Skip to content
Container Images

Harden Wasm cache admission fairness #102

Sign in to view logs

Harden Wasm cache admission fairness

Harden Wasm cache admission fairness #102

Workflow file for this run

.github/workflows/images.yml at c231d0b
name: Container Images
on:
workflow_dispatch:
inputs:
platforms:
description: OCI platforms to build.
required: true
default: linux/amd64
features:
description: Override all image profile feature sets. Leave empty for profile defaults.
required: false
default: ""
include_load_balancer:
description: Build the load-balancer image profile for manual dispatches before the normal load-balancer image line.
required: true
default: false
type: boolean
publish_dev_wolfi:
description: Publish the Quay-only development Wolfi image from main.
required: true
default: false
type: boolean
config:
description: Config file copied into /etc/fluxheim/fluxheim.toml.
required: false
default: ""
runtime_uid:
description: Runtime UID inside the image. Keep 65532 unless intentionally publishing a root image.
required: true
default: "65532"
runtime_gid:
description: Runtime GID inside the image. Keep 65532 unless intentionally publishing a root image.
required: true
default: "65532"
push:
tags:
- "v*"
permissions:
contents: read
packages: write
env:
CARGO_TERM_COLOR: always
jobs:
images:
if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish_dev_wolfi != 'true') }}
name: Build and publish ${{ matrix.profile.name }} ${{ matrix.variant }}
runs-on: ubuntu-latest
timeout-minutes: 90
strategy:
fail-fast: false
matrix:
variant:
- debian
- alpine
- wolfi
- suse-micro
profile:
- name: full
tag: ""
features: profile-full,acme-client,metrics,metrics-otlp,otel-tracing,otel-otlp
config: packaging/container/fluxheim.toml
wolfi_config: ""
wolfi_runtime_packages: ""
- name: cache
tag: cache
features: profile-cache-edge,acme-client
config: packaging/container/cache.toml
wolfi_config: ""
wolfi_runtime_packages: ""
- name: proxy
tag: proxy
features: profile-proxy-edge,acme-client
config: packaging/container/proxy.toml
wolfi_config: ""
wolfi_runtime_packages: ""
- name: php
tag: php
features: profile-web-server,php-fpm,acme-client
config: packaging/container/php.toml
wolfi_config: packaging/container/php-managed.toml
wolfi_runtime_packages: php-8.5-fpm
- name: load-balancer
tag: load-balancer
features: profile-load-balancer-edge,acme-client
config: packaging/container/load-balancer.toml
wolfi_config: ""
wolfi_runtime_packages: ""
env:
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
QUAY_NAMESPACE: ${{ vars.QUAY_NAMESPACE || github.repository_owner }}
QUAY_REPOSITORY: ${{ vars.QUAY_REPOSITORY || github.event.repository.name }}
INCLUDE_LOAD_BALANCER: ${{ inputs.include_load_balancer || false }}
steps:
- name: Decide image profile
id: profile
shell: bash
env:
PROFILE: ${{ matrix.profile.name }}
run: |
set -euo pipefail
build="true"
if [[ "${PROFILE}" == "load-balancer" ]]; then
if [[ "${GITHUB_EVENT_NAME}" != "push" && ! "${GITHUB_REF_NAME}" =~ ^v(1\.[5-9]|[2-9]\.) && "${INCLUDE_LOAD_BALANCER}" != "true" ]]; then
build="false"
fi
fi
echo "build=${build}" >> "${GITHUB_OUTPUT}"
if [[ "${build}" == "false" ]]; then
echo "Skipping ${PROFILE} image profile for manual ref before the load-balancer image line without include_load_balancer=true."
fi
- name: Checkout repository
if: ${{ steps.profile.outputs.build == 'true' }}
uses: actions/checkout@v7.0.0
- name: Set up QEMU
if: ${{ steps.profile.outputs.build == 'true' }}
uses: docker/setup-qemu-action@v4.2.0
- name: Set up Buildx
if: ${{ steps.profile.outputs.build == 'true' }}
uses: docker/setup-buildx-action@v4.2.0
- name: Log in to GitHub Container Registry
if: ${{ steps.profile.outputs.build == 'true' }}
uses: docker/login-action@v4.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Log in to Docker Hub
if: ${{ steps.profile.outputs.build == 'true' && env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
uses: docker/login-action@v4.4.0
with:
registry: docker.io
username: ${{ env.DOCKERHUB_USERNAME }}
password: ${{ env.DOCKERHUB_TOKEN }}
- name: Log in to Quay
if: ${{ steps.profile.outputs.build == 'true' && env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
uses: docker/login-action@v4.4.0
with:
registry: quay.io
username: ${{ env.QUAY_USERNAME }}
password: ${{ env.QUAY_TOKEN }}
- name: Prepare tags
if: ${{ steps.profile.outputs.build == 'true' }}
id: tags
shell: bash
env:
VARIANT: ${{ matrix.variant }}
PROFILE: ${{ matrix.profile.name }}
PROFILE_TAG: ${{ matrix.profile.tag }}
run: |
set -euo pipefail
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
version="${GITHUB_REF_NAME}"
else
version="dev"
fi
if [[ -n "${PROFILE_TAG}" ]]; then
variant_suffix="${PROFILE_TAG}-${VARIANT}"
else
variant_suffix="${VARIANT}"
fi
sha_suffix="${GITHUB_SHA::12}-${variant_suffix}"
tags=(
"ghcr.io/${GITHUB_REPOSITORY}:${version}-${variant_suffix}"
"ghcr.io/${GITHUB_REPOSITORY}:sha-${sha_suffix}"
)
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=("ghcr.io/${GITHUB_REPOSITORY}:latest-${variant_suffix}")
fi
if [[ "${VARIANT}" == "wolfi" ]]; then
if [[ -n "${PROFILE_TAG}" ]]; then
tags+=("ghcr.io/${GITHUB_REPOSITORY}:${version}-${PROFILE_TAG}")
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=("ghcr.io/${GITHUB_REPOSITORY}:latest-${PROFILE_TAG}")
fi
else
tags+=(
"ghcr.io/${GITHUB_REPOSITORY}:${version}"
"ghcr.io/${GITHUB_REPOSITORY}:${version}-base"
)
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=(
"ghcr.io/${GITHUB_REPOSITORY}:latest"
"ghcr.io/${GITHUB_REPOSITORY}:latest-base"
)
fi
fi
fi
if [[ -n "${DOCKERHUB_USERNAME}" ]]; then
tags+=(
"docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}-${variant_suffix}"
"docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:sha-${sha_suffix}"
)
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=("docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest-${variant_suffix}")
fi
if [[ "${VARIANT}" == "wolfi" ]]; then
if [[ -n "${PROFILE_TAG}" ]]; then
tags+=("docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}-${PROFILE_TAG}")
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=("docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest-${PROFILE_TAG}")
fi
else
tags+=(
"docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}"
"docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:${version}-base"
)
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=(
"docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest"
"docker.io/${GITHUB_REPOSITORY_OWNER}/fluxheim:latest-base"
)
fi
fi
fi
fi
if [[ -n "${QUAY_USERNAME}" ]]; then
tags+=(
"quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}-${variant_suffix}"
"quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:sha-${sha_suffix}"
)
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=("quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest-${variant_suffix}")
fi
if [[ "${VARIANT}" == "wolfi" ]]; then
if [[ -n "${PROFILE_TAG}" ]]; then
tags+=("quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}-${PROFILE_TAG}")
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=("quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest-${PROFILE_TAG}")
fi
else
tags+=(
"quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}"
"quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:${version}-base"
)
if [[ "${GITHUB_REF_NAME}" == "${DEFAULT_BRANCH}" ]]; then
tags+=(
"quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest"
"quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:latest-base"
)
fi
fi
fi
fi
{
echo "tags<<EOF"
printf '%s\n' "${tags[@]}"
echo "EOF"
} >> "${GITHUB_OUTPUT}"
- name: Resolve build inputs
if: ${{ steps.profile.outputs.build == 'true' }}
id: build-inputs
shell: bash
env:
VARIANT: ${{ matrix.variant }}
MATRIX_FEATURES: ${{ matrix.profile.features }}
MATRIX_CONFIG: ${{ matrix.profile.config }}
MATRIX_WOLFI_CONFIG: ${{ matrix.profile.wolfi_config || '' }}
MATRIX_WOLFI_RUNTIME_PACKAGES: ${{ matrix.profile.wolfi_runtime_packages || '' }}
INPUT_FEATURES: ${{ inputs.features || '' }}
INPUT_CONFIG: ${{ inputs.config || '' }}
run: |
set -euo pipefail
features="${INPUT_FEATURES:-$MATRIX_FEATURES}"
config="${INPUT_CONFIG:-$MATRIX_CONFIG}"
runtime_packages=""
if [[ "${VARIANT}" == "wolfi" && -z "${INPUT_CONFIG}" ]]; then
if [[ -n "${MATRIX_WOLFI_CONFIG}" ]]; then
config="${MATRIX_WOLFI_CONFIG}"
fi
runtime_packages="${MATRIX_WOLFI_RUNTIME_PACKAGES}"
fi
{
echo "features=${features}"
echo "config=${config}"
echo "runtime_packages=${runtime_packages}"
} >> "${GITHUB_OUTPUT}"
- name: Build and publish image
if: ${{ steps.profile.outputs.build == 'true' }}
uses: docker/build-push-action@v7.3.0
with:
context: .
file: containers/Containerfile.${{ matrix.variant }}
platforms: ${{ inputs.platforms || 'linux/amd64' }}
push: true
build-args: |
FLUXHEIM_FEATURES=${{ steps.build-inputs.outputs.features }}
FLUXHEIM_CONFIG=${{ steps.build-inputs.outputs.config }}
FLUXHEIM_RUNTIME_PACKAGES=${{ steps.build-inputs.outputs.runtime_packages }}
FLUXHEIM_RUNTIME_UID=${{ inputs.runtime_uid || '65532' }}
FLUXHEIM_RUNTIME_GID=${{ inputs.runtime_gid || '65532' }}
cache-from: type=gha,scope=images-${{ matrix.profile.name }}-${{ matrix.variant }}
cache-to: type=gha,mode=max,scope=images-${{ matrix.profile.name }}-${{ matrix.variant }}
labels: |
org.opencontainers.image.title=Fluxheim
org.opencontainers.image.description=Fluxheim static web server and reverse proxy
org.opencontainers.image.licenses=EUPL-1.2
org.opencontainers.image.source=https://github.com/${{ github.repository }}
org.opencontainers.image.revision=${{ github.sha }}
org.opencontainers.image.version=${{ github.ref_name }}
tags: ${{ steps.tags.outputs.tags }}
quay-dev-wolfi:
name: Build and publish Quay dev-wolfi
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.publish_dev_wolfi == 'true' }}
runs-on: ubuntu-latest
timeout-minutes: 90
env:
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
QUAY_NAMESPACE: ${{ vars.QUAY_NAMESPACE || github.repository_owner }}
QUAY_REPOSITORY: ${{ vars.QUAY_REPOSITORY || github.event.repository.name }}
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.0
- name: Set up Buildx
uses: docker/setup-buildx-action@v4.2.0
- name: Log in to Quay
if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
uses: docker/login-action@v4.4.0
with:
registry: quay.io
username: ${{ env.QUAY_USERNAME }}
password: ${{ env.QUAY_TOKEN }}
- name: Prepare dev tags
if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
id: dev-tags
shell: bash
run: |
set -euo pipefail
short_sha="${GITHUB_SHA::12}"
{
echo "tags<<EOF"
echo "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:dev-wolfi"
echo "quay.io/${QUAY_NAMESPACE}/${QUAY_REPOSITORY}:dev-${short_sha}-wolfi"
echo "EOF"
} >> "${GITHUB_OUTPUT}"
- name: Build and publish dev-wolfi
if: ${{ env.QUAY_USERNAME != '' && env.QUAY_TOKEN != '' }}
uses: docker/build-push-action@v7.3.0
with:
context: .
file: containers/Containerfile.wolfi
platforms: linux/amd64
push: true
build-args: |
FLUXHEIM_FEATURES=profile-development
FLUXHEIM_CONFIG=packaging/container/fluxheim.toml
FLUXHEIM_RUNTIME_UID=65532
FLUXHEIM_RUNTIME_GID=65532
cache-from: type=gha,scope=quay-dev-wolfi
cache-to: type=gha,mode=max,scope=quay-dev-wolfi
labels: |
org.opencontainers.image.title=Fluxheim Development
org.opencontainers.image.description=Fluxheim development image with all compatible production features enabled
org.opencontainers.image.licenses=EUPL-1.2
org.opencontainers.image.source=https://github.com/${{ github.repository }}
org.opencontainers.image.revision=${{ github.sha }}
org.opencontainers.image.version=dev
tags: ${{ steps.dev-tags.outputs.tags }}
- name: Skip Quay publish
if: ${{ env.QUAY_USERNAME == '' || env.QUAY_TOKEN == '' }}
run: echo "Skipping dev-wolfi publish because QUAY_USERNAME or QUAY_TOKEN is not configured."