Skip to content

Commit 22b8f17

Browse files
catatsuycatatsuy
authored
Merge pull request #848 from isucon/feature-update-dockerfiles-and-run-scripts
Refactor Dockerfile to use multi-stage builds and add non-privileged user
2 parents 2c567c5 + 4c2976c commit 22b8f17

File tree

7 files changed

+121
-35
lines changed

7 files changed

+121
-35
lines changed

‎.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ jobs:
9191
- name: Run the benchmark
9292
continue-on-error: true
9393
run: |
94-
docker run --add-host host.docker.internal:host-gateway -p 5678:5678 -p 7890:7890 -i isucari-benchmarker /opt/go/benchmarker -target-url http://host.docker.internal -data-dir /initial-data -static-dir /static -payment-url http://host.docker.internal:5678 -payment-port 5678 -shipment-url http://host.docker.internal:7890 -shipment-port 7890 || echo "BENCHMARK_FAILED=true" >> $GITHUB_ENV
94+
docker container run --add-host host.docker.internal:host-gateway -p 5678:5678 -p 7890:7890 -i isucari-benchmarker /bin/benchmarker -target-url http://host.docker.internal -data-dir /initial-data -static-dir /static -payment-url http://host.docker.internal:5678 -payment-port 5678 -shipment-url http://host.docker.internal:7890 -shipment-port 7890 || echo "BENCHMARK_FAILED=true" >> $GITHUB_ENV
9595
9696
- name: Show logs
9797
run: |

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ docker compose up
251251
docker build -t isucari-benchmarker -f bench/Dockerfile .
252252

253253
# benchmarkerの実行（Linuxは --add-host host.docker.internal:host-gateway を追加）
254-
docker run -p 5678:5678 -p 7890:7890 -i isucari-benchmarker /opt/go/benchmarker -target-url http://host.docker.internal -data-dir /initial-data -static-dir /static -payment-url http://host.docker.internal:5678 -payment-port 5678 -shipment-url http://host.docker.internal:7890 -shipment-port 7890
254+
docker container run -p 5678:5678 -p 7890:7890 -i isucari-benchmarker /bin/benchmarker -target-url http://host.docker.internal -data-dir /initial-data -static-dir /static -payment-url http://host.docker.internal:5678 -payment-port 5678 -shipment-url http://host.docker.internal:7890 -shipment-port 7890
255255
```
256256

257257
### external service

‎bench/Dockerfile

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,46 @@
1-
FROM golang:1.22
1+
# syntax=docker/dockerfile:1
22

3-
RUN mkdir -p /opt/go
4-
WORKDIR /opt/go
3+
FROM --platform=$BUILDPLATFORM golang:1.22 AS build
4+
WORKDIR /src
5+
6+
RUN --mount=type=cache,target=/go/pkg/mod/ \
7+
--mount=type=bind,source=go.sum,target=go.sum \
8+
--mount=type=bind,source=go.mod,target=go.mod \
9+
go mod download -x
10+
11+
RUN --mount=type=cache,target=/go/pkg/mod/ \
12+
--mount=type=bind,target=. \
13+
CGO_ENABLED=0 go build -o /bin/benchmarker cmd/bench/main.go
14+
15+
16+
FROM alpine:latest AS final
17+
18+
RUN --mount=type=cache,target=/var/cache/apk \
19+
apk --update add \
20+
ca-certificates \
21+
tzdata \
22+
&& \
23+
update-ca-certificates
24+
25+
# Create a non-privileged user that the app will run under.
26+
# See https://docs.docker.com/go/dockerfile-user-best-practices/
27+
ARG UID=10001
28+
RUN adduser \
29+
--disabled-password \
30+
--gecos "" \
31+
--home "/nonexistent" \
32+
--shell "/sbin/nologin" \
33+
--no-create-home \
34+
--uid "${UID}" \
35+
appuser
36+
USER appuser
537

638
COPY initial-data /initial-data
739
COPY webapp/public/static /static
840

9-
COPY go.mod /opt/go/go.mod
10-
COPY go.sum /opt/go/go.sum
11-
RUN go mod download
12-
13-
COPY cmd/ /opt/go/cmd
14-
COPY bench/ /opt/go/bench
41+
COPY bench/run.sh /run.sh
1542

16-
RUN go build -o benchmarker cmd/bench/main.go
43+
# Copy the executable from the "build" stage.
44+
COPY --from=build /bin/benchmarker /bin/
1745

18-
ENTRYPOINT ["/opt/go/bench/run.sh"]
46+
ENTRYPOINT ["/run.sh"]

‎bench/Dockerfile-payment

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,43 @@
1-
FROM golang:1.22
1+
# syntax=docker/dockerfile:1
22

3-
RUN mkdir -p /opt/go
4-
WORKDIR /opt/go
3+
FROM --platform=$BUILDPLATFORM golang:1.22 AS build
4+
WORKDIR /src
55

6-
COPY go.mod /opt/go/go.mod
7-
COPY go.sum /opt/go/go.sum
8-
RUN go mod download
6+
RUN --mount=type=cache,target=/go/pkg/mod/ \
7+
--mount=type=bind,source=go.sum,target=go.sum \
8+
--mount=type=bind,source=go.mod,target=go.mod \
9+
go mod download -x
910

10-
COPY cmd/ /opt/go/cmd
11-
COPY bench/ /opt/go/bench
11+
RUN --mount=type=cache,target=/go/pkg/mod/ \
12+
--mount=type=bind,target=. \
13+
CGO_ENABLED=0 go build -o /bin/server cmd/payment/main.go
1214

13-
RUN go build -o bin/payment cmd/payment/main.go
15+
FROM alpine:latest AS final
1416

15-
CMD [ "/opt/go/bin/payment", "-port", "5556" ]
17+
RUN --mount=type=cache,target=/var/cache/apk \
18+
apk --update add \
19+
ca-certificates \
20+
tzdata \
21+
&& \
22+
update-ca-certificates
23+
24+
# Create a non-privileged user that the app will run under.
25+
# See https://docs.docker.com/go/dockerfile-user-best-practices/
26+
ARG UID=10001
27+
RUN adduser \
28+
--disabled-password \
29+
--gecos "" \
30+
--home "/nonexistent" \
31+
--shell "/sbin/nologin" \
32+
--no-create-home \
33+
--uid "${UID}" \
34+
appuser
35+
USER appuser
36+
37+
# Copy the executable from the "build" stage.
38+
COPY --from=build /bin/server /bin/
39+
40+
EXPOSE 5556
41+
42+
# What the container should run when it is started.
43+
ENTRYPOINT [ "/bin/server", "-port", "5556" ]

‎bench/Dockerfile-shipment

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,45 @@
1-
FROM golang:1.22
1+
# syntax=docker/dockerfile:1
22

3-
RUN mkdir -p /opt/go
4-
WORKDIR /opt/go
3+
FROM --platform=$BUILDPLATFORM golang:1.22 AS build
4+
WORKDIR /src
55

6-
COPY initial-data /initial-data
6+
RUN --mount=type=cache,target=/go/pkg/mod/ \
7+
--mount=type=bind,source=go.sum,target=go.sum \
8+
--mount=type=bind,source=go.mod,target=go.mod \
9+
go mod download -x
10+
11+
RUN --mount=type=cache,target=/go/pkg/mod/ \
12+
--mount=type=bind,target=. \
13+
CGO_ENABLED=0 go build -o /bin/server cmd/shipment/main.go
14+
15+
FROM alpine:latest AS final
716

8-
COPY go.mod /opt/go/go.mod
9-
COPY go.sum /opt/go/go.sum
10-
RUN go mod download
17+
RUN --mount=type=cache,target=/var/cache/apk \
18+
apk --update add \
19+
ca-certificates \
20+
tzdata \
21+
&& \
22+
update-ca-certificates
23+
24+
# Create a non-privileged user that the app will run under.
25+
# See https://docs.docker.com/go/dockerfile-user-best-practices/
26+
ARG UID=10001
27+
RUN adduser \
28+
--disabled-password \
29+
--gecos "" \
30+
--home "/nonexistent" \
31+
--shell "/sbin/nologin" \
32+
--no-create-home \
33+
--uid "${UID}" \
34+
appuser
35+
USER appuser
36+
37+
COPY initial-data /initial-data
1138

12-
COPY cmd/ /opt/go/cmd
13-
COPY bench/ /opt/go/bench
39+
# Copy the executable from the "build" stage.
40+
COPY --from=build /bin/server /bin/
1441

15-
RUN go build -o bin/shipment cmd/shipment/main.go
42+
EXPOSE 7002
1643

17-
CMD [ "/opt/go/bin/shipment", "-data-dir", "/initial-data", "-port", "7002" ]
44+
# What the container should run when it is started.
45+
ENTRYPOINT [ "/bin/server", "-data-dir", "/initial-data", "-port", "7002" ]

‎bench/run.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
#!/bin/bash
1+
#!/bin/sh
22

33
exec "$@"

‎compose.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ services:
44
build:
55
context: .
66
dockerfile: bench/Dockerfile-payment
7+
target: final
78
ports:
89
- "5556:5556"
910

1011
shipment:
1112
build:
1213
context: .
1314
dockerfile: bench/Dockerfile-shipment
15+
target: final
1416
ports:
1517
- "7002:7002"

0 commit comments

Comments
 (0)