Add Docker image creation for crossreference

[vladbogo]

No description provided.

[grooverdan]

build-essential and mariadb-client looks odd - does it directly use mariadb executable? Could append ; rm -rf /var/lib/apt/lists/* for size reduction.

[fauust]

Also:

• please one package by line;
• this lack of cleaning should have been catched by hadolint, can you make sure that it is run against this Dockerfile.

[vladbogo]

hadolint runs

[vladbogo]

probably the mariadb-client and build-essential are not needed. some leftovers from other dockerfiles. I'll remove them and we'll see after testing

[fauust]

hadolint runs

Nope, it does not, it runs on the wrong PATH...

~/buildbot/cross-reference remotes/vlad/crossref_docker ≡
.venv ❯ podman run -it -i -v $(pwd):/mnt -w /mnt ghcr.io/hadolint/hadolint:latest hadolint /mnt/Dockerfile
WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers 
Trying to pull ghcr.io/hadolint/hadolint:latest...
Getting image source signatures
Copying blob db4123164570 done   | 
Copying config da13a5ec2e done   | 
Writing manifest to image destination
/mnt/Dockerfile:12 DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
/mnt/Dockerfile:12 DL3009 info: Delete the apt-get lists after installing something
/mnt/Dockerfile:18 DL3013 warning: Pin versions in pip. Instead of `pip install <package>` use `pip install <package>==<version>` or `pip install --requirement <requirements file>`

[fauust]

DL3008 are disabled but DL3009 is not.

[vladbogo]

The paths are too cryptic. I am not sure what it wants from pip

[vladbogo]

DL3009 is also disabled. Anyway not sure what it wants now

[fauust]

Also:

• please one package by line;
• this lack of cleaning should have been catched by hadolint, can you make sure that it is run against this Dockerfile.

[fauust]

Maybe a good moment to try to upgrade to bullseye (or better alpine :-) )

[cvicentiu]

0.0.0.0 as far as I am aware

…

On Fri, 12 Apr 2024, 15:01 faust, ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In cross-reference/Dockerfile <#412 (comment)>: > @@ -0,0 +1,27 @@ +# Use an official Python runtime as a parent image +FROM python:3.11-slim-buster Maybe a good moment to try to upgrade to bullseye (or better alpine :-) ) ------------------------------ In cross-reference/Dockerfile <#412 (comment)>: > @@ -0,0 +1,27 @@ +# Use an official Python runtime as a parent image +FROM python:3.11-slim-buster + +# Set environment variables +ENV PYTHONDONTWRITEBYTECODE 1 +ENV PYTHONUNBUFFERED 1 + +# Set work directory +WORKDIR /app + +# Install system dependencies +RUN apt-get update && apt-get install --no-install-recommends -y build-essential mariadb-client libmariadbclient-dev Also: - please one package by line; - this lack of cleaning should have been catched by hadolint, can you make sure that it is run against this Dockerfile. ------------------------------ In cross-reference/Dockerfile <#412 (comment)>: > +RUN apt-get update && apt-get install --no-install-recommends -y build-essential mariadb-client libmariadbclient-dev + +# Install python dependencies +COPY requirements.txt /app +RUN pip install --no-cache-dir --upgrade pip && \ + pip install --no-cache-dir -r requirements.txt + +# Copy project +COPY ./crossreference /app/ + +# Add and run as non-root user +RUN adduser --disabled-password --gecos '' cr +USER cr + +# Run gunicorn +CMD ["bash", "-c", "python manage.py collectstatic --noinput && gunicorn crossreference.wsgi:application --bind 1.0.0.0:25432"] yep, that's probably 0.0.0.0/0 (not sure if there is a best practice here, it maybe localhost too since the port is going to be exposed on localhost host by docker-compose). — Reply to this email directly, view it on GitHub <#412 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARWRPKS7NLQLBXG33CIGWDY47EJRAVCNFSM6AAAAABGCLOOFSVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMYTSOJWGYZDQNRZGM> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[fauust]

Here is how to check the correct Dockerfile:

- docker run -i -v $(pwd):/mnt -w /mnt ghcr.io/hadolint/hadolint:latest hadolint /mnt/Dockerfile
+ docker run -i -v $(pwd):/mnt -w /mnt ghcr.io/hadolint/hadolint:latest hadolint /mnt/cross-reference/Dockerfile

note that $(pwd) the current repo root is mounted in /mnt in the container, also since the working directory is /mnt (that's what the -w does), this should also work:

docker run -i -v $(pwd):/mnt -w /mnt ghcr.io/hadolint/hadolint:latest hadolint cross-reference/Dockerfile

[vladbogo]

This doesn't work because of line 16. All the next steps need to run in the cross-reference dir. So we either make this run in the parent, or copy the file

[fauust]

Oh, I see, sorry missed that one. I am happy with any one of the mentioned solution.

[fauust]

Do you think that you could implement a very basic check step in the CI, just to make sure that the image seems to look good.

[fauust]

this for loop is useless

[fauust]

It's probably cleaner to use this as a volume mount with the generated image. It would avoid regenerating the image anytime we change app code source...

[RazvanLiviuVarzaru]

What is the status of this PR?
Is it still work in progress / abandoned ?

Let's handle it appropriately so won't hang in the PR queue forever.
I can help with a review, but please help me with a quick recap of what is the purpose << No description provided. >> and what has happened so far + if there is any other information split over other channels (Zulip, Slack, e-mail, etc).