Publish release Docker images per binary

Author: terion-name

.github/workflows/release.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 jobs:
   release:
@@ -101,3 +102,60 @@ jobs:
           else
             gh release create "${TAG_NAME}" dist/* --title "${TAG_NAME}" --notes "Release ${TAG_NAME}"
           fi
+
+  docker-images:
+    name: Build and publish ${{ matrix.app }} image
+    runs-on: ubuntu-latest
+    needs: release
+    strategy:
+      fail-fast: false
+      matrix:
+        app:
+          - edge-gateway
+          - private-connector
+          - signurl
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare image name
+        id: image
+        env:
+          REPOSITORY: ${{ github.repository }}
+          APP: ${{ matrix.app }}
+        run: |
+          set -euo pipefail
+          repository="${REPOSITORY,,}"
+          echo "name=ghcr.io/${repository}/${APP}" >> "${GITHUB_OUTPUT}"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          build-args: |
+            APP=${{ matrix.app }}
+          tags: |
+            ${{ steps.image.outputs.name }}:${{ github.ref_name }}
+          labels: |
+            org.opencontainers.image.title=air3 ${{ matrix.app }}
+            org.opencontainers.image.description=air3 ${{ matrix.app }} release image
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ github.ref_name }}

Dockerfile

@@ -1,23 +1,32 @@
 # syntax=docker/dockerfile:1
 
-# Repository foundation image. The binaries are placeholders until runtime behavior
-# is implemented, but this build path is intended to remain the multi-binary path.
-FROM golang:1.22-alpine AS build
+ARG GO_VERSION=1.22
+ARG ALPINE_VERSION=3.20
+
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build
 WORKDIR /src
 
-COPY go.mod ./
+ARG APP=edge-gateway
+ARG TARGETOS=linux
+ARG TARGETARCH
+
+COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -o /out/edge-gateway ./cmd/edge-gateway \
- && CGO_ENABLED=0 GOOS=linux go build -o /out/private-connector ./cmd/private-connector \
- && CGO_ENABLED=0 GOOS=linux go build -o /out/signurl ./cmd/signurl
+RUN case "${APP}" in \
+      edge-gateway|private-connector|signurl) ;; \
+      *) echo "unsupported APP=${APP}" >&2; exit 1 ;; \
+    esac \
+ && targetos="${TARGETOS:-linux}" \
+ && targetarch="${TARGETARCH:-$(go env GOARCH)}" \
+ && CGO_ENABLED=0 GOOS="${targetos}" GOARCH="${targetarch}" \
+      go build -trimpath -ldflags="-s -w" -o /out/air3 "./cmd/${APP}"
 
-FROM alpine:3.20
+FROM alpine:${ALPINE_VERSION}
 RUN adduser -D -H -u 10001 appuser
-COPY --from=build /out/ /usr/local/bin/
+COPY --from=build /out/air3 /usr/local/bin/air3
 USER appuser
 
-# Run the edge gateway by default. Override the command to run another binary,
-# for example: docker run --rm air3 /usr/local/bin/private-connector
-CMD ["/usr/local/bin/edge-gateway"]
+# The selected APP binary is copied to this stable runtime path.
+CMD ["/usr/local/bin/air3"]

README.md

@@ -65,6 +65,20 @@ go test ./... -race  # run race-enabled Go tests (expected to pass)
 
 Pushing a bare semver-like tag such as `0.0.1` runs the release workflow. The workflow tests the Go packages, validates the Compose file when Docker Compose is available, cross-compiles `edge-gateway`, `private-connector`, and `signurl` for Linux, macOS, and Windows on amd64 and arm64, uploads the packaged artifacts, and publishes them to the GitHub Release for the tag with SHA-256 checksums.
 
+The same release workflow also publishes separate multi-architecture Linux images to GitHub Container Registry. Images are tagged with the release tag:
+
+- `ghcr.io/terion-name/air3/edge-gateway:<tag>`
+- `ghcr.io/terion-name/air3/private-connector:<tag>`
+- `ghcr.io/terion-name/air3/signurl:<tag>`
+
+Pull a released image with, for example:
+
+```sh
+docker pull ghcr.io/terion-name/air3/edge-gateway:0.0.1
+docker pull ghcr.io/terion-name/air3/private-connector:0.0.1
+docker pull ghcr.io/terion-name/air3/signurl:0.0.1
+```
+
 ## Docker Compose demo quickstart
 
 The demo starts four runtime services:
@@ -119,4 +133,12 @@ When URL signing is enabled, a ranged request must include the range claim in th
 
 ## Docker image
 
-The root `Dockerfile` builds all three binaries into a small runtime image. The Compose demo overrides the command per service to run either `/usr/local/bin/edge-gateway` or `/usr/local/bin/private-connector`.
+The root `Dockerfile` builds one selected binary into a small runtime image. Select the command with the `APP` build argument; supported values are `edge-gateway`, `private-connector`, and `signurl`. The selected binary is copied to `/usr/local/bin/air3`, which is the image default command.
+
+```sh
+docker build --build-arg APP=edge-gateway -t air3-edge-gateway:dev .
+docker build --build-arg APP=private-connector -t air3-private-connector:dev .
+docker build --build-arg APP=signurl -t air3-signurl:dev .
+```
+
+The Compose demo sets `APP` per service and builds separate local images for `edge-gateway` and `private-connector`.

deploy/compose.yaml

@@ -18,8 +18,9 @@ services:
   edge-gateway:
     build:
       context: ..
-    image: air3:demo
-    command: ["/usr/local/bin/edge-gateway"]
+      args:
+        APP: edge-gateway
+    image: air3-edge-gateway:demo
     depends_on:
       nats:
         condition: service_healthy
@@ -54,8 +55,9 @@ services:
   private-connector:
     build:
       context: ..
-    image: air3:demo
-    command: ["/usr/local/bin/private-connector"]
+      args:
+        APP: private-connector
+    image: air3-private-connector:demo
     depends_on:
       nats:
         condition: service_healthy