Thoughts on Automated Containerization

[kskarthik]

Hi @evilaliv3

I have some queries:

• I have seen that there is a docker registry at https://hub.docker.com/u/globaleaks But i did not find any cicd jobs which push the image, is it done manually?

• why is https://github.com/globaleaks/GlobaLeaks/blob/main/docker/Dockerfile pulling the deb file & building the image instead of pulling the image from above docker registry

I have this idea of automating the docker image creation using github actions & I have already written a Dockerfile which builds the app from source. I wish to push my work to the repo!

[evilaliv3]

Thank you for your question @kskarthik

At the moment the dockerfile is used to build the image from scratch; the image use a debian-base image and install globaleaks fetching the original debian package that we release.

At the moment we are pushing the docket images manually since images requires that the globaleaks package is first built and loaded on the globaleaks repository and the repository should be signed.

Based on this do you have any recomendations to improve the process?

1. One idea could be to tag github only when the package is actually released and build docker images automatically.
2. One more complete idea and goal at which we should target is to to automate also the creation of the debian repository but i think there will be very major work to achieve

[kskarthik]

One idea could be to tag github only when the package is actually released and build docker images automatically.

Yes, this is my intention. i have actually built the globaleaks from source in a dockerfile with multistage build process. I will share the dockerfile with a WIP MR. Suggest me any improvements required. Then, I will configure to build the docker image only on tags.

One more complete idea and goal at which we should target is to to automate also the creation of the debian repository but i think there will be very major work to achieve

I will do some research regarding this in next phase. Many FOSS projects do this, infact.

[kskarthik]

one more alternative way is:

on tags -> build deb & publish first -> run the docker job after the deb job is successful

[kskarthik]

why is https://github.com/globaleaks/GlobaLeaks/blob/main/docker/Dockerfile pulling the deb file & building the image instead of pulling the image from above docker registry

We can change the docke compose file to pull the image from the docker repository, instead of building. Shall i do that change?

oh, there is no latest tag. why not create a latest tag pointing to the recent version, in this way, the user does not have to build the image from scratch locally.

[evilaliv3]

If you do that, how one will be able to build the moment image before pushing it on docker?

Message ID: <globaleaks/GlobaLeaks/repo-discussions/4046/comments/9154040@ github.com>

Thank you if you could clarify.

[kskarthik]

the latest docker tag will always point to the recent release

in docker compose file, we can give the image name with latest tag to pull.

That was my line of thought

[kskarthik]

This is the proposed changes diff of docker-compose.yaml
assuming the latest tag exists

 services:
   globaleaks:
-    build: .
+    image: globaleaks/globaleaks:latest
     restart: unless-stopped
     container_name: globaleaks
     network_mode: bridge

For now, Whenever there is a new docker image upload to the hub manually, It also needs to be tagged as latest.

The change from your end would be tagging as latest, for this snippet to work

[kskarthik]

@evilaliv3 right now, i guess debian repository is also manually updated, correct ?