|
| 1 | +# Docker Image Updates |
| 2 | + |
| 3 | +## Background |
| 4 | + |
| 5 | +Docker images are the primary software deliverable of the NISAR Algorithm Development |
| 6 | +Team (ADT) to the Science Data System (SDS). ADT images include the ISCE3 software, |
| 7 | +containing NISAR science application workflows, as well as the NISAR Quality Assurance |
| 8 | +(QA) and SoilMoisture software packages. |
| 9 | + |
| 10 | +ADT Docker images use an Oracle Linux 8 base image with additional security patches |
| 11 | +applied. [Miniforge](https://github.com/conda-forge/miniforge) is used to install |
| 12 | +additional conda packages within the container image. In order to ensure that Docker |
| 13 | +builds are reproducible, the ADT pins the base image and all installed packages such |
| 14 | +that the version of each is explicitly specified and immutable. |
| 15 | + |
| 16 | +A set of "spec files" (text files containing a list of concrete package specifications) |
| 17 | +in the ISCE3 repository store the pinned version of each conda package in the ADT Docker |
| 18 | +image. ISCE3's runtime and build-time dependencies are separated into distinct spec |
| 19 | +files. The QA software dependencies are a subset of ISCE3's runtime dependencies, but |
| 20 | +the SoilMoisture software has its own separate conda environment and spec file. These |
| 21 | +spec files are tracked by Git and can be used to exactly reproduce each conda |
| 22 | +environment on the same platform. |
| 23 | + |
| 24 | +From time to time, it's desirable to upgrade the Docker base image and conda packages to |
| 25 | +ensure that the ADT image includes the latest available software patches. Typically, |
| 26 | +this procedure is carried out 2-3 weeks before a scheduled ADT delivery in order to |
| 27 | +ensure there's sufficient time to test the environment changes. |
| 28 | + |
| 29 | +## Procedure |
| 30 | + |
| 31 | +### Updating the base Docker image |
| 32 | + |
| 33 | +1. Find the latest available security-patched Oracle Linux image from the |
| 34 | +[`docker-release-local/gov/nasa/jpl/iems/sds/infrastructure/base/jplsds-oraclelinux/`](https://artifactory.jpl.nasa.gov/ui/repos/tree/General/docker-release-local/gov/nasa/jpl/iems/sds/infrastructure/base/jplsds-oraclelinux) |
| 35 | +repository on JPL Artifactory. |
| 36 | + |
| 37 | + !!! note |
| 38 | + Docker images in the repository are labeled by the OS major and minor version |
| 39 | + number and creation date in `YYMMDD` format (e.g. `8.10.250801`). |
| 40 | + |
| 41 | +1. Get the image's SHA-256 digest. This can be found in the "Checksums" section of the |
| 42 | +`manifest.json` (or `list.manifest.json`) file associated with the image in the |
| 43 | +Artifactory repository. Alternatively, it can be found by pulling and inspecting the |
| 44 | +image locally. For example, if the image tag is `8.10.250801`, |
| 45 | + |
| 46 | + ```shell |
| 47 | + $ REPO='cae-artifactory.jpl.nasa.gov:16003/gov/nasa/jpl/iems/sds/infrastructure/base/jplsds-oraclelinux' |
| 48 | + $ TAG='8.10.250801' |
| 49 | + $ docker pull $REPO:$TAG |
| 50 | + $ docker inspect --format='{{index .RepoDigests 0}}' $REPO:$TAG | grep -oE 'sha256:[a-zA-Z0-9]+' |
| 51 | + ``` |
| 52 | + |
| 53 | +1. Modify `tools/imagesets/oracle8conda/runtime/Dockerfile` to replace the old base |
| 54 | +image tag and digest with the new ones, e.g. |
| 55 | + |
| 56 | + ```diff title="Dockerfile" |
| 57 | + ARG repository=cae-artifactory.jpl.nasa.gov:16003/gov/nasa/jpl/iems/sds/infrastructure/base/jplsds-oraclelinux |
| 58 | + -ARG tag=8.10.250701 |
| 59 | + +ARG tag=8.10.250801 |
| 60 | + -ARG digest=sha256:f0c2bab2b3d2b7483ab7dcd334a6230491ab8dece3c234221c1b30e5e23a4262 |
| 61 | + +ARG digest=sha256:e0c73a62eccada432f9170b734bacb38e0be65fa1d3d660ee7255c56d8c16462 |
| 62 | + FROM ${repository}:${tag}@${digest} |
| 63 | + |
| 64 | + ... |
| 65 | + ``` |
| 66 | + |
| 67 | +### Updating conda packages |
| 68 | + |
| 69 | +The `tools/create_spec_file.py` script in the ISCE3 repository can be used to regenerate |
| 70 | +the spec files that list the pinned versions of each conda package within the ADT Docker |
| 71 | +image. |
| 72 | + |
| 73 | +The script will spin up a Docker image, create a conda environment within the image |
| 74 | +containing the required dependencies, and serialize the environment contents to a text |
| 75 | +file within the ISCE3 repository. |
| 76 | + |
| 77 | +!!! note |
| 78 | + The Docker base image and Miniforge version are hard-coded in the Python script. It |
| 79 | + may be necessary to manually update them (especially the Miniforge version) to match |
| 80 | + the versions used by the latest NISAR ADT Docker image. |
| 81 | + |
| 82 | +The script should be run three times with different arguments to update each of the spec |
| 83 | +files in the repository. Example usage from the root of the ISCE3 repository is shown |
| 84 | +below. |
| 85 | + |
| 86 | +```shell |
| 87 | +$ ./tools/create_spec_file.py runtime |
| 88 | +$ ./tools/create_spec_file.py dev |
| 89 | +$ ./tools/create_spec_file.py soil-moisture |
| 90 | +``` |
0 commit comments