Add Dockerfile for SCF workspace image

[zhangtbj]

Hi,

Our team are using SCF in our workspace, but one vagrant VM is not enough for a team. We would like to have own workspace and integrate with CI tools. I extract required tools from Vagrant VM and create a Dockerfile.

We have verified the Docker image can work fine as SCF workspace. such as develop, create images, etc...

We also verified it in CI tools such as Concourse, it also works fine (Only need about 50mins to create SCF images). Please take a look if it is valuable.

Submitter: zhangtbj@cn.ibm.com (Jordan) and shenxh@cn.ibm.com (Xiao Hua)

Thanks a lot!

[zhangtbj]

Or you can have a try the existing docker image which we created:
https://hub.docker.com/r/bluebosh/bwb/

[mook-as]

Sorry it took us a bit to get to this!

Generally okay (there are a few things that shouldn't be necessary, but I don't care enough to block merging on them). The only thing I actually care about is running as root (and consequently changing permissions on the checkout outside the docker image).

I guess this is mostly aimed at concourse? You should be able to run make vagrant-prep from a workstation and have thing work, since most "interesting" bits are run in docker.

[mook-as]

I'm not sure why we need nginx, and a bunch of development libs, on in the image, but okay. (Fissile should be compiling everything inside docker containers anyway)

[zhangtbj]

OK, I will remove nginx to see if there is any tool needs it. These libs are deps such for docker, etc...

[mook-as]

Right, but (hopefully) docker isn't doing anything that needs tghe -dev packages… it shouldn't depend on a compiler being present :)

[mook-as]

This should be pulled in via the prep stuff in the makefile (specifically, make ${FISSILE_BINARY}). But whatever 😄

[zhangtbj]

I try to use make all, but it fail because docker deamon is not started and ready yet.
so make docker-deps will fail... :(

[mook-as]

I was more thinking of doing it inside the docker image (after the mount happens); after all, hopefully we would need to bump this image less often than we bump the tools. As written, we'll need to rebuild the docker image every time we have a new fissile / configgin.

[mook-as]

I'm a bit concerned that everything in the container would run as root (which means the files in your checkout would start being owned by root).

[zhangtbj]

Yes, every files is created by root. but I verify all works fine. root execute, generate and use everything.
Have you seen any error when using root?

[mook-as]

Right, nothing would go wrong for the actual build; however, as a user on a workstation you'll then need to deal with a bunch of files owned by root. (Mostly because we tend to check this out into our home directories, ~/workspace/scf/ or something like that).

This of course isn't an issue for automated CI (where everything is a throwaway volume anyway).

[mook-as]

From trial and error: Just exposing the docker socket directly (--volume /var/run/docker.sock:/var/run/docker.sock) will not work, because the volume mounts will get all confused. Unless you mount with -v $PWD:$PWD instead of /scf, then thing will map correctly.

Either way, running as root makes it annoying (unless you're dealing with disposable checkouts like concourse is).

[zhangtbj]

Sorry, I didn't understand it well. What is the error?
--volume “/root/scf:/scf”, these are the folder on your machine: docker container folder.
And docker socket is?

[mook-as]

I was attempting to not need to start a separate docker inside the container (instead, using the host docker). This gets rid of the need for a /var/lib/docker mount. Hence mounting /var/run/docker.sock into the container too. But that's more me playing with the thing than something we actually need.

[zhangtbj]

We plan use it for concourse and our daily development. I think it is faster and can develop and make build anywhere :)

[mook-as]

FWIW, on a workstation (where your user has access to docker) you should be able to run make vagrant-prep / make helm / make kube just fine; make run would probably fail because we don't have anything set up to transfer the built images somewhere that the kubernetes cluster can pull (unless you make publish first).

[mook-as]

Right, but (hopefully) docker isn't doing anything that needs tghe -dev packages… it shouldn't depend on a compiler being present :)

[mook-as]

I was more thinking of doing it inside the docker image (after the mount happens); after all, hopefully we would need to bump this image less often than we bump the tools. As written, we'll need to rebuild the docker image every time we have a new fissile / configgin.

[mook-as]

Right, nothing would go wrong for the actual build; however, as a user on a workstation you'll then need to deal with a bunch of files owned by root. (Mostly because we tend to check this out into our home directories, ~/workspace/scf/ or something like that).

This of course isn't an issue for automated CI (where everything is a throwaway volume anyway).

[mook-as]

I was attempting to not need to start a separate docker inside the container (instead, using the host docker). This gets rid of the need for a /var/lib/docker mount. Hence mounting /var/run/docker.sock into the container too. But that's more me playing with the thing than something we actually need.

[zhangtbj]

Hi @mook-as Sorry, We are still using the old Dockerfile to build image continully. I will verify if build process works fine after refine by your suggestion in next milestone. It may take more time. I will update here if I have any news. Thanks!