Github action for automated Docker builds

[just5ky]

Hi,
I noticed that Decider is not in cisagov docker repo. So I build and pushed my own.
Here are the changes+ additions needed to make it work.

Based on the file tree, I wasn't able to build the container without these changes

• Changes to web app Dockerfile, I also moved this Dockerfile to the main directory

  • I noticed that a few lines do not have correct linking

  • decider/docker/web/Dockerfile

    Line 9 in 56e794b

    COPY ./app /app

  • https://github.com/Just5KY/decider/blob/f252db658d4fe0735ccbf5153fb280d050dddf4c/Dockerfile#L10

  • decider/docker/web/Dockerfile

    Line 11 in 56e794b

    COPY ./decider.py /decider.py

  • https://github.com/Just5KY/decider/blob/f252db658d4fe0735ccbf5153fb280d050dddf4c/Dockerfile#L12

• Changes to pgsql docker file

  • decider/docker/db/Dockerfile

    Line 3 in 56e794b

    COPY ./docker/db/init.sql /docker-entrypoint-initdb.d/

  • https://github.com/Just5KY/decider/blob/f252db658d4fe0735ccbf5153fb280d050dddf4c/docker/db/Dockerfile#L3

• Added GitHub actions

  • .github/workflows/docker.yml

name: Docker

on:
  workflow_run:
    workflows: ["build"]
    types: [requested]
    branches:
      - 'latest'
  workflow_dispatch:

jobs:
  build:
    name: build
    runs-on: ubuntu-latest

    permissions:
      packages: write
      contents: read

    steps:
      - name: Check out the repo
        uses: actions/checkout@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v2.5.0

      - name: Log in to Docker Hub
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96
        with:
          images: |
            justsky/decider
      
      - name: Build and push Docker images
        uses: docker/build-push-action@v4
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/decider:buildcache
          cache-to: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/decider:buildcache,mode=max

• .github/workflows/docker_db.yml

name: Docker

on:
  workflow_run:
    workflows: ["build"]
    types: [requested]
    branches:
      - 'latest'
  workflow_dispatch:

jobs:
  build:
    name: build
    runs-on: ubuntu-latest

    permissions:
      packages: write
      contents: read

    steps:
      - name: Check out the repo
        uses: actions/checkout@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v2.5.0

      - name: Log in to Docker Hub
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96
        with:
          images: |
            ${{ secrets.DOCKERHUB_USERNAME }}/decider:db
      - name: Build and push Docker images
        uses: docker/build-push-action@v4
        with:
          context: "{{defaultContext}}:docker/db"
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ secrets.DOCKERHUB_USERNAME }}/decider:db
          labels: ${{ steps.meta.outputs.labels }}

Ref

• https://github.com/Just5KY/decider
• https://hub.docker.com/r/justsky/decider
• https://docs.github.com/en/actions/publishing-packages/publishing-docker-images
• https://docs.docker.com/build/ci/github-actions/multi-platform/

[damionmounts]

Hello @just5ky,

Just letting you know that I did see this - and that I'll be able to throw some eyes at it next week

[damionmounts]

I'll need to reach to a CISA contact and see if they're interested in adding this to their dockerhub.

Was it not possible to keep the original folder structure using context: "{{defaultContext}}" for both and then a path to each Dockerfile for file:?

There was #32 as well - if you had any feedback on a direction for naming.

[damionmounts]

I'm not dead-set against any folder structure changes - but a loose Dockerfile in the root seems off versus dedicated holding dirs.

[just5ky]

it is possible to use context: "{{defaultContext}}".
I guess it's just my personal preference to keep it at the root level, but you can keep it in a directory.

For #32 container_name: decider-web. Docker like to put random names for the container if not specified.
as an example, I run around 80 containers in my sever so specifying a name is important for me.
I dont mind decider_web or decider_app

[mygithub23]

it is possible to use context: "{{defaultContext}}". I guess it's just my personal preference to keep it at the root level, but you can keep it in a directory.

For #32 container_name: decider-web. Docker like to put random names for the container if not specified. as an example, I run around 80 containers in my sever so specifying a name is important for me. I dont mind decider_web or decider_app

the Docker daemon generates a random and unique name for each container; I also like to name my own containers, but the only draw back is if the container's name is not unique it will fail to run.

[just5ky]

we can set it to something like cisa_decider_app & cisa_decider_db

[mygithub23]

Thank you Just5KY, I will test it and let you know. I had some issue deploying decider images to docker hub.
the app didn't work after I pull both the decider_db and the decider_web from my docker hub . What I end up doing just for testing purposes I executed the following steps and it works. I know --link is deprecated may be I can use network overlay.
--- Create image from container
docker commit 33c9806ff99d decider_db_image
docker commit a93b86e8ed8b decider_web_image

-- Create network
docker network create -d bridge --subnet 172.22.0.0/16 decider_network

-- link containers network
docker run --network=decider_nw -itd -p 5432:5432 --name=decider_db_container decider_db_image
docker run --network=decider_nw -itd -p 8001:5000 --name=decider_web_container --link decider_db_container:db decider_web_image

[just5ky]

Can you try using the compose i posted in my docker hub
Just replace the image with the one you created

[mygithub23]

I just pushed both images to my docker hub madkar777/decider_web_ibc_2:latest and madkar777/decider_db_ibc_2:latest.
I tested as you instructed but it didn't work. It looks like a network issue. I will check the logs and inspect the images.

[mygithub23]

it works on http://localhost:8001
the reason it didn't worked before because I was testing it on https which I was using all week.

[mygithub23]

I am planning to deploy the decider to EKS. I am thinking to use Kompose to convert the docker-compose file to Kubernetes