceAccount: default
      securityContext:
        runAsUser: 0
        runAsGroup: 0
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

---
apiVersion: v1
kind: Service
metadata:
  name: esm
  namespace: esm
  labels:
    app.kubernetes.io/instance: esm
    app.kubernetes.io/name: esm
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: http
  selector:
    app.kubernetes.io/instance: esm
    app.kubernetes.io/name: esm
  type: ClusterIP
  sessionAffinity: None
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  internalTrafficPolicy: Cluster

thats great! does this handle clusters?

ije · 2023-05-29T11:39:23Z

.github/workflows/docker-image.yml

+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}


i need to put my own token for the CI right?

You don't need to change it.
GitHub provides some contexts for each task.
See https://docs.github.com/en/actions/learn-github-actions/contexts

That will auto-login to your GHCR instance.

ije · 2023-05-29T11:41:34Z

.github/workflows/docker-image.yml

+
+on:
+  push:
+    branches: [ "main" ]


maybe just on tags like v124? because we may put bad code to the main branch

Yes, you can.

But it's hard to debug if I do not have the repo permission.
I have no permission to push images to your GHCR instance.
Github action has strict permission.

I recommend you copy the action from my existing file.

It can auto-build images based on tag, branch, and pull requests.
And will auto-comment the result to PR if the action trigger comes from PR.

That tags will be like that.

The PR Comments

ije · 2023-05-29T11:42:51Z

.github/workflows/docker-image.yml

+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/${{ github.repository_owner }}/esmd:latest


i prefer ghcr.io/owner/esm.sh instead of ghcr.io/owner/esmd, can you pls change?

Sorry, I don't want to change it anymore.
It's hard for me to debug the code because of the action permission.
You can merge it first and change it.

ije · 2023-05-29T11:44:16Z

Dockerfile

-RUN useradd -u 1000 -m esm
-RUN mkdir /esm && chown esm:esm /esm
-RUN git clone https://github.com/esm-dev/esm.sh /esm/esm.sh
-RUN git checkout v124


again, let's use the latest tag instead of main branch

https://github.com/gocrane/crane/blob/9776243d8f37f2766fa7f39ffb4b2470de922857/.github/workflows/build-images.yml#L90C12-L95

Reading the version information from git is better than manual changes each time.

ije · 2023-05-29T11:49:13Z

Dockerfile

+RUN apk add --no-cache libc6-compat xz
+RUN addgroup -g $GROUP_ID $GROUP_NAME && \
+    adduser --shell /sbin/nologin --disabled-password \
+    --uid $USER_ID --ingroup $GROUP_NAME $USER_NAME
+RUN mkdir -p /usr/local/lib && chown -R $USER_NAME:$GROUP_NAME /usr/local


wath is for?

This code is prepared for non-root users.
Create a user and give the right permissions.

You must add the lib libc6-compat.
If not the server will crash.

ije · 2023-05-29T11:49:29Z

Dockerfile

-WORKDIR /esm
-RUN go build -o bin/esmd esm.sh/main.go
+FROM node:18-alpine3.16
+ENV USER_ID=65535


just wondered, can we remove the USER_ID and GROUP_ID perm?

If you want the script to run as root, you can.

You can pass the -u 0:0 params to docker.
That will be run as root.

That full command is: docker run --rm -it -p 8077:80 -u 0:0 ghcr.io/zsnmwy/esmd:latest.

That's a security question.
See https://docs.docker.com/engine/security/rootless/

zsnmwy · 2023-05-29T16:46:51Z

I have to say that the k8s share code is not enough to handle large service requests.
You should add HPA to enable the k8s autoscaling features.
However, HPA has inherent limitations due to design issues.
You can use EHPA to avoid that.
It's not easy for beginners. :)

ESM should support S3 and Redis.
S3 and Redis can help ESM share the status globally.

ije · 2023-09-04T09:54:58Z

check https://github.com/esm-dev/esm.sh/pkgs/container/esm.sh

zsnmwy added 4 commits May 29, 2023 04:36

Create docker-image.yml

85188e4

FIX: Docker Image

79eaf56

Update Dockerfile

ff62ce8

chore: add xz for alpine

09f651a

ije reviewed May 29, 2023

View reviewed changes

ije closed this Sep 4, 2023

Uh oh!

Conversation

zsnmwy commented May 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zsnmwy commented May 29, 2023

Uh oh!

ije commented May 29, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zsnmwy May 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zsnmwy commented May 29, 2023

Uh oh!

ije commented Sep 4, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zsnmwy commented May 29, 2023 •

edited

Loading

zsnmwy May 29, 2023 •

edited

Loading

ije commented Sep 4, 2023 •

edited

Loading