Skip to content

Commit 3fa80e4

Browse files
benjamin102014benjamin102014
authored
Add debug container, pipeline
1 parent 73b62d5 commit 3fa80e4

File tree

6 files changed

+201
-0
lines changed

6 files changed

+201
-0
lines changed

‎.github/workflows/release-debug.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: Release debugging image
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
push:
10+
branches: [ "main" ]
11+
tags: [ "*" ]
12+
paths: [ "images/debug/**" ]
13+
pull_request:
14+
branches: [ "main" ]
15+
paths: [ "images/debug/**" ]
16+
17+
env:
18+
# Use docker.io for Docker Hub if empty
19+
REGISTRY: ghcr.io
20+
IMAGE_NAME: ${{ github.repository }}/distroless-debug
21+
22+
jobs:
23+
build:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
packages: write
28+
# This is used to complete the identity challenge
29+
# with sigstore/fulcio when running outside of PRs.
30+
id-token: write
31+
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@v4
35+
36+
- name: Get image tag
37+
id: get_image_tag
38+
run: |
39+
VERSION=$(grep "^ARG VERSION=" images/debug/Dockerfile \
40+
| cut -d'=' -f2 \
41+
| tr -d '"' \
42+
| tr -d "'" \
43+
| tr -d [:space:])
44+
echo $VERSION
45+
echo "image_tag=${VERSION}" >> $GITHUB_OUTPUT
46+
47+
# Install the cosign tool except on PR
48+
# https://github.com/sigstore/cosign-installer
49+
- name: Install cosign
50+
if: github.event_name != 'pull_request'
51+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
52+
with:
53+
cosign-release: 'v2.5.3'
54+
55+
# Set up BuildKit Docker container builder to be able to build
56+
# multi-platform images and export cache
57+
# https://github.com/docker/setup-buildx-action
58+
- name: Set up Docker Buildx
59+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
60+
61+
# Login against a Docker registry except on PR
62+
# https://github.com/docker/login-action
63+
- name: Log into registry ${{ env.REGISTRY }}
64+
if: github.event_name != 'pull_request'
65+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
66+
with:
67+
registry: ${{ env.REGISTRY }}
68+
username: ${{ github.actor }}
69+
password: ${{ secrets.GITHUB_TOKEN }}
70+
71+
# Extract metadata (tags, labels) for Docker
72+
# https://github.com/docker/metadata-action
73+
- name: Extract Docker metadata
74+
id: meta
75+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
76+
with:
77+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
78+
# tag image with version specified in ARG VERSION in Dockerfile if event is a push
79+
# or with given tag if event is tag
80+
tags: |
81+
type=semver,pattern={{version}},value=${{ steps.get_image_tag.outputs.image_tag }},enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') }}
82+
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
83+
type=ref,event=tag,enable=${{ startsWith(github.ref, 'refs/tags/') }}
84+
flavor: |
85+
latest=false
86+
87+
# Build and push Docker image with Buildx (don't push on PR)
88+
# https://github.com/docker/build-push-action
89+
- name: Build and push Docker image
90+
id: build-and-push
91+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
92+
with:
93+
context: images/debug
94+
push: ${{ github.event_name != 'pull_request' }}
95+
tags: ${{ steps.meta.outputs.tags }}
96+
labels: ${{ steps.meta.outputs.labels }}
97+
cache-from: type=gha
98+
cache-to: type=gha,mode=max
99+
100+
# Sign the resulting Docker image digest except on PRs.
101+
# This will only write to the public Rekor transparency log when the Docker
102+
# repository is public to avoid leaking data. If you would like to publish
103+
# transparency data even for private images, pass --force to cosign below.
104+
# https://github.com/sigstore/cosign
105+
- name: Sign the published Docker image
106+
if: ${{ github.event_name != 'pull_request' }}
107+
env:
108+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
109+
TAGS: ${{ steps.meta.outputs.tags }}
110+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
111+
# This step uses the identity token to provision an ephemeral certificate
112+
# against the sigstore community Fulcio instance.
113+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
114+
115+
- name: Verify ghcr image signatures
116+
if: ${{ github.event_name != 'pull_request' }}
117+
shell: bash
118+
env:
119+
COSIGN_EXPERIMENTAL: 1
120+
TAGS: ${{ steps.meta.outputs.tags }}
121+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
122+
run: |
123+
echo "${TAGS}" | xargs -I {} cosign verify \
124+
--certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-debug.yml@${{ github.ref }} \
125+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
126+
"{}@${DIGEST}"

‎README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,50 @@ docker compose stop bitcoin
7575

7676
You can check the bootstrap process with the `hc.sh` script. `./hc <your-provided-password>`
7777

78+
# Debugging
79+
80+
Distroless images do not contain a shell to run commands for debugging. Sidecar debug containers, attached to the main container through shared namespaces, need to be used.
81+
82+
Attaching a debug container:
83+
```
84+
docker run \
85+
--rm -it --privileged \
86+
--net=container:<node-name> --pid=container:<node-name> \
87+
ghcr.io/flare-foundation/connected-chains-docker/distroless-debug:1.0.0
88+
```
89+
90+
Example commands:
91+
```
92+
# attach to running bitcoin node's namespaces
93+
# and open an interactive terminal
94+
docker run \
95+
--rm -it --privileged \
96+
--net=container:bitcoin --pid=container:bitcoin \
97+
ghcr.io/flare-foundation/connected-chains-docker/distroless-debug:1.0.0
98+
99+
# show processes of main and debug container
100+
ps aux
101+
102+
# show contents of PID 1 (main container process) root directory
103+
ls -lha /proc/1/root/
104+
105+
# show contents of bitcoin node directory
106+
ls -lha /proc/1/root/opt/bitcoin/
107+
```
108+
109+
Add tools by specifying them in `./images/debug/Dockerfile` or use your own debugging image.
110+
111+
## Releasing debug image with Github Actions
112+
113+
Commits to main with changes to `images/debug/**` context will automatically trigger a rebuild and push of image, with tag sourced from `ARG VERSION=<semver>` (suffixes and prefix 'v' allowed) in Dockerfile.
114+
115+
For development purposes, you can also trigger the pipeline with a custom tag like so (the commit still needs to have made changes to `images/debug/**` context):
116+
117+
```
118+
git tag -a <tag-name> -m "<message>"
119+
git push origin <tag-name>
120+
```
121+
78122
# Logs
79123

80124
```

‎docker-compose-testnet.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
services:
22
bitcoin:
3+
container_name: bitcoin
34
image: flarefoundation/bitcoin:29.0
45
restart: on-failure:3
56
environment:
@@ -12,6 +13,7 @@ services:
1213
- ./config-testnet/bitcoin/bitcoin.conf:/opt/bitcoin/.bitcoin/bitcoin.conf
1314

1415
litecoin:
16+
container_name: litecoin
1517
image: flarefoundation/litecoin:0.21.4
1618
restart: on-failure:3
1719
environment:
@@ -24,6 +26,7 @@ services:
2426
- ./config-testnet/litecoin/litecoin.conf:/opt/litecoin/.litecoin/litecoin.conf
2527

2628
dogecoin:
29+
container_name: dogecoin
2730
image: flarefoundation/dogecoin:1.14.9
2831
restart: on-failure:3
2932
environment:
@@ -36,6 +39,7 @@ services:
3639
- ./config-testnet/dogecoin/dogecoin.conf:/opt/dogecoin/.dogecoin/dogecoin.conf
3740

3841
rippled:
42+
container_name: rippled
3943
image: flarefoundation/rippled:2.5.0
4044
restart: on-failure:3
4145
environment:
@@ -53,6 +57,7 @@ services:
5357
- ./config-testnet/ripple/validators.txt:/opt/ripple/.ripple/validators.txt
5458

5559
algorand:
60+
container_name: algorand
5661
image: flarefoundation/algorand:4.1.2
5762
restart: on-failure:3
5863
ports:

‎docker-compose.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
services:
22
bitcoin:
3+
container_name: bitcoin
34
image: flarefoundation/bitcoin:29.0
45
restart: on-failure:3
56
environment:
@@ -11,6 +12,7 @@ services:
1112
- ./config/bitcoin/bitcoin.conf:/opt/bitcoin/.bitcoin/bitcoin.conf
1213

1314
litecoin:
15+
container_name: litecoin
1416
image: flarefoundation/litecoin:0.21.4
1517
restart: on-failure:3
1618
environment:
@@ -22,6 +24,7 @@ services:
2224
- ./config/litecoin/litecoin.conf:/opt/litecoin/.litecoin/litecoin.conf
2325

2426
dogecoin:
27+
container_name: dogecoin
2528
image: flarefoundation/dogecoin:1.14.9
2629
restart: on-failure:3
2730
environment:
@@ -33,6 +36,7 @@ services:
3336
- ./config/dogecoin/dogecoin.conf:/opt/dogecoin/.dogecoin/dogecoin.conf
3437

3538
rippled:
39+
container_name: rippled
3640
image: flarefoundation/rippled:2.5.0
3741
restart: on-failure:3
3842
environment:
@@ -50,6 +54,7 @@ services:
5054
- ./config/ripple/validators.txt:/opt/ripple/.ripple/validators.txt
5155

5256
algorand:
57+
container_name: algorand
5358
image: flarefoundation/algorand:4.1.2
5459
restart: on-failure:3
5560
ports:

‎images/debug/Dockerfile‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# syntax=docker/dockerfile:1.3-labs
2+
FROM debian:12@sha256:b6507e340c43553136f5078284c8c68d86ec8262b1724dde73c325e8d3dcdeba as final
3+
4+
ARG VERSION=v1.0.0
5+
6+
RUN apt-get update && apt-get install -y \
7+
curl \
8+
jq \
9+
procps \
10+
netcat-openbsd \
11+
tcpdump \
12+
strace \
13+
net-tools \
14+
iproute2 \
15+
vim \
16+
nano \
17+
less \
18+
tree
19+
20+
ENTRYPOINT ["/bin/bash"]

‎images/debug/build.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
docker build -t flarefoundation/distroless-debug:1.0.0 .

0 commit comments

Comments
 (0)