From bacc968b8fb228118088a3a88e75df0418e907b3 Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Wed, 14 Oct 2026 14:05:49 +0200 Subject: [PATCH] build(docker): Make the distroless image the only vroom image Every region now runs the -distroless tag, so drop the Debian stage and build one image. It is published under both the plain SHA/nightly tags and the -distroless tags, so the deploys and devservices that pull -distroless keep working until they move to the plain tags. Co-Authored-By: Claude --- .github/workflows/image.yaml | 108 ++++++++++------------------------- Dockerfile | 22 +------ 2 files changed, 30 insertions(+), 100 deletions(-) diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml index 821c289e..c6d68ab6 100644 --- a/.github/workflows/image.yaml +++ b/.github/workflows/image.yaml @@ -12,20 +12,13 @@ jobs: strategy: matrix: platform: [amd64, arm64] - variant: [default, distroless] include: - platform: amd64 os: ubuntu-24.04 - platform: arm64 os: ubuntu-24.04-arm - - variant: default - target: application - suffix: '' - - variant: distroless - target: application-distroless - suffix: '-distroless' if: github.repository_owner == 'getsentry' - name: build-${{ matrix.platform }}${{ matrix.suffix }} + name: build-${{ matrix.platform }} steps: - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0 @@ -36,12 +29,11 @@ jobs: uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . - target: ${{ matrix.target }} - cache-from: ghcr.io/getsentry/vroom:nightly${{ matrix.suffix }} + cache-from: ghcr.io/getsentry/vroom:nightly cache-to: type=inline platforms: linux/${{ matrix.platform }} - tags: vroom:${{ matrix.platform }}${{ matrix.suffix }} - outputs: type=docker,dest=/tmp/vroom-${{ matrix.platform }}${{ matrix.suffix }}.tar + tags: vroom:${{ matrix.platform }} + outputs: type=docker,dest=/tmp/vroom-${{ matrix.platform }}.tar push: false # NOTE(aldy505): Rather than pushing the individual architecture-specific image to GHCR, @@ -54,18 +46,15 @@ jobs: - name: Upload Image uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: vroom-${{ matrix.platform }}${{ matrix.suffix }} - path: /tmp/vroom-${{ matrix.platform }}${{ matrix.suffix }}.tar + name: vroom-${{ matrix.platform }} + path: /tmp/vroom-${{ matrix.platform }}.tar assemble-image: runs-on: ubuntu-latest needs: - build-image if: ${{ github.event_name != 'pull_request' }} - strategy: - matrix: - suffix: ['', '-distroless'] - name: assemble-image${{ matrix.suffix }} + name: assemble-image steps: - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0 - run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN" @@ -78,42 +67,37 @@ jobs: - name: Download amd64 Image uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4.3.2 with: - name: vroom-amd64${{ matrix.suffix }} + name: vroom-amd64 path: /tmp - name: Load amd64 Image - run: docker load --input /tmp/vroom-amd64${{ matrix.suffix }}.tar + run: docker load --input /tmp/vroom-amd64.tar - name: Download arm64 Image uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4.3.2 with: - name: vroom-arm64${{ matrix.suffix }} + name: vroom-arm64 path: /tmp - name: Load arm64 Image - run: docker load --input /tmp/vroom-arm64${{ matrix.suffix }}.tar + run: docker load --input /tmp/vroom-arm64.tar - name: Push to GitHub Container Registry - env: - SUFFIX: ${{ matrix.suffix }} run: | - docker tag vroom:amd64${SUFFIX} ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64 - docker push ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64 - docker tag vroom:arm64${SUFFIX} ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64 - docker push ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64 - - docker manifest create \ - ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX} \ - --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64 \ - --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64 - - docker manifest create \ - ghcr.io/getsentry/vroom:nightly${SUFFIX} \ - --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-amd64 \ - --amend ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX}-arm64 - - docker manifest push ghcr.io/getsentry/vroom:${{ github.sha }}${SUFFIX} - docker manifest push ghcr.io/getsentry/vroom:nightly${SUFFIX} + docker tag vroom:amd64 ghcr.io/getsentry/vroom:${{ github.sha }}-amd64 + docker push ghcr.io/getsentry/vroom:${{ github.sha }}-amd64 + docker tag vroom:arm64 ghcr.io/getsentry/vroom:${{ github.sha }}-arm64 + docker push ghcr.io/getsentry/vroom:${{ github.sha }}-arm64 + + # The image is distroless. The "-distroless" tags are kept until + # everything that pulls them (deploys, devservices) moves to the plain tags. + for tag in ${{ github.sha }} ${{ github.sha }}-distroless nightly nightly-distroless; do + docker manifest create \ + ghcr.io/getsentry/vroom:${tag} \ + --amend ghcr.io/getsentry/vroom:${{ github.sha }}-amd64 \ + --amend ghcr.io/getsentry/vroom:${{ github.sha }}-arm64 + docker manifest push ghcr.io/getsentry/vroom:${tag} + done publish-to-dockerhub: name: Publish Vroom to DockerHub @@ -146,18 +130,14 @@ jobs: - assemble-image runs-on: ubuntu-latest timeout-minutes: 30 - strategy: - fail-fast: false - matrix: - suffix: ['', '-distroless'] - name: self-hosted-end-to-end${{ matrix.suffix }} + name: self-hosted-end-to-end steps: - name: Run Sentry self-hosted e2e CI uses: getsentry/self-hosted@e29cfe002b439d8d281d51a54d574e6a31831973 # master with: project_name: vroom - image_url: ghcr.io/getsentry/vroom:${{ github.sha }}${{ matrix.suffix }} + image_url: ghcr.io/getsentry/vroom:${{ github.sha }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} @@ -182,6 +162,7 @@ jobs: tag_nightly: false tag_latest: true google_ar_image_name: us-central1-docker.pkg.dev/sentryio/vroom/vroom + tags: us-central1-docker.pkg.dev/sentryio/vroom/vroom:${{ github.sha }}-distroless google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool google_service_account: gha-vroom-push@sac-prod-sa.iam.gserviceaccount.com @@ -196,37 +177,6 @@ jobs: tag_nightly: false tag_latest: true google_ar_image_name: us-docker.pkg.dev/sentryio/vroom-mr/vroom - google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool - google_service_account: gha-vroom-push@sac-prod-sa.iam.gserviceaccount.com - - - name: Build and push distroless image to single-region registry - uses: getsentry/action-build-and-push-images@dd9b907092cdd2dbc6c1a409f7290df1b391f6ee - with: - image_name: 'vroom' - platforms: linux/amd64 - dockerfile_path: './Dockerfile' - build_target: 'application-distroless' - tag_suffix: -distroless - ghcr: false - google_ar: true - tag_nightly: false - tag_latest: false - google_ar_image_name: us-central1-docker.pkg.dev/sentryio/vroom/vroom - google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool - google_service_account: gha-vroom-push@sac-prod-sa.iam.gserviceaccount.com - - - name: Build and push distroless image to multi-region registry - uses: getsentry/action-build-and-push-images@dd9b907092cdd2dbc6c1a409f7290df1b391f6ee - with: - image_name: 'vroom' - platforms: linux/amd64 - dockerfile_path: './Dockerfile' - build_target: 'application-distroless' - tag_suffix: -distroless - ghcr: false - google_ar: true - tag_nightly: false - tag_latest: false - google_ar_image_name: us-docker.pkg.dev/sentryio/vroom-mr/vroom + tags: us-docker.pkg.dev/sentryio/vroom-mr/vroom:${{ github.sha }}-distroless google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool google_service_account: gha-vroom-push@sac-prod-sa.iam.gserviceaccount.com diff --git a/Dockerfile b/Dockerfile index ab288e78..6bf351c4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,33 +8,13 @@ RUN CGO_ENABLED=0 go build -o . -ldflags="-s -w -X main.release=$(git rev-parse # Distroless runtime: no shell or package manager. The base already ships the # CA bundle (SSL_CERT_FILE), tzdata and a world-writable /tmp. -FROM us-docker.pkg.dev/sentryio/dhi-mirror/static:20250419-debian13 AS application-distroless +FROM us-docker.pkg.dev/sentryio/dhi-mirror/static:20250419-debian13 AS application EXPOSE 8085 COPY --from=builder /src/vroom /bin/vroom WORKDIR /var/vroom -# Same uid/gid as the debian image, so existing volumes and runAsUser keep working. USER 1000:1000 ENTRYPOINT ["/bin/vroom"] - -# Debian runtime. Keep it the last stage: builds without --target produce this image. -FROM debian:trixie-slim AS application - -EXPOSE 8080 - -RUN groupadd --gid 1000 vroom \ - && useradd -g vroom --uid 1000 vroom \ - && apt-get update \ - && apt-get install -y ca-certificates tzdata --no-install-recommends \ - && apt-get clean \ - && rm -rf /var/lib/apt/lists/* - -COPY --from=builder /src/vroom /bin/vroom - -WORKDIR /var/vroom -USER vroom - -ENTRYPOINT ["/bin/vroom"]