Skip to content

Commit 8235431

Browse files
marvinsxtrmarvinsxtr
committed
Update code
1 parent f7bf72f commit 8235431

28 files changed

Lines changed: 1997 additions & 1667 deletions

Dockerfile renamed to .devcontainer/Dockerfile

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
1-
FROM --platform=linux/amd64 python:3.12-slim AS linux-base
1+
FROM python:3.12-slim AS linux-base
2+
3+
ARG TARGETARCH
24

35
# Utilities
46
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends build-essential \
5-
sudo curl git htop less rsync screen vim nano wget ca-certificates openssh-client zsh procps psmisc
7+
sudo curl git htop less rsync screen vim nano wget ca-certificates openssh-client zsh procps psmisc \
8+
iptables ipset iproute2 dnsutils aggregate jq gfortran pkg-config
69

710
# Download and install VS Code Server CLI
8-
RUN wget -O /tmp/vscode-server-cli.tar.gz "https://update.code.visualstudio.com/latest/cli-linux-x64/stable" && \
11+
RUN ARCH="$TARGETARCH" && [ "$ARCH" = "amd64" ] && ARCH="x64"; \
12+
wget -O /tmp/vscode-server-cli.tar.gz "https://update.code.visualstudio.com/latest/cli-linux-${ARCH}/stable" && \
913
mkdir -p /usr/local/bin && \
1014
tar -xf /tmp/vscode-server-cli.tar.gz -C /usr/local/bin && \
1115
rm /tmp/vscode-server-cli.tar.gz
@@ -16,9 +20,11 @@ RUN COMMANDS="sacct sacctmgr salloc sattach sbatch sbcast scancel scontrol sdiag
1620
&& echo 'ssh $USER@$SLURM_CLUSTER_NAME -t "cd $PWD; . ~/.zshrc 2>/dev/null || . ~/.bashrc 2>/dev/null; bash -lc '\'$CMD \$@\''"' >> "/usr/local/bin/$CMD" \
1721
&& chmod +x "/usr/local/bin/$CMD"; done
1822

23+
# Non-root user
24+
RUN useradd -m -s /bin/bash devuser
25+
1926
FROM linux-base AS python-base
2027

21-
# Workdir
2228
WORKDIR /srv/repo
2329

2430
# Environment variables
@@ -30,13 +36,15 @@ ENV UV_PYTHON=python3.12
3036
ENV PATH="$UV_PROJECT_ENVIRONMENT/bin:$PATH"
3137
ENV PYTHONPATH="/srv/repo:$PYTHONPATH"
3238
# See https://github.com/jax-ml/jax/issues/29260
33-
ENV LD_LIBRARY_PATH=/venv/lib/python3.12/site-packages/nvidia/cuda_nvrtc/lib:$LD_LIBRARY_PATH
39+
ENV LD_LIBRARY_PATH="/venv/lib/python3.12/site-packages/nvidia/cuda_nvrtc/lib:$LD_LIBRARY_PATH"
3440

3541
# Install uv
3642
COPY --from=ghcr.io/astral-sh/uv:0.6.6 /uv /usr/local/bin/uv
43+
RUN mkdir -p /venv && chown devuser:devuser /venv
44+
45+
USER devuser
3746

38-
# Environment
39-
RUN --mount=type=cache,target=/root/.cache/uv \
47+
RUN --mount=type=cache,target=/home/devuser/.cache/uv,uid=1000 \
4048
--mount=type=bind,source=uv.lock,target=uv.lock \
4149
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
4250
uv sync --frozen --no-install-project --all-groups

.devcontainer.json renamed to .devcontainer/devcontainer.json

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
{
2-
"dockerFile": "Dockerfile",
3-
"build": {"args": {"BUILDPLATFORM": "linux/amd64"}},
4-
"workspaceFolder": "/srv/repo",
2+
"build": {
3+
"dockerfile": "Dockerfile",
4+
"context": ".."
5+
},
6+
"workspaceFolder": "/srv/repo",
57
"workspaceMount": "source=${localWorkspaceFolder},target=/srv/repo,type=bind",
68
"customizations": {
79
"vscode": {
810
"extensions": [
911
"ms-python.debugpy",
1012
"ms-python.python",
11-
"ms-python.vscode-pylance",
12-
"ms-python.mypy-type-checker",
13+
"astral-sh.ty",
1314
"charliermarsh.ruff",
1415
"tamasfe.even-better-toml",
1516
"ms-azuretools.vscode-docker",

‎.dockerignore‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
*
2-
!/Dockerfile
32
!/pyproject.toml
4-
!/uv.lock
3+
!/uv.lock

‎.github/workflows/docker-publish.yaml‎

Lines changed: 105 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,108 +1,152 @@
11
name: Docker
22

3-
# This workflow uses actions that are not certified by GitHub.
4-
# They are provided by a third-party and are governed by
5-
# separate terms of service, privacy policy, and support
6-
# documentation.
7-
83
on:
94
push:
10-
# Publish semver tags as releases.
11-
tags: [ 'v*.*.*' ]
5+
tags: ['v*.*.*']
126

137
env:
14-
# Use docker.io for Docker Hub if empty
158
REGISTRY: ghcr.io
16-
# github.repository as <account>/<repo>
179
IMAGE_NAME: ${{ github.repository }}
1810

19-
2011
jobs:
2112
build:
22-
23-
runs-on: ubuntu-latest
13+
runs-on: ${{ matrix.runner }}
2414
permissions:
2515
contents: read
2616
packages: write
27-
# This is used to complete the identity challenge
28-
# with sigstore/fulcio when running outside of PRs.
29-
id-token: write
30-
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
include:
21+
- platform: linux/amd64
22+
runner: ubuntu-latest
23+
- platform: linux/arm64
24+
runner: ubuntu-24.04-arm
3125
steps:
3226
- name: Checkout repository
3327
uses: actions/checkout@v4
3428

3529
- name: Clean up disk space
3630
uses: jlumbroso/free-disk-space@main
3731

38-
# Install the cosign tool except on PR
39-
# https://github.com/sigstore/cosign-installer
40-
- name: Install cosign
41-
if: github.event_name != 'pull_request'
42-
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
43-
with:
44-
cosign-release: 'v2.2.4'
45-
46-
# Set up BuildKit Docker container builder to be able to build
47-
# multi-platform images and export cache
48-
# https://github.com/docker/setup-buildx-action
4932
- name: Set up Docker Buildx
50-
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
33+
uses: docker/setup-buildx-action@v3
5134

52-
# Login against a Docker registry except on PR
53-
# https://github.com/docker/login-action
54-
- name: Log into registry ${{ env.REGISTRY }}
55-
if: github.event_name != 'pull_request'
56-
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
35+
- name: Log into registry
36+
uses: docker/login-action@v3
5737
with:
5838
registry: ${{ env.REGISTRY }}
5939
username: ${{ github.actor }}
6040
password: ${{ secrets.GITHUB_TOKEN }}
6141

62-
# Extract metadata (tags, labels) for Docker
63-
# https://github.com/docker/metadata-action
42+
- name: Repository to lowercase
43+
id: lower-repo
44+
run: echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
45+
6446
- name: Extract Docker metadata
6547
id: meta
66-
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
48+
uses: docker/metadata-action@v5
6749
with:
68-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
50+
images: ${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}
6951

70-
# Build and push Docker image with Buildx (don't push on PR)
71-
# https://github.com/docker/build-push-action
72-
- name: Build and push Docker image
73-
id: build-and-push
74-
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
52+
- name: Prepare platform pair
53+
id: platform
54+
run: echo "pair=${platform//\//-}" >> $GITHUB_OUTPUT
55+
env:
56+
platform: ${{ matrix.platform }}
57+
58+
- name: Build and push by digest
59+
id: build
60+
uses: docker/build-push-action@v5
7561
with:
7662
context: .
77-
push: ${{ github.event_name != 'pull_request' }}
78-
tags: ${{ steps.meta.outputs.tags }}
79-
labels: ${{ steps.meta.outputs.labels }}
80-
cache-from: type=gha
81-
cache-to: type=gha,mode=max
63+
file: .devcontainer/Dockerfile
64+
platforms: ${{ matrix.platform }}
65+
outputs: type=image,name=${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }},push-by-digest=true,name-canonical=true,push=true
66+
cache-from: type=gha,scope=${{ steps.platform.outputs.pair }}
67+
cache-to: type=gha,mode=max,scope=${{ steps.platform.outputs.pair }}
8268

83-
- name: Free disk space after Docker build
69+
- name: Export digest
8470
run: |
85-
docker buildx ls --format '{{.Name}}' | grep -v default | xargs -I {} docker buildx rm {} 2>/dev/null || true
86-
docker system prune -af --volumes
87-
docker builder prune -af
71+
mkdir -p /tmp/digests
72+
digest="${{ steps.build.outputs.digest }}"
73+
touch "/tmp/digests/${digest#sha256:}"
74+
75+
- name: Upload digest
76+
uses: actions/upload-artifact@v4
77+
with:
78+
name: digest-${{ steps.platform.outputs.pair }}
79+
path: /tmp/digests/*
80+
if-no-files-found: error
81+
retention-days: 1
82+
83+
merge:
84+
runs-on: ubuntu-latest
85+
needs: build
86+
permissions:
87+
contents: read
88+
packages: write
89+
steps:
90+
- name: Download digests
91+
uses: actions/download-artifact@v4
92+
with:
93+
path: /tmp/digests
94+
pattern: digest-*
95+
merge-multiple: true
96+
97+
- name: Log into registry
98+
uses: docker/login-action@v3
99+
with:
100+
registry: ${{ env.REGISTRY }}
101+
username: ${{ github.actor }}
102+
password: ${{ secrets.GITHUB_TOKEN }}
88103

89-
rm -rf ~/.docker/buildx || true
90-
rm -rf /tmp/docker-actions-toolkit-*/* 2>/dev/null || true
104+
- name: Repository to lowercase
105+
id: lower-repo
106+
run: echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
91107

92-
df -h /
108+
- name: Extract Docker metadata
109+
id: meta
110+
uses: docker/metadata-action@v5
111+
with:
112+
images: ${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}
93113

94-
- id: lower-repo
95-
name: Repository to lowercase
114+
- name: Create manifest list and push
115+
working-directory: /tmp/digests
96116
run: |
97-
echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
117+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
118+
$(printf '${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}@sha256:%s ' *)
119+
120+
apptainer:
121+
runs-on: ubuntu-latest
122+
needs: merge
123+
permissions:
124+
contents: read
125+
packages: write
126+
steps:
127+
- name: Checkout repository
128+
uses: actions/checkout@v4
129+
130+
- name: Clean up disk space
131+
uses: jlumbroso/free-disk-space@main
132+
133+
- name: Repository to lowercase
134+
id: lower-repo
135+
run: echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
136+
137+
- name: Extract Docker metadata
138+
id: meta
139+
uses: docker/metadata-action@v5
140+
with:
141+
images: ${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}
98142

99-
# Build and push .sif files for Apptainer
100143
- name: Setup Apptainer
101144
uses: eWaterCycle/setup-apptainer@v2
145+
102146
- name: Build and push Apptainer
103147
env:
104148
TAGS: ${{ steps.meta.outputs.tags }}
105149
run: |
106-
echo ${{ secrets.GITHUB_TOKEN }} | apptainer registry login -u ${{ secrets.GHCR_USERNAME }} --password-stdin docker://ghcr.io
107-
apptainer build container.sif docker://${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}:latest
108-
echo "${TAGS}" | xargs -I {} apptainer push container.sif oras://{}-sif
150+
echo ${{ secrets.GITHUB_TOKEN }} | apptainer registry login -u ${{ secrets.GHCR_USERNAME }} --password-stdin docker://ghcr.io
151+
apptainer build container.sif docker://${{ env.REGISTRY }}/${{ steps.lower-repo.outputs.repository }}:latest
152+
echo "${TAGS}" | xargs -I {} apptainer push container.sif oras://{}-sif

0 commit comments

Comments
 (0)