Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dev and ci Dockerfile to match updater #3279

Merged
merged 1 commit into from
Mar 17, 2021
Merged

Update dev and ci Dockerfile to match updater #3279

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 42 additions & 23 deletions Dockerfile.ci
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,29 @@
FROM dependabot/dependabot-core
ARG CODE_DIR=/home/dependabot/dependabot-core

USER root

ARG USERNAME=dependabot
ARG DEPENDABOT_HOME=/home/${USERNAME}
ARG CODE_DIR=${DEPENDABOT_HOME}/dependabot-core

# Install project dependencies as an unprivileged user
RUN useradd -m ${USERNAME} && mkdir ${CODE_DIR}
RUN chown -R ${USERNAME}:${USERNAME} \
${CODE_DIR} \
/usr/local/.pyenv \
/opt/go/gopath \
/opt/rust/ \
/opt/bundler/

WORKDIR ${CODE_DIR}

ENV BUNDLE_PATH="/home/dependabot/.bundle" \
BUNDLE_BIN=".bundle/binstubs" \
PATH=".bundle/binstubs:$PATH:/home/dependabot/.bundle/bin"
USER ${USERNAME}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This setup is the same as Dockerfile.development and the updater, previously ci would run as root having access to /var/lib which is the default cache directory for rubygems when GEM_HOME isn't set


ENV BUNDLE_PATH="${CODE_DIR}/.bundle" \
BUNDLE_BIN=".bundle/bin"
ENV PATH="$BUNDLE_BIN:$PATH:$BUNDLE_PATH/bin"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$BUNDLE_BIN and $BUNDLE_PATH/bin are now the same value of .bundle/bin - do we still need both?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah this tripped me up several times, the BUNDLE_BIN is set to a relative path but the BUNDLE_PATH isn't

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦅 👁️

Good catch!


COPY .rubocop.yml /home/dependabot/dependabot-core/
COPY .rubocop.yml ${CODE_DIR}/

RUN mkdir -p \
${CODE_DIR}/bundler \
Expand Down Expand Up @@ -67,23 +84,25 @@ RUN cd python && bundle install
RUN cd terraform && bundle install
RUN cd omnibus && bundle install

COPY common/ ${CODE_DIR}/common/
COPY bundler/ ${CODE_DIR}/bundler/
COPY cargo/ ${CODE_DIR}/cargo/
COPY composer/ ${CODE_DIR}/composer/
COPY dep/ ${CODE_DIR}/dep/
COPY docker/ ${CODE_DIR}/docker/
COPY elm/ ${CODE_DIR}/elm/
COPY git_submodules/ ${CODE_DIR}/git_submodules/
COPY github_actions/ ${CODE_DIR}/github_actions/
COPY go_modules/ ${CODE_DIR}/go_modules/
COPY gradle/ ${CODE_DIR}/gradle/
COPY hex/ ${CODE_DIR}/hex/
COPY maven/ ${CODE_DIR}/maven/
COPY npm_and_yarn/ ${CODE_DIR}/npm_and_yarn/
COPY nuget/ ${CODE_DIR}/nuget/
COPY python/ ${CODE_DIR}/python/
COPY terraform/ ${CODE_DIR}/terraform/
COPY omnibus/ ${CODE_DIR}/omnibus/
# Set the owner to be dependabot instead of defaulting to `root` allowing test
# helpers to writing to the spec folder
COPY --chown=${USERNAME}:${USERNAME} common/ ${CODE_DIR}/common/
COPY --chown=${USERNAME}:${USERNAME} bundler/ ${CODE_DIR}/bundler/
COPY --chown=${USERNAME}:${USERNAME} cargo/ ${CODE_DIR}/cargo/
COPY --chown=${USERNAME}:${USERNAME} composer/ ${CODE_DIR}/composer/
COPY --chown=${USERNAME}:${USERNAME} dep/ ${CODE_DIR}/dep/
COPY --chown=${USERNAME}:${USERNAME} docker/ ${CODE_DIR}/docker/
COPY --chown=${USERNAME}:${USERNAME} elm/ ${CODE_DIR}/elm/
COPY --chown=${USERNAME}:${USERNAME} git_submodules/ ${CODE_DIR}/git_submodules/
COPY --chown=${USERNAME}:${USERNAME} github_actions/ ${CODE_DIR}/github_actions/
COPY --chown=${USERNAME}:${USERNAME} go_modules/ ${CODE_DIR}/go_modules/
COPY --chown=${USERNAME}:${USERNAME} gradle/ ${CODE_DIR}/gradle/
COPY --chown=${USERNAME}:${USERNAME} hex/ ${CODE_DIR}/hex/
COPY --chown=${USERNAME}:${USERNAME} maven/ ${CODE_DIR}/maven/
COPY --chown=${USERNAME}:${USERNAME} npm_and_yarn/ ${CODE_DIR}/npm_and_yarn/
COPY --chown=${USERNAME}:${USERNAME} nuget/ ${CODE_DIR}/nuget/
COPY --chown=${USERNAME}:${USERNAME} python/ ${CODE_DIR}/python/
COPY --chown=${USERNAME}:${USERNAME} terraform/ ${CODE_DIR}/terraform/
COPY --chown=${USERNAME}:${USERNAME} omnibus/ ${CODE_DIR}/omnibus/
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems COPY defaults to the file being owned by root, this was failing when running rspec and loading the vcr configuration that attempted to create a folder here: https://github.com/dependabot/dependabot-core/blob/main/common/spec/spec_helper.rb#L38 (vcr codes)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the default COPY behaviour is surprising.

To reduce repetition we need to update this, we could just chown -r ${CODE_DIR} after the copy block? I don't feel strongly about making that change.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm attempted to run a chwon -r ${CODE_DIR} after the copy but looks like its failing and running out of disk space, reverting to the inline option https://github.com/dependabot/dependabot-core/runs/2122700298


RUN git config --global user.name dependabot-ci && git config --global user.email [email protected]
10 changes: 6 additions & 4 deletions Dockerfile.development
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,26 +15,28 @@ RUN apt-get update && apt-get install -y vim strace ltrace gdb
ARG USER_UID=1000
ARG USER_GID=$USER_UID
ARG USERNAME=dependabot
ARG DEPENDABOT_HOME=/home/${USERNAME}

RUN groupadd -o --gid "${USER_GID}" "${USERNAME}" && \
useradd --uid "${USER_UID}" --gid "${USER_GID}" -m "${USERNAME}"
RUN chown -R "${USERNAME}":"${USERNAME}" \
/usr/local/.pyenv \
/opt/go/gopath \
/opt/rust/
/opt/rust/ \
/opt/bundler/
USER $USERNAME
RUN git config --global user.name dependabot-ci && git config --global user.email [email protected]

ARG CODE_DIR=/home/$USERNAME/dependabot-core
ARG CODE_DIR=${DEPENDABOT_HOME}/dependabot-core

RUN curl -L -o ~/.vimrc https://github.com/hmarr/dotfiles/raw/main/vimrc-vanilla.vim && \
echo 'export PS1="[dependabot-core-dev] \w \[$(tput setaf 4)\]$ \[$(tput sgr 0)\]"' >> ~/.bashrc

RUN mkdir -p ${CODE_DIR}/common/lib/dependabot
WORKDIR ${CODE_DIR}

ENV BUNDLE_PATH="/home/$USERNAME/.bundle" \
BUNDLE_BIN=".bundle/binstubs"
ENV BUNDLE_PATH="${CODE_DIR}/.bundle" \
BUNDLE_BIN=".bundle/bin"
ENV PATH="$BUNDLE_BIN:$PATH:$BUNDLE_PATH/bin"

COPY common/Gemfile common/dependabot-common.gemspec ${CODE_DIR}/common/
Expand Down