x/build: investigate possibility of supporting Go tests that require use of Docker in trybots/builders

[jba]

We would like the trybots to be able to run a docker container.

The discovery site needs a postgres database to run tests, and we've been starting it in our CI with docker run.

An alternative would be to install postgres in the trybot image, but that's probably more difficult and definitely less general.

[dmitshur]

/cc @cagedmantis @toothrot

IIRC it may have been @findleyr that had the same feature requests for x/tools trybots.

[dmitshur]

@jba Docker does not support every platform that Go supports and gets tested on. Is the scope of this feature request limited to a subset of GOOS/GOARCH pairs? For example, just linux/amd64 and potentially others?

[toothrot]

If the target for the discovery site is always Docker, an alternative would be to configure a Cloud Build run to be able to publish Trybot results, rather than using the normal Trybots for this specific scenario.

[findleyr]

Yep, I discussed this with Jonathan (thanks @jba for posting this issue). I think this might not be possible with the current Trybot implementation. For example, exposing Docker probably means exposing sudoless docker, which comes with a bunch of security concerns.

Another option might be to integrate TryBot functionality with other CI tooling, for example Cloud Build. TryBots have many nice features (e.g. gating on Run-Trybots +1) that could perhaps be separated from the actual CI.

[toothrot]

If you're using Cloud Build, it might not be necessary to gate Run-Trybots. Out of curiosity, what other features are you thinking of?

[findleyr]

Perhaps, though I'd prefer still gating on Run-Trybots

Another feature is hosting artifacts in a public GCS bucket, and posting them back to the the CL (not something GCB does out of the box).

[jba]

Could the trybots execute a gcloud command? Then we could use the trybot to trigger the GCB run.

That would give us gating, but not public artifacts.

It would imply that the trybots have some sort of GCP auth on them.