build under konflux (first approach)#178
build under konflux (first approach)#178openshift-merge-bot[bot] merged 1 commit intorh-ecosystem-edge:mainfrom rauhersu:main.konflux.dockerfile
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rauhersu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
WalkthroughThis pull request adds a new Dockerfile at Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Build as Build Stage (RHEL)
participant Runtime as Runtime Stage (Minimal RHEL)
Dev->>Build: Initiate Docker build process
Build->>Build: Set working directory and copy source files
Build->>Build: Register system (subscription via org and key files)
Build->>Build: Install Rust toolset and protobuf compiler
Build->>Build: Compile `recert` in release mode
Build->>Runtime: Transfer the compiled `recert` binary
Runtime->>Runtime: Install openssh-clients package
Runtime->>Runtime: Set working directory and place `recert` at /usr/local/bin
Runtime->>Dev: Set container entrypoint to `recert` binary
Suggested labels
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.konflux/Dockerfile.konflux (2)
3-3: Absolute WORKDIR Path for Build StageThe
WORKDIR appdirective should specify an absolute path to ensure clarity and consistency with Docker best practices (as noted by Hadolint DL3000). Consider updating it to:- WORKDIR app + WORKDIR /app🧰 Tools
🪛 Hadolint (2.12.0)
[error] 3-3: Use absolute WORKDIR
(DL3000)
19-19: Absolute WORKDIR Path for Runtime StageSimilar to the build stage, the
WORKDIR appin the runtime stage should be an absolute path for clarity and to adhere to Docker best practices. Update it to:- WORKDIR app + WORKDIR /app🧰 Tools
🪛 Hadolint (2.12.0)
[error] 19-19: Use absolute WORKDIR
(DL3000)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.konflux/Dockerfile.konflux(1 hunks)
🧰 Additional context used
🪛 Hadolint (2.12.0)
.konflux/Dockerfile.konflux
[error] 3-3: Use absolute WORKDIR
(DL3000)
[error] 19-19: Use absolute WORKDIR
(DL3000)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build
🔇 Additional comments (4)
.konflux/Dockerfile.konflux (4)
6-7: Verify Subscription Manager UsageThe commands for registering the system and disabling repositories are structured correctly. Ensure that the key files (
/activation-key/organd/activation-key/activationkey) exist at runtime in the build context to prevent registration failures.
8-10: Efficient Package InstallationThe approach to define the
PKGSvariable and install the Rust toolset and protobuf compiler in one RUN statement is efficient. The subsequent clean-up of the package cache is also appropriate to minimize the image size.
11-11: Proper Build Command for Rust ApplicationThe command
cargo build --release --bin recertfollows best practices for building a release binary. This ensures that the final binary is optimized for production.
20-21: Correct Binary Placement and Entry PointThe binary is correctly copied from the build stage to
/usr/local/binand the ENTRYPOINT is properly set to execute therecertbinary.
|
/assign @fontivan For lgtm |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.konflux/Dockerfile (3)
3-3: Use an Absolute WORKDIR in the Build StageHadolint [DL3000] recommends using an absolute path for WORKDIR. Update this line from:
- WORKDIR app + WORKDIR /appThis change improves clarity and aligns with Docker best practices.
🧰 Tools
🪛 Hadolint (2.12.0)
[error] 3-3: Use absolute WORKDIR
(DL3000)
6-7: Secure Subscription Registration HandlingThe RUN command that registers the system using output from files (
/activation-key/organd/activation-key/activationkey) could expose sensitive details if not managed securely. Please verify that these files are secured and consider using Docker build secrets if appropriate.
19-19: Use an Absolute WORKDIR in the Runtime StageHadolint again flags the relative WORKDIR usage. Please change:
- WORKDIR app + WORKDIR /appThis ensures consistency and clarity in the container’s filesystem layout.
🧰 Tools
🪛 Hadolint (2.12.0)
[error] 19-19: Use absolute WORKDIR
(DL3000)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.konflux/Dockerfile(1 hunks)
🧰 Additional context used
🪛 Hadolint (2.12.0)
.konflux/Dockerfile
[error] 3-3: Use absolute WORKDIR
(DL3000)
[error] 19-19: Use absolute WORKDIR
(DL3000)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build
🔇 Additional comments (4)
.konflux/Dockerfile (4)
8-10: Verify Package Installation RequirementsThe commands installing
rust-toolsetandprotobuf-compilerlook correct. Just ensure that the package versions meet your security and compatibility requirements. If specific versions are needed, consider pinning them.
11-11: Cargo Build Command ValidationThe cargo build command is straightforward and correctly builds the
recertbinary. Confirm that any necessary build flags or environment variables (if needed) are configured elsewhere.
14-17: Runtime Stage Setup is SolidThe runtime stage appropriately uses a minimal RHEL image and installs
openssh-clientsvia microdnf. This setup is efficient for production use. Ensure that the OpenSSH client configuration aligns with your security guidelines.
20-21: Binary Placement and Entrypoint ConfigurationCopying the compiled
recertbinary to/usr/local/binand setting it as the entry point is a best practice for containerized applications. No changes are necessary here.
|
/retest-required |
|
/override ci/prow/e2e-aws-ovn-single-node-recert-parallel ci/prow/e2e-aws-ovn-single-node-recert-serial |
|
@mresvanis: Overrode contexts on behalf of mresvanis: ci/prow/e2e-aws-ovn-single-node-recert-parallel, ci/prow/e2e-aws-ovn-single-node-recert-serial DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/lgtm |
openshift-merge-bot
bot
merged commit 5d7322d
into
rh-ecosystem-edge:main
3 participants
Summary by CodeRabbit