Merge pull request grafana/phlare#16 from grafana/20220609_docker_image

Add docker image and pipelines

.github/workflows/test.yml

@@ -35,3 +35,38 @@ jobs:
       if: matrix.os == 'ubuntu-latest'
     - name: Test
       run: make go/test
+
+  build-image:
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Build image
+        run: make docker-image/fire/build
+
+  build-and-push-image:
+    if: github.event_name == 'push' && github.repository == 'grafana/fire'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to GCR
+        uses: docker/login-action@v2
+        with:
+          registry: us.gcr.io
+          username: _json_key
+          password: ${{ secrets.GCR_JSON_KEY }}
+      - name: Build & push multi-arch image
+        run: make docker-image/fire/push IMAGE_PLATFORM=linux/arm/v7,linux/arm64/v8,linux/amd64

Makefile

@@ -11,6 +11,19 @@ COPYRIGHT_YEARS := 2021-2022
 LICENSE_IGNORE := -e /testdata/
 GO_TEST_FLAGS ?= -v -race -cover
 
+IMAGE_PLATFORM = linux/amd64
+
+# Boiler plate for building Docker containers.
+# All this must go at top of file I'm afraid.
+IMAGE_PREFIX ?= us.gcr.io/kubernetes-dev/
+
+IMAGE_TAG ?= $(shell ./tools/image-tag)
+GIT_REVISION := $(shell git rev-parse --short HEAD)
+GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
+
+GO_LDFLAGS   := -X $(VPREFIX).Branch=$(GIT_BRANCH) -X $(VPREFIX).Version=$(IMAGE_TAG) -X $(VPREFIX).Revision=$(GIT_REVISION) -X $(VPREFIX).BuildUser=$(shell whoami)@$(shell hostname) -X $(VPREFIX).BuildDate=$(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
+GO_FLAGS     := -ldflags "-extldflags \"-static\" -s -w $(GO_LDFLAGS)" -tags netgo -mod=mod
+
 .PHONY: help
 help: ## Describe useful make targets
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "%-30s %s\n", $$1, $$2}'
@@ -43,7 +56,7 @@ go/deps:
 .PHONY: go/bin
 go/bin:
 	mkdir -p ./bin
-	$(GO) build -o bin/ ./cmd/fire
+	CGO_ENABLED=0 $(GO) build $(GO_FLAGS) -o bin/ ./cmd/fire
 
 .PHONY: go/lint
 go/lint: $(BIN)/golangci-lint
@@ -72,6 +85,19 @@ check/unstaged-changes:
 check/go/mod: go/mod
 	@git --no-pager diff --exit-code -- go.sum go.mod vendor/ || { echo ">> There are unstaged changes in go vendoring run 'make go/mod'"; exit 1; }
 
+
+define docker_buildx
+	docker buildx build $(1) --platform $(IMAGE_PLATFORM) --build-arg=revision=$(GIT_REVISION) -t $(IMAGE_PREFIX)$(shell basename $(@D)) -t $(IMAGE_PREFIX)$(shell basename $(@D)):$(IMAGE_TAG) -f cmd/$(shell basename $(@D))/Dockerfile .
+endef
+
+.PHONY: docker-image/fire/build
+docker-image/fire/build:
+	$(call docker_buildx,)
+
+.PHONY: docker-image/fire/push
+docker-image/fire/push:
+	$(call docker_buildx,--push)
+
 .PHONY: clean
 clean: ## Delete intermediate build artifacts
 	@# -X only removes untracked files, -d recurses into directories, -f actually removes files/dirs

cmd/fire/Dockerfile

@@ -0,0 +1,28 @@
+FROM golang:1.18.2 as build
+
+WORKDIR /src/fire
+
+COPY go.mod go.sum /src/fire/
+RUN go mod download
+
+COPY . /src/fire
+
+RUN make clean build
+
+FROM alpine:3.16.0
+
+RUN apk add --no-cache ca-certificates
+
+COPY --from=build /src/fire/bin/fire /usr/bin/fire
+COPY cmd/fire/fire.yaml /etc/fire/config.yaml
+
+RUN addgroup -g 10001 -S fire && \
+    adduser -u 10001 -S fire -G fire
+RUN mkdir -p /fire/rules && \
+    mkdir -p /fire/rules-temp && \
+    chown -R fire:fire /etc/fire /fire
+
+USER fire
+EXPOSE 4100
+ENTRYPOINT [ "/usr/bin/fire" ]
+CMD ["-config.file=/etc/fire/config.yaml"]

tools/image-tag

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Provenance-includes-location: https://github.com/cortexproject/cortex/blob/master/tools/image-tag
+# Provenance-includes-license: Apache-2.0
+# Provenance-includes-copyright: The Cortex Authors.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+WORKING_SUFFIX=$(if git status --porcelain | grep -qE '^(?:[^?][^ ]|[^ ][^?])\s'; then echo "-WIP"; else echo ""; fi)
+BRANCH_PREFIX=$(git rev-parse --abbrev-ref HEAD)
+echo "${BRANCH_PREFIX//\//-}-$(git rev-parse --short HEAD)$WORKING_SUFFIX"