Building one image to deploy to multiple destinations

[mudge]

We currently use Kamal to continuously deploy an application to two destinations: staging and production.

We do this by using kamal deploy -d staging and kamal deploy -d production in a CI workflow but this causes the same Docker image to be built twice: once for each destination even though the resulting images are identical (as there are no per-environment build secrets).

Is there a recommended way to build an image once but then deploy it to separate destinations given that kamal deploy -d will tag images with their destination (e.g. latest-staging) or does it only really support building and tagging images per destination?

[cdesiles]

Accordingly to the doc (https://kamal-deploy.org/docs/configuration/builders/) kamal uses the docker build system. I would recommend to download the built image (in staging) to rebuild the production image, with the build-cache (https://kamal-deploy.org/docs/configuration/builders/#builder-cache) you would get this build performed almost instantaneously.

TLDR; docker has built-in solution for your problem with a build cache mechanism.

[mudge]

Thanks for your reply. We're using CircleCI's Docker layer caching which does much the same and means our production builds are almost entirely cached but I was wondering if we could safely skip the redundant build altogether.

[morgoth]

We're doing exactly that: build one image for staging deploy, and then reuse this image for production deploy.

You can deploy existing docker image via kamal deploy --skip-push. It will not build the image but will try to fetch already built one.

[mudge]

Thanks for this, it seems to work with the only inconsistency being that the staging build with push a latest-staging tag for the image to the registry whereas the production deploy will only create the latest-production tag locally on each server.

As we weren't relying on these, I think it's an acceptable trade-off.

[morgoth]

Yes.
We also have a custom script to tag the image accordingly:

#!/bin/bash -e

# To indicate on registry which are the latest images deployed on all destinations,
# since we build only once.

tag=$1
image=path/to-image-on-ghcr
version=$(git rev-parse HEAD)
ghcr_password=$GITHUB_TOKEN

echo "$ghcr_password" | docker login ghcr.io -u deployer --password-stdin
docker pull ghcr.io/$image:$version
docker tag ghcr.io/$image:$version ghcr.io/$image:$tag
docker push ghcr.io/$image:$tag

echo
echo "Tagged $image $version as $tag"

and we run it from GHA after production deploy: bin/tag_image latest-production