From 477345da931ab052416224bb7ff12272cff5eec1 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Mon, 17 Sep 2018 12:19:37 +0100 Subject: [PATCH 1/8] Reference the numerical UID for the Docker images to run as. Signed-off-by: Kashif Saadat --- docker/mysql-agent/Dockerfile | 3 ++- docker/mysql-operator/Dockerfile | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/docker/mysql-agent/Dockerfile b/docker/mysql-agent/Dockerfile index 637c752a4..160363274 100644 --- a/docker/mysql-agent/Dockerfile +++ b/docker/mysql-agent/Dockerfile @@ -2,6 +2,7 @@ FROM mysql/mysql-server:8.0.12 COPY bin/linux_amd64/mysql-agent / -USER mysql +# Reference the UID for the 'mysql' user +USER 27 ENTRYPOINT ["/mysql-agent"] diff --git a/docker/mysql-operator/Dockerfile b/docker/mysql-operator/Dockerfile index 4b968cf63..5d034c3e2 100644 --- a/docker/mysql-operator/Dockerfile +++ b/docker/mysql-operator/Dockerfile @@ -2,4 +2,8 @@ FROM oraclelinux:7.3 COPY bin/linux_amd64/mysql-operator / +# Add a non-root user and reference the UID +RUN adduser -rU -u 1000 mysql-operator +USER 1000 + ENTRYPOINT ["/mysql-operator"] From 85411fbdd85c39db72df6df1817d60c27e9f71ee Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Tue, 18 Sep 2018 10:53:08 +0100 Subject: [PATCH 2/8] Retrieve the UID for the mysql user and pass in when building the mysql-agent image, rather than hardcoding a UID in the Dockerfile. Signed-off-by: Kashif Saadat --- Makefile | 5 +++++ docker/mysql-agent/Dockerfile | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 7e6266318..2b1be8eb5 100644 --- a/Makefile +++ b/Makefile @@ -78,9 +78,14 @@ build-docker: -t $(REGISTRY)/$(TENANT)/mysql-operator:$(VERSION) \ -f docker/mysql-operator/Dockerfile . + # Retrieve the UID for the mysql user, passed in when building the mysql-agent image + $(eval MYSQL_AGENT_IMAGE := $(shell sed -n 's/^FROM \(.*\)/\1/p' docker/mysql-agent/Dockerfile)) + $(eval MYSQL_UID=$(shell docker run --rm --entrypoint id ${MYSQL_AGENT_IMAGE} -u mysql)) + @docker build \ --build-arg=http_proxy \ --build-arg=https_proxy \ + --build-arg=MYSQL_USER=${MYSQL_UID} \ -t $(REGISTRY)/$(TENANT)/mysql-agent:$(VERSION) \ -f docker/mysql-agent/Dockerfile . diff --git a/docker/mysql-agent/Dockerfile b/docker/mysql-agent/Dockerfile index 160363274..86e39f7e6 100644 --- a/docker/mysql-agent/Dockerfile +++ b/docker/mysql-agent/Dockerfile @@ -2,7 +2,8 @@ FROM mysql/mysql-server:8.0.12 COPY bin/linux_amd64/mysql-agent / -# Reference the UID for the 'mysql' user -USER 27 +# Set default value for 'MYSQL_USER', which is overridden with the UID at build time +ARG MYSQL_USER=mysql +USER ${MYSQL_USER} ENTRYPOINT ["/mysql-agent"] From 130721529bb7a745697d2345b4ddb17962447bf5 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Wed, 19 Sep 2018 16:12:28 +0100 Subject: [PATCH 3/8] WIP: Update wercker to use Makefile for image build Signed-off-by: Kashif Saadat --- Makefile | 12 +++++++++--- wercker.yml | 54 ++++++++++++++++++++++++++--------------------------- 2 files changed, 35 insertions(+), 31 deletions(-) diff --git a/Makefile b/Makefile index 2b1be8eb5..e81cefa26 100644 --- a/Makefile +++ b/Makefile @@ -23,6 +23,7 @@ endif PKG := github.com/oracle/mysql-operator REGISTRY := iad.ocir.io +IMAGE_PREFIX ?= $(REGISTRY)/$(TENANT) SRC_DIRS := cmd pkg test/examples CMD_DIRECTORIES := $(sort $(dir $(wildcard ./cmd/*/))) COMMANDS := $(CMD_DIRECTORIES:./cmd/%/=%) @@ -71,13 +72,18 @@ build: dist build-dirs Makefile cp $(BINARIES) ./bin/$(OS)_$(ARCH)/ .PHONY: build-docker -build-docker: +build-docker: build-docker-mysql-operator build-docker-mysql-agent + +.PHONY: build-docker-mysql-operator +build-docker-mysql-operator: @docker build \ --build-arg=http_proxy \ --build-arg=https_proxy \ - -t $(REGISTRY)/$(TENANT)/mysql-operator:$(VERSION) \ + -t $(IMAGE_PREFIX)/mysql-operator:$(VERSION) \ -f docker/mysql-operator/Dockerfile . +.PHONY: build-docker-mysql-agent +build-docker-mysql-agent: # Retrieve the UID for the mysql user, passed in when building the mysql-agent image $(eval MYSQL_AGENT_IMAGE := $(shell sed -n 's/^FROM \(.*\)/\1/p' docker/mysql-agent/Dockerfile)) $(eval MYSQL_UID=$(shell docker run --rm --entrypoint id ${MYSQL_AGENT_IMAGE} -u mysql)) @@ -86,7 +92,7 @@ build-docker: --build-arg=http_proxy \ --build-arg=https_proxy \ --build-arg=MYSQL_USER=${MYSQL_UID} \ - -t $(REGISTRY)/$(TENANT)/mysql-agent:$(VERSION) \ + -t $(IMAGE_PREFIX)/mysql-agent:$(VERSION) \ -f docker/mysql-agent/Dockerfile . # Note: Only used for development, i.e. in CI the images are pushed using Wercker. diff --git a/wercker.yml b/wercker.yml index 503f7f049..96dc914d9 100644 --- a/wercker.yml +++ b/wercker.yml @@ -36,105 +36,103 @@ build: cp -R mysql-operator ${WERCKER_OUTPUT_DIR}/ cp -R .git ${WERCKER_OUTPUT_DIR}/ -push-operator-image: - box: - id: oraclelinux:7.3 +build-image: + base-path: "/go/src/github.com/oracle/mysql-operator" steps: - script: name: set environment variables code: | + export IMAGE_PREFIX=wercker-build export VERSION=$(cat dist/version.txt) - echo "Pushing operator version ${VERSION}" + echo "Building mysql operator & agent images with version: ${VERSION}" + + - script: + name: build mysql-operator image + code: make build-docker-mysql-operator - script: - name: prepare + name: build mysql-agent image + code: make build-docker-mysql-agent + +push-operator-image: + steps: + - script: + name: set environment variables code: | - mv bin/mysql-operator /mysql-operator - chmod +x /mysql-operator + export IMAGE_PREFIX=wercker-build + export VERSION=$(cat dist/version.txt) - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} registry: https://iad.ocir.io/v2 repository: iad.ocir.io/oracle/mysql-operator tag: $VERSION - entrypoint: /mysql-operator username: $OCIRUSERNAME password: $OCIRPASSWORD - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} registry: https://lhr.ocir.io/v2 repository: lhr.ocir.io/oracle/mysql-operator tag: $VERSION - entrypoint: /mysql-operator username: $OCIRUSERNAME password: $OCIRPASSWORD - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} registry: https://phx.ocir.io/v2 repository: phx.ocir.io/oracle/mysql-operator tag: $VERSION - entrypoint: /mysql-operator username: $OCIRUSERNAME password: $OCIRPASSWORD - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} registry: https://fra.ocir.io/v2 repository: fra.ocir.io/oracle/mysql-operator tag: $VERSION - entrypoint: /mysql-operator username: $OCIRUSERNAME password: $OCIRPASSWORD push-agent-image: - box: - id: mysql/mysql-server:8.0.11 steps: - script: name: set environment variables code: | + export IMAGE_PREFIX=wercker-build export VERSION=$(cat dist/version.txt) - echo "Pushing agent version ${VERSION}" - - - script: - name: prepare - code: | - mv bin/mysql-agent /mysql-agent - chmod +x /mysql-agent - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} registry: https://iad.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD repository: iad.ocir.io/oracle/mysql-agent tag: $VERSION - entrypoint: /mysql-agent - user: mysql - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} registry: https://lhr.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD repository: lhr.ocir.io/oracle/mysql-agent tag: $VERSION - entrypoint: /mysql-agent - user: mysql - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} registry: https://phx.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD repository: phx.ocir.io/oracle/mysql-agent tag: $VERSION - entrypoint: /mysql-agent - user: mysql - internal/docker-push: + image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} registry: https://fra.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD repository: fra.ocir.io/oracle/mysql-agent tag: $VERSION - entrypoint: /mysql-agent - user: mysql e2e-test: base-path: "/go/src/github.com/oracle/mysql-operator" From 6e27851d7fe4342abd6df2e41b33182180edd598 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Wed, 19 Sep 2018 16:34:41 +0100 Subject: [PATCH 4/8] Reworked wercker image build steps Signed-off-by: Kashif Saadat --- wercker.yml | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/wercker.yml b/wercker.yml index 96dc914d9..de329a05e 100644 --- a/wercker.yml +++ b/wercker.yml @@ -36,7 +36,7 @@ build: cp -R mysql-operator ${WERCKER_OUTPUT_DIR}/ cp -R .git ${WERCKER_OUTPUT_DIR}/ -build-image: +push-operator-image: base-path: "/go/src/github.com/oracle/mysql-operator" steps: - script: @@ -44,24 +44,12 @@ build-image: code: | export IMAGE_PREFIX=wercker-build export VERSION=$(cat dist/version.txt) - echo "Building mysql operator & agent images with version: ${VERSION}" + echo "Building mysql-operator image with version: ${VERSION}" - script: name: build mysql-operator image code: make build-docker-mysql-operator - - script: - name: build mysql-agent image - code: make build-docker-mysql-agent - -push-operator-image: - steps: - - script: - name: set environment variables - code: | - export IMAGE_PREFIX=wercker-build - export VERSION=$(cat dist/version.txt) - - internal/docker-push: image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} registry: https://iad.ocir.io/v2 @@ -95,12 +83,18 @@ push-operator-image: password: $OCIRPASSWORD push-agent-image: + base-path: "/go/src/github.com/oracle/mysql-operator" steps: - script: name: set environment variables code: | export IMAGE_PREFIX=wercker-build export VERSION=$(cat dist/version.txt) + echo "Building mysql-agent image with version: ${VERSION}" + + - script: + name: build mysql-agent image + code: make build-docker-mysql-agent - internal/docker-push: image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} From c06bad6c576d98a09c713ea4d72f8d6f5cb983e0 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Thu, 20 Sep 2018 09:09:05 +0100 Subject: [PATCH 5/8] Set docker property in image build and push pipelines --- wercker.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/wercker.yml b/wercker.yml index de329a05e..4c27756be 100644 --- a/wercker.yml +++ b/wercker.yml @@ -38,7 +38,13 @@ build: push-operator-image: base-path: "/go/src/github.com/oracle/mysql-operator" + box: alpine + docker: true steps: + - script: + name: Install build utils + code: apk --no-cache add docker make + - script: name: set environment variables code: | @@ -84,7 +90,13 @@ push-operator-image: push-agent-image: base-path: "/go/src/github.com/oracle/mysql-operator" + box: alpine + docker: true steps: + - script: + name: Install build utils + code: apk --no-cache add docker make + - script: name: set environment variables code: | From 5b480acd34308a77f0c5277d21d810058b2782ca Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Thu, 20 Sep 2018 09:38:48 +0100 Subject: [PATCH 6/8] WIP: Drop docker-push steps for operator image to validate build. --- wercker.yml | 62 ++++++++++++++++++++++++++--------------------------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/wercker.yml b/wercker.yml index 4c27756be..00de95456 100644 --- a/wercker.yml +++ b/wercker.yml @@ -56,37 +56,37 @@ push-operator-image: name: build mysql-operator image code: make build-docker-mysql-operator - - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - registry: https://iad.ocir.io/v2 - repository: iad.ocir.io/oracle/mysql-operator - tag: $VERSION - username: $OCIRUSERNAME - password: $OCIRPASSWORD - - - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - registry: https://lhr.ocir.io/v2 - repository: lhr.ocir.io/oracle/mysql-operator - tag: $VERSION - username: $OCIRUSERNAME - password: $OCIRPASSWORD - - - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - registry: https://phx.ocir.io/v2 - repository: phx.ocir.io/oracle/mysql-operator - tag: $VERSION - username: $OCIRUSERNAME - password: $OCIRPASSWORD - - - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - registry: https://fra.ocir.io/v2 - repository: fra.ocir.io/oracle/mysql-operator - tag: $VERSION - username: $OCIRUSERNAME - password: $OCIRPASSWORD + # - internal/docker-push: + # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} + # registry: https://iad.ocir.io/v2 + # repository: iad.ocir.io/oracle/mysql-operator + # tag: $VERSION + # username: $OCIRUSERNAME + # password: $OCIRPASSWORD + # + # - internal/docker-push: + # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} + # registry: https://lhr.ocir.io/v2 + # repository: lhr.ocir.io/oracle/mysql-operator + # tag: $VERSION + # username: $OCIRUSERNAME + # password: $OCIRPASSWORD + # + # - internal/docker-push: + # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} + # registry: https://phx.ocir.io/v2 + # repository: phx.ocir.io/oracle/mysql-operator + # tag: $VERSION + # username: $OCIRUSERNAME + # password: $OCIRPASSWORD + # + # - internal/docker-push: + # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} + # registry: https://fra.ocir.io/v2 + # repository: fra.ocir.io/oracle/mysql-operator + # tag: $VERSION + # username: $OCIRUSERNAME + # password: $OCIRPASSWORD push-agent-image: base-path: "/go/src/github.com/oracle/mysql-operator" From 117a7f2cf452ab61495540d9c529094e44acf7b7 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Thu, 20 Sep 2018 11:08:08 +0100 Subject: [PATCH 7/8] Makefile tweaks --- Makefile | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/Makefile b/Makefile index e81cefa26..514ac05b8 100644 --- a/Makefile +++ b/Makefile @@ -34,15 +34,13 @@ UNAME_S := $(shell uname -s) ifeq ($(UNAME_S),Darwin) # Cross-compiling from OSX to linux, go install puts the binaries in $GOPATH/bin/$GOOS_$GOARCH - BINARIES := $(addprefix $(GOPATH)/bin/$(OS)_$(ARCH)/,$(COMMANDS)) -else -ifeq ($(UNAME_S),Linux) + BINARIES := $(addprefix $(GOPATH)/bin/$(OS)_$(ARCH)/,$(COMMANDS)) +else ifeq ($(UNAME_S),Linux) # Compiling on linux for linux, go install puts the binaries in $GOPATH/bin - BINARIES := $(addprefix $(GOPATH)/bin/,$(COMMANDS)) + BINARIES := $(addprefix $(GOPATH)/bin/,$(COMMANDS)) else $(error "Unsupported OS: $(UNAME_S)") endif -endif .PHONY: all all: build From 7aeaa2e4a763c6bf62f69450f9af8bc18f7c2353 Mon Sep 17 00:00:00 2001 From: Kashif Saadat Date: Thu, 20 Sep 2018 12:48:01 +0100 Subject: [PATCH 8/8] Use wercker internal docker-build command --- wercker.yml | 112 ++++++++++++++++++++++------------------------------ 1 file changed, 48 insertions(+), 64 deletions(-) diff --git a/wercker.yml b/wercker.yml index 00de95456..b65be8ce3 100644 --- a/wercker.yml +++ b/wercker.yml @@ -19,9 +19,7 @@ build: - script: name: copy build artifacts code: | - mkdir -p ${WERCKER_OUTPUT_DIR}/bin - cp -R /go/bin/mysql-agent ${WERCKER_OUTPUT_DIR}/bin/ - cp -R /go/bin/mysql-operator ${WERCKER_OUTPUT_DIR}/bin/ + cp -R bin ${WERCKER_OUTPUT_DIR}/ cp -R dist ${WERCKER_OUTPUT_DIR}/ - script: @@ -35,81 +33,67 @@ build: cp -R hack ${WERCKER_OUTPUT_DIR}/ cp -R mysql-operator ${WERCKER_OUTPUT_DIR}/ cp -R .git ${WERCKER_OUTPUT_DIR}/ + cp -R docker ${WERCKER_OUTPUT_DIR}/ push-operator-image: - base-path: "/go/src/github.com/oracle/mysql-operator" - box: alpine - docker: true steps: - - script: - name: Install build utils - code: apk --no-cache add docker make + - internal/docker-build: + dockerfile: docker/mysql-operator/Dockerfile + image-name: wercker-build-mysql-operator - script: - name: set environment variables + name: Set environment variables code: | - export IMAGE_PREFIX=wercker-build export VERSION=$(cat dist/version.txt) - echo "Building mysql-operator image with version: ${VERSION}" + echo "Pushing mysql-operator version ${VERSION}" - - script: - name: build mysql-operator image - code: make build-docker-mysql-operator - - # - internal/docker-push: - # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - # registry: https://iad.ocir.io/v2 - # repository: iad.ocir.io/oracle/mysql-operator - # tag: $VERSION - # username: $OCIRUSERNAME - # password: $OCIRPASSWORD - # - # - internal/docker-push: - # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - # registry: https://lhr.ocir.io/v2 - # repository: lhr.ocir.io/oracle/mysql-operator - # tag: $VERSION - # username: $OCIRUSERNAME - # password: $OCIRPASSWORD - # - # - internal/docker-push: - # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - # registry: https://phx.ocir.io/v2 - # repository: phx.ocir.io/oracle/mysql-operator - # tag: $VERSION - # username: $OCIRUSERNAME - # password: $OCIRPASSWORD - # - # - internal/docker-push: - # image-name: ${IMAGE_PREFIX}/mysql-operator:${VERSION} - # registry: https://fra.ocir.io/v2 - # repository: fra.ocir.io/oracle/mysql-operator - # tag: $VERSION - # username: $OCIRUSERNAME - # password: $OCIRPASSWORD + - internal/docker-push: + image-name: wercker-build-mysql-operator + registry: https://iad.ocir.io/v2 + repository: iad.ocir.io/oracle/mysql-operator + tag: $VERSION + username: $OCIRUSERNAME + password: $OCIRPASSWORD + + - internal/docker-push: + image-name: wercker-build-mysql-operator + registry: https://lhr.ocir.io/v2 + repository: lhr.ocir.io/oracle/mysql-operator + tag: $VERSION + username: $OCIRUSERNAME + password: $OCIRPASSWORD + + - internal/docker-push: + image-name: wercker-build-mysql-operator + registry: https://phx.ocir.io/v2 + repository: phx.ocir.io/oracle/mysql-operator + tag: $VERSION + username: $OCIRUSERNAME + password: $OCIRPASSWORD + + - internal/docker-push: + image-name: wercker-build-mysql-operator + registry: https://fra.ocir.io/v2 + repository: fra.ocir.io/oracle/mysql-operator + tag: $VERSION + username: $OCIRUSERNAME + password: $OCIRPASSWORD push-agent-image: - base-path: "/go/src/github.com/oracle/mysql-operator" - box: alpine - docker: true steps: - - script: - name: Install build utils - code: apk --no-cache add docker make + - internal/docker-build: + dockerfile: docker/mysql-agent/Dockerfile + image-name: wercker-build-mysql-agent + build-args: "MYSQL_USER=27" - script: - name: set environment variables + name: Set environment variables code: | - export IMAGE_PREFIX=wercker-build export VERSION=$(cat dist/version.txt) - echo "Building mysql-agent image with version: ${VERSION}" - - - script: - name: build mysql-agent image - code: make build-docker-mysql-agent + echo "Pushing mysql-agent version ${VERSION}" - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} + image-name: wercker-build-mysql-agent registry: https://iad.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD @@ -117,7 +101,7 @@ push-agent-image: tag: $VERSION - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} + image-name: wercker-build-mysql-agent registry: https://lhr.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD @@ -125,7 +109,7 @@ push-agent-image: tag: $VERSION - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} + image-name: wercker-build-mysql-agent registry: https://phx.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD @@ -133,7 +117,7 @@ push-agent-image: tag: $VERSION - internal/docker-push: - image-name: ${IMAGE_PREFIX}/mysql-agent:${VERSION} + image-name: wercker-build-mysql-agent registry: https://fra.ocir.io/v2 username: $OCIRUSERNAME password: $OCIRPASSWORD