Repository navigation
Docker fixes - new compose (podman support also) #1051
Description
Potentially helping docker related issues #741 and #523
Repo Linking
There are several links under different usernames/repos. I'm not sure how mantainers want to manaage this but it would help with docker issues if there could be one official repo that's linked everywhere and also published on on Docker Hub under this name also.
- "https://github.com/stringer-rss/stringer/" links to "https://github.com/swanson/stringer" under the repos about section.
- The docker docs reference "stringer-rss/stringer" (presumably expanding to "docker.io/stringer-rss/stringer")
- The docker-compose file references "mockdeep/stringer" (presumably expanding to "docker.io/mockdeep/stringer")
Compose Tweaks
Fixes and improvement suggestion plus support rootless containers, (podman, podman-compose), if you're happy with these suggestions I'll submit PR. These tweaks make the docker docs accurate also.
services:
stringer-postgres:
image: docker.io/postgres:9.5-alpine # full registry paths for non-docker compatibility/verbosity
container_name: stringer-postgres # helps with podman-compose
restart: unless-stopped
volumes:
- stringer:/var/lib/postgresql/data # use volume rather than mount point
environment:
- PUID=1000 # perms issues for the old ~/ vol mount
- PGID=1000
- POSTGRES_USER=db_user
- POSTGRES_DB=stringer
- POSTGRES_PASSWORD=super_secret_password # TODO change me
stringer:
image: docker.io/mockdeep/stringer # maybe stringer-rss/stringer? # full registry paths for non-docker compatibility/verbosity
container_name: stringer # helps with podman-compose
depends_on:
- stringer-postgres
restart: unless-stopped
ports:
- 8080:8080 # not on privileged port for rootless
environment:
- PORT=8080
- DATABASE_URL=postgres://db_user:super_secret_password@stringer-postgres:5432/stringer # TODO change me
# - SECRET_KEY_BASE=<your configuration> # TODO change me
# - ENCRYPTION_PRIMARY_KEY<your configuration> # TODO change me
# - ENCRYPTION_DETERMINISTIC_KEY=<your configuration> # TODO change me
# - ENCRYPTION_KEY_DERIVATION_SALT=<your configuration> # TODO change me
Container suggestions
- can we migrate to alpine/chainguard base image? Image is currently >1GB.
- can the DATABASE_URL be generated with other env vars to make the config dryer? maybe using docker-compose env file.
- can we get an explanation about the new encryption env vars rather than just commit msg? maybe on main README or in this compose
Activity
mockdeep commentedon Jul 6, 2023
@hozza thanks for opening this! A PR would be very welcome, as my Docker experience is extremely limited. I end up running in circles every time I try to dig in. We've also been chatting about it in #1050. Maybe @guidopetri will have opinions on this as well.
guidopetri commentedon Jul 6, 2023
I'll agree on all points above :) I'm not super confident on the PUID/PGID nor on the podman side of things (I don't run it myself) but migrating to alpine base image sounds good, and using an env file also sounds great (and I do this myself, actually, heh). One potential addition here is to make the port binding localhost only (
127.0.0.1:8080:8080) and use a reverse proxy in front of stringer to make it more secure.I also agree that the different links (swanson, mockdeep, stringer-rss) are a bit confusing. I'm partial to keeping everything under
stringer-rsspersonally, but I'm also not the maintainer :)mockdeep commentedon Jul 6, 2023
I think the
stringer-rssnamespace makes sense.hozza commentedon Jul 6, 2023
Ok great stuff. So it looks like there's a few work streams here:
guidopetri commentedon Jul 7, 2023
It's nothing fancy. I have a bunch of other services in the same compose file, so here's the section for stringer:
And the env file is of the format:
For the Docker image building in CI, I was going to work on adding it to CI + making it build all three of amd64/arm/arm64. If you're more familiar with CircleCI though, feel free to take that on :) I have #1053 open to make the Dockerfile accept other architectures,
though I have yet to test those changesthey are tested now!mockdeep commentedon Jul 24, 2023
@guidopetri thanks for the updates! I fixed one bundler issue, but now it's giving an error while installing gems:
I don't have a clear sense of what to do about that. Any ideas?
mockdeep commentedon Jul 26, 2023
I opened an issue on the CircleCI Docker orb.
guidopetri commentedon Jul 26, 2023
Sorry for the delay here, I try not to do a lot of open source during the week :) Unfortunately I have also got no idea where that error is coming from. I can investigate a bit more closely this weekend or next perhaps?
If the faulty build is blocking
main, I think we can revert it and add it back in later, too.mockdeep commentedon Jul 27, 2023
@guidopetri no hurry, It's not blocking merges or anything, though it would be nice to have a passing
mainbranch. I may open a support request with CircleCI, since the build runs fine locally.guidopetri commentedon Jul 27, 2023
This might be a bundler problem, not a CircleCI problem: ruby/rubygems#4353 , rubygems/bundler#4367 maybe we need to set the number of threads to 1? I'm not sure how to do that, though.
guidopetri commentedon Aug 10, 2023
@mockdeep did you end up opening a support request with CircleCI? I can try and carve out some time to find a solution if not.
mockdeep commentedon Aug 11, 2023
@guidopetri so far I've opened an issue on the orb, as well as opening a discussion on their forum, but no response on either. I was starting to think maybe we could move to using Github Actions for the docker image instead. It would be nice to have a build step for each PR, and only publish on
main. That way we can test the images before merging them.guidopetri commentedon Aug 11, 2023
Ok, I can give that a shot. Would you want to remove the circleCI testing or keep both circleCI and gh actions?
mockdeep commentedon Aug 15, 2023
@guidopetri great thanks! I think for now we can focus on getting the docker image on GA and leave the tests on CircleCI.