Skip to content

Commit aff94bb

Browse files
tmaenotmaeno
authored
Merge pull request #16 from tmaeno/master
pilot container
2 parents 5e69e40 + 177d309 commit aff94bb

File tree

4 files changed

+216
-1
lines changed

4 files changed

+216
-1
lines changed

‎.github/workflows/docker-publish.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Docker
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
workflow_dispatch:
10+
release:
11+
types: [published]
12+
13+
env:
14+
# Use docker.io for Docker Hub if empty
15+
REGISTRY: ghcr.io
16+
# github.repository as <account>/<repo>
17+
IMAGE_NAME: ${{ github.repository }}
18+
19+
20+
jobs:
21+
build:
22+
23+
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
packages: write
27+
# This is used to complete the identity challenge
28+
# with sigstore/fulcio when running outside of PRs.
29+
id-token: write
30+
31+
steps:
32+
- name: Checkout repository
33+
uses: actions/checkout@v4
34+
35+
# Install the cosign tool except on PR
36+
# https://github.com/sigstore/cosign-installer
37+
- name: Install cosign
38+
if: github.event_name != 'pull_request'
39+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
40+
with:
41+
cosign-release: 'v2.2.4'
42+
43+
# Set up BuildKit Docker container builder to be able to build
44+
# multi-platform images and export cache
45+
# https://github.com/docker/setup-buildx-action
46+
- name: Set up Docker Buildx
47+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
48+
49+
# Login against a Docker registry except on PR
50+
# https://github.com/docker/login-action
51+
- name: Log into registry ${{ env.REGISTRY }}
52+
if: github.event_name != 'pull_request'
53+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
54+
with:
55+
registry: ${{ env.REGISTRY }}
56+
username: ${{ github.actor }}
57+
password: ${{ secrets.GITHUB_TOKEN }}
58+
59+
# Extract metadata (tags, labels) for Docker
60+
# https://github.com/docker/metadata-action
61+
- name: Extract Docker metadata
62+
id: meta
63+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
64+
with:
65+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
66+
67+
# Build and push Docker image with Buildx (don't push on PR)
68+
# https://github.com/docker/build-push-action
69+
- name: Build and push Docker image
70+
id: build-and-push
71+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
72+
with:
73+
context: .
74+
push: ${{ github.event_name != 'pull_request' }}
75+
tags: ${{ steps.meta.outputs.tags }}
76+
labels: ${{ steps.meta.outputs.labels }}
77+
cache-from: type=gha
78+
cache-to: type=gha,mode=max
79+
#platforms: linux/amd64,linux/arm64
80+
81+
# Sign the resulting Docker image digest except on PRs.
82+
# This will only write to the public Rekor transparency log when the Docker
83+
# repository is public to avoid leaking data. If you would like to publish
84+
# transparency data even for private images, pass --force to cosign below.
85+
# https://github.com/sigstore/cosign
86+
- name: Sign the published Docker image
87+
if: ${{ github.event_name != 'pull_request' }}
88+
env:
89+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
90+
TAGS: ${{ steps.meta.outputs.tags }}
91+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
92+
# This step uses the identity token to provision an ephemeral certificate
93+
# against the sigstore community Fulcio instance.
94+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎Dockerfile‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
ARG PILOT_VERSION=3.10.4.12
2+
3+
ARG PYTHON_VERSION=3.12.11
4+
ARG BOOST_VERSION=1.88.0
5+
6+
FROM docker.io/almalinux:9.6
7+
8+
ARG PYTHON_VERSION
9+
ARG PILOT_VERSION
10+
ARG BOOST_VERSION
11+
12+
RUN dnf install -y epel-release yum-utils \
13+
&& yum-config-manager --enable crb \
14+
&& dnf update -y
15+
16+
# install rucio dependencies
17+
RUN dnf install -y \
18+
gfal2-all \
19+
gfal2-devel \
20+
nordugrid-arc-client \
21+
nordugrid-arc-plugins-gfal \
22+
nordugrid-arc-plugins-globus \
23+
nordugrid-arc-plugins-s3 \
24+
nordugrid-arc-plugins-xrootd \
25+
xrootd-client
26+
27+
# install other dependencies mainly for building Python and Boost
28+
RUN dnf install -y gcc make voms-clients apptainer wget openssl-devel bzip2-devel libffi-devel zlib-devel \
29+
which emacs unzip cmake bzip2 gcc-c++ glib2-devel
30+
31+
# install Python
32+
RUN mkdir /tmp/python && cd /tmp/python && \
33+
wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz && \
34+
tar -xzf Python-*.tgz && rm -f Python-*.tgz && \
35+
cd Python-* && \
36+
./configure && \
37+
make altinstall && \
38+
echo /usr/local/lib > /etc/ld.so.conf.d/local.conf && ldconfig && cd / && rm -rf /tmp/python
39+
40+
# install Boost Python
41+
RUN mkdir /tmp/boost && cd /tmp/boost && \
42+
wget https://archives.boost.io/release/${BOOST_VERSION}/source/boost_$(echo ${BOOST_VERSION} | sed 's/\./_/g').tar.bz2 && \
43+
tar -xf boost_*.tar.bz2 && rm -f boost_*.tar.bz2 && \
44+
cd boost_* && \
45+
export CPLUS_INCLUDE_PATH=$CPLUS_INCLUDE_PATH:/usr/local/include/python$(echo ${PYTHON_VERSION} | sed -E 's/\.[0-9]+$//') && \
46+
./bootstrap.sh --with-python=/usr/local/bin/python$(echo ${PYTHON_VERSION} | sed -E 's/\.[0-9]+$//') && \
47+
./b2 install && cd / && rm -rf /tmp/boost
48+
49+
RUN dnf clean all && rm -rf /var/cache/dnf
50+
51+
# setup venv with pythonX.Y
52+
RUN python$(echo ${PYTHON_VERSION} | sed -E 's/\.[0-9]+$//') -m venv /opt/pilot
53+
54+
RUN /opt/pilot/bin/pip install --no-cache-dir -U pip setuptools
55+
RUN /opt/pilot/bin/pip install --no-cache-dir -U rucio-clients psutil gfal2-python
56+
57+
# rucio clients configuration
58+
RUN mkdir -p /opt/rucio/etc && \
59+
ln -s /scratch/rucio.cfg /opt/rucio/etc/rucio.cfg
60+
61+
# install CA certificates
62+
RUN mkdir -p /etc/grid-security/certificates && \
63+
mkdir /tmp/cert && \
64+
cd /tmp/cert && \
65+
wget -l1 -r -np -nH -e robots=off --cut-dirs=7 http://repository.egi.eu/sw/production/cas/1/current/tgz/ && \
66+
bash -c 'for tgz in $(ls *.tar.gz); do tar xzf ./$tgz --strip-components=1 -C /etc/grid-security/certificates; done' && \
67+
cd - && \
68+
rm -rf /tmp/cert
69+
70+
ENV X509_CERT_DIR=/etc/grid-security/certificates
71+
72+
# setup pilot
73+
RUN mkdir /pilot
74+
WORKDIR /pilot
75+
76+
ARG WRAPPER_NAME=runpilot2-wrapper.sh
77+
78+
# copy the wrapper script
79+
COPY ${WRAPPER_NAME} .
80+
RUN chmod +x ${WRAPPER_NAME}
81+
82+
# download and extract pilot tarball
83+
RUN wget -O pilot3.tar.gz https://github.com/PanDAWMS/pilot3/archive/refs/tags/${PILOT_VERSION}.tar.gz && \
84+
tar xvfz pilot3.tar.gz && rm -f pilot3.tar.gz && mv pilot3-* pilot3
85+
86+
# create entrypoint script
87+
RUN echo '#!/bin/bash' > entrypoint.sh && \
88+
echo 'cp /scratch/* .' >> entrypoint.sh && \
89+
echo 'source /opt/pilot/bin/activate' >> entrypoint.sh && \
90+
echo './'${WRAPPER_NAME}' $@' >> entrypoint.sh && \
91+
chmod +x entrypoint.sh
92+
93+
ENTRYPOINT ["/pilot/entrypoint.sh"]
94+
CMD ["/bin/bash"]

‎README.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,26 @@
11
Production wrapper for Pilot 3
2+
3+
To run the container:
4+
5+
```bash
6+
$ echo -n <your_token> > token.txt
7+
$ cp /somewhere/rucio.cfg .
8+
$ docker run -v ${PWD}:/scratch -e OIDC_AUTH_TOKEN=/scratch/token.txt -e OIDC_AUTH_ORIGIN=<vo.role> -it --platform linux/amd64 ghcr.io/pilot-wrapper/pilot-wrapper:master -s <site_name> -r <queue_name> -q <queue_name> -j unified -i PR --pythonversion 3 -w generic --pilot-user rubin --url <panda_server_url> -d --localpy --piloturl local --container -t
9+
```
10+
where you need to replace `<blah>`. E.g.:
11+
```bash
12+
$ # x509 for rucio access
13+
$ cp ~/.globus/user* .
14+
$ cp /tmp/x509up_u123456 .
15+
$ # rucio config with x509
16+
$ cat rucio.cfg
17+
[client]
18+
rucio_host = https://voatlasrucio-server-prod.cern.ch:443
19+
auth_host = https://atlas-rucio-auth.cern.ch:443
20+
client_cert = /scratch/usercert.pem
21+
client_key = /scratch/userkey.pem
22+
client_x509_proxy = /scratch/x509up_u123456
23+
auth_type = x509_proxy
24+
request_retries = 3
25+
$ docker run -v ${PWD}:/scratch -e OIDC_AUTH_TOKEN=/scratch/token.txt -e OIDC_AUTH_ORIGIN=panda_dev.pilot -it --platform linux/amd64 ghcr.io/pilot-wrapper/pilot-wrapper:master -s CERN -r CERN -q CERN -j unified -i PR --pythonversion 3 -w generic --pilot-user rubin --url https://aipanda123.cern.ch:25443 -d --localpy --piloturl local --container -t
26+
```

‎runpilot2-wrapper.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -853,7 +853,9 @@ function main() {
853853
echo
854854

855855
echo "---- Retrieve pilot code ----"
856-
piloturl=$(get_piloturl ${pilotversion})
856+
if [[ ${piloturl} != 'local' ]]; then
857+
piloturl=$(get_piloturl ${pilotversion})
858+
fi
857859
log "Using piloturl: ${piloturl}"
858860

859861
log "Only supporting pilot3 so pilotbase directory: pilot3"

0 commit comments

Comments
 (0)