Skip to content

Commit 0bb061c

Browse files
oseoinoseoin
authored
Re-order docker builds (nginx#5812)
1 parent 65d7ccf commit 0bb061c

File tree

3 files changed

+67
-77
lines changed

3 files changed

+67
-77
lines changed

‎.github/workflows/build-oss.yml

Lines changed: 23 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,6 @@ jobs:
5656
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
5757
with:
5858
ref: ${{ inputs.branch }}
59-
fetch-depth: 0
60-
61-
- name: Setup QEMU
62-
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
63-
with:
64-
platforms: arm,arm64,ppc64le,s390x
65-
66-
- name: Docker Buildx
67-
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
6859

6960
- name: Authenticate to Google Cloud
7061
id: auth
@@ -104,56 +95,60 @@ jobs:
10495
env:
10596
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
10697

107-
- name: Check if base images exist
108-
id: base_exists
98+
- name: Check if images exist
99+
id: images_exist
109100
run: |
110101
base_image="gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-base/oss:${{ inputs.base-image-md5 }}-${{ inputs.image }}"
111102
echo "image=${base_image}" >> $GITHUB_OUTPUT
112103
if docker manifest inspect ${base_image}; then
113-
echo "exists=true" >> $GITHUB_OUTPUT
104+
echo "base_exists=true" >> $GITHUB_OUTPUT
105+
fi
106+
if docker manifest inspect ${{ steps.meta.outputs.tags }}; then
107+
echo "target_exists=true" >> $GITHUB_OUTPUT
114108
fi
115109
if: ${{ inputs.authenticated && ! inputs.full-build }}
116110

111+
- name: Setup QEMU
112+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
113+
with:
114+
platforms: arm,arm64,ppc64le,s390x
115+
if: ${{ steps.images_exist.outputs.target_exists != 'true' }}
116+
117+
- name: Docker Buildx
118+
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
119+
if: ${{ steps.images_exist.outputs.target_exists != 'true' }}
120+
117121
- name: Build Base Container
118122
uses: docker/build-push-action@f6010ea70151369b06f0194be1051fbbdff851b2 # v6.0.2
119123
with:
120124
file: build/Dockerfile
121125
context: "."
122126
cache-to: type=gha,scope=${{ inputs.image }},mode=max
123127
target: common
124-
tags: ${{ steps.base_exists.outputs.image }}
128+
tags: ${{ steps.images_exist.outputs.image }}
125129
platforms: ${{ inputs.platforms }}
126130
pull: true
127131
push: true
128132
no-cache: true
129133
build-args: |
130134
BUILD_OS=${{ inputs.image }}
131135
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
132-
if: ${{ inputs.authenticated && steps.base_exists.outputs.exists != 'true' }}
133-
134-
- name: Check if target image exists
135-
id: target_exists
136-
run: |
137-
if docker pull ${{ steps.meta.outputs.tags }}; then
138-
echo "exists=true" >> $GITHUB_OUTPUT
139-
fi
140-
if: ${{ inputs.authenticated && ! inputs.full-build }}
136+
if: ${{ inputs.authenticated && steps.images_exist.outputs.base_exists != 'true' }}
141137

142138
- name: Debug values
143139
run: |
144140
echo "authenticated: ${{ inputs.authenticated }}"
145-
echo "base_exists: ${{ steps.base_exists.outputs.exists }}"
146-
echo "target_exists: ${{ steps.target_exists.outputs.exists }}"
141+
echo "images_exist: ${{ steps.images_exist.outputs.base_exists }}"
142+
echo "target_exists: ${{ steps.images_exist.outputs.target_exists }}"
147143
echo "full-build: ${{ inputs.full-build }}"
148-
echo "all: ${{ inputs.authenticated || steps.base_exists.outputs.exists != 'true' || steps.target_exists.outputs.exists != 'true' }}"
149144
150145
- name: Fetch Cached Artifacts
151146
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
152147
with:
153148
path: ${{ github.workspace }}/dist
154149
key: nginx-ingress-${{ inputs.go-md5 }}
155150
fail-on-cache-miss: true
156-
if: ${{ inputs.authenticated || steps.base_exists.outputs.exists != 'true' || steps.target_exists.outputs.exists != 'true' }}
151+
if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}
157152

158153
- name: Build Docker image
159154
uses: docker/build-push-action@f6010ea70151369b06f0194be1051fbbdff851b2 # v6.0.2
@@ -175,9 +170,9 @@ jobs:
175170
provenance: false
176171
build-args: |
177172
BUILD_OS=${{ inputs.image }}
178-
${{ inputs.authenticated && format('PREBUILT_BASE_IMG={0}', steps.base_exists.outputs.image) }}
173+
${{ inputs.authenticated && format('PREBUILT_BASE_IMG={0}', steps.images_exist.outputs.image) }}
179174
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
180-
if: ${{ steps.base_exists.outputs.exists != 'true' || steps.target_exists.outputs.exists != 'true' }}
175+
if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}
181176

182177
- name: Make directory for security scan results
183178
run: |

‎.github/workflows/build-plus.yml

Lines changed: 24 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,6 @@ jobs:
5858
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
5959
with:
6060
ref: ${{ inputs.branch }}
61-
fetch-depth: 0
62-
63-
- name: Setup QEMU
64-
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
65-
with:
66-
platforms: arm64,s390x
67-
68-
- name: Docker Buildx
69-
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
7061

7162
- name: Authenticate to Google Cloud
7263
id: auth
@@ -109,24 +100,37 @@ jobs:
109100
env:
110101
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
111102

112-
- name: Check if base images exist
113-
id: base_exists
103+
- name: Check if images exist
104+
id: images_exist
114105
run: |
115106
base_image="gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-base/plus:${{ inputs.base-image-md5 }}-${{ inputs.image }}${{ steps.nap_modules.outputs.name != '' && format('-{0}', steps.nap_modules.outputs.name) || '' }}${{ contains(inputs.image, 'v5') && '-v5' || '' }}"
116107
echo "image=${base_image}" >> $GITHUB_OUTPUT
117-
if docker pull ${base_image}; then
118-
echo "exists=true" >> $GITHUB_OUTPUT
108+
if docker manifest inspect ${base_image}; then
109+
echo "base_exists=true" >> $GITHUB_OUTPUT
110+
fi
111+
if docker manifest inspect ${{ steps.meta.outputs.tags }}; then
112+
echo "target_exists=true" >> $GITHUB_OUTPUT
119113
fi
120114
if: ${{ inputs.authenticated && ! inputs.full-build }}
121115

116+
- name: Setup QEMU
117+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
118+
with:
119+
platforms: arm,arm64,ppc64le,s390x
120+
if: ${{ steps.images_exist.outputs.target_exists != 'true' }}
121+
122+
- name: Docker Buildx
123+
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
124+
if: ${{ steps.images_exist.outputs.target_exists != 'true' }}
125+
122126
- name: Build Base Container
123127
uses: docker/build-push-action@f6010ea70151369b06f0194be1051fbbdff851b2 # v6.0.2
124128
with:
125129
file: build/Dockerfile
126130
context: "."
127131
cache-to: type=gha,scope=${{ inputs.image }}${{ steps.nap_modules.outputs.name != '' && format('-{0}', steps.nap_modules.outputs.name) || '' }},mode=max
128132
target: common
129-
tags: ${{ steps.base_exists.outputs.image }}
133+
tags: ${{ steps.images_exist.outputs.image }}
130134
platforms: ${{ inputs.platforms }}
131135
pull: true
132136
push: true
@@ -139,31 +143,22 @@ jobs:
139143
"nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
140144
"nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
141145
${{ inputs.nap-modules != '' && contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
142-
if: ${{ inputs.authenticated && steps.base_exists.outputs.exists != 'true' }}
143-
144-
- name: Check if target image exists
145-
id: target_exists
146-
run: |
147-
if docker pull ${{ steps.meta.outputs.tags }}; then
148-
echo "exists=true" >> $GITHUB_OUTPUT
149-
fi
150-
if: ${{ inputs.authenticated && ! inputs.full-build }}
146+
if: ${{ inputs.authenticated && steps.images_exist.outputs.base_exists != 'true' }}
151147

152148
- name: Debug values
153149
run: |
154150
echo "authenticated: ${{ inputs.authenticated }}"
155-
echo "base_exists: ${{ steps.base_exists.outputs.exists }}"
156-
echo "target_exists: ${{ steps.target_exists.outputs.exists }}"
151+
echo "images_exist: ${{ steps.images_exist.outputs.base_exists }}"
152+
echo "target_exists: ${{ steps.images_exist.outputs.target_exists }}"
157153
echo "full-build: ${{ inputs.full-build }}"
158-
echo "all: ${{ inputs.authenticated || steps.base_exists.outputs.exists != 'true' || steps.target_exists.outputs.exists != 'true' }}"
159154
160155
- name: Fetch Cached Artifacts
161156
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
162157
with:
163158
path: ${{ github.workspace }}/dist
164159
key: nginx-ingress-${{ inputs.go-md5 }}
165160
fail-on-cache-miss: true
166-
if: ${{ inputs.authenticated || steps.base_exists.outputs.exists != 'true' || steps.target_exists.outputs.exists != 'true' }}
161+
if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}
167162

168163
- name: Build Docker image
169164
uses: docker/build-push-action@f6010ea70151369b06f0194be1051fbbdff851b2 # v6.0.2
@@ -185,7 +180,7 @@ jobs:
185180
provenance: false
186181
build-args: |
187182
BUILD_OS=${{ inputs.image }}
188-
${{ inputs.authenticated && format('PREBUILT_BASE_IMG={0}', steps.base_exists.outputs.image ) }}
183+
${{ inputs.authenticated && format('PREBUILT_BASE_IMG={0}', steps.images_exist.outputs.image ) }}
189184
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
190185
${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
191186
${{ (contains(inputs.target, 'aws') && inputs.nap-modules != '') && format('NAP_MODULES_AWS={0}', steps.nap_modules.outputs.modules) || '' }}
@@ -194,7 +189,7 @@ jobs:
194189
"nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
195190
"nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
196191
${{ contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
197-
if: ${{ steps.base_exists.outputs.exists != 'true' || steps.target_exists.outputs.exists != 'true' }}
192+
if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}
198193

199194
- name: Make directory for security scan results
200195
run: |

‎build/Dockerfile

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ ARG WAF_VERSION=v4
1010

1111

1212
############################################# Base images containing libs for Opentracing and FIPS #############################################
13-
FROM ghcr.io/nginxinc/k8s-common:nginx-opentracing-1.27.0@sha256:d9f6f930b7bfcc026785aca49fdb96fbecdc517ebbdb893f6393ac78b247c8fb as opentracing-lib
14-
FROM ghcr.io/nginxinc/k8s-common:nginx-opentracing-1.27.0-alpine@sha256:5dc5c76384a775316c541995b145d4cef86d529934951319fd127f4d4fdb9ef7 as alpine-opentracing-lib
15-
FROM ghcr.io/nginxinc/alpine-fips:0.1.0-alpine3.17@sha256:f00b3f266422feaaac7b733b46903bd19eb1cd1caa6991131576f5f767db76f8 as alpine-fips-3.17
16-
FROM ghcr.io/nginxinc/alpine-fips:0.2.0-alpine3.19@sha256:1744ae3a8e795daf771f3f7df33b83160981545abb1f1597338e2769d06aa1cc as alpine-fips-3.19
13+
FROM ghcr.io/nginxinc/k8s-common:nginx-opentracing-1.27.0@sha256:d9f6f930b7bfcc026785aca49fdb96fbecdc517ebbdb893f6393ac78b247c8fb AS opentracing-lib
14+
FROM ghcr.io/nginxinc/k8s-common:nginx-opentracing-1.27.0-alpine@sha256:5dc5c76384a775316c541995b145d4cef86d529934951319fd127f4d4fdb9ef7 AS alpine-opentracing-lib
15+
FROM ghcr.io/nginxinc/alpine-fips:0.1.0-alpine3.17@sha256:f00b3f266422feaaac7b733b46903bd19eb1cd1caa6991131576f5f767db76f8 AS alpine-fips-3.17
16+
FROM ghcr.io/nginxinc/alpine-fips:0.2.0-alpine3.19@sha256:1744ae3a8e795daf771f3f7df33b83160981545abb1f1597338e2769d06aa1cc AS alpine-fips-3.19
1717
FROM redhat/ubi9-minimal@sha256:a7d837b00520a32502ada85ae339e33510cdfdbc8d2ddf460cc838e12ec5fa5a AS ubi-minimal
18-
FROM golang:1.22-alpine@sha256:32c85006b1edf29c097514e0c81a33334aa1450685a885c10657ec756dbb7703 as golang-builder
18+
FROM golang:1.22-alpine@sha256:32c85006b1edf29c097514e0c81a33334aa1450685a885c10657ec756dbb7703 AS golang-builder
1919

2020

2121
############################################# Base image for Alpine #############################################
@@ -57,7 +57,7 @@ COPY --link --chown=101:0 LICENSE /licenses/
5757

5858

5959
############################################# NGINX files for NGINX Plus #############################################
60-
FROM scratch as nginx-files
60+
FROM scratch AS nginx-files
6161
ARG IC_VERSION
6262
ARG BUILD_OS
6363
ARG NGINX_PLUS_VERSION
@@ -97,7 +97,7 @@ ADD --link --chown=101:0 --chmod=0755 build/scripts/agent.sh agent.sh
9797

9898

9999
############################################# Patch Image #############################################
100-
FROM ${IMAGE_NAME} as patched
100+
FROM ${IMAGE_NAME} AS patched
101101
ARG IMAGE_NAME
102102
ARG IC_VERSION
103103

@@ -112,7 +112,7 @@ USER 101
112112

113113

114114
############################################# Base image for Alpine with NGINX Plus #############################################
115-
FROM alpine:3.19@sha256:af4785ccdbcd5cde71bfd5b93eabd34250b98651f19fe218c91de6c8d10e21c5 as alpine-plus
115+
FROM alpine:3.19@sha256:af4785ccdbcd5cde71bfd5b93eabd34250b98651f19fe218c91de6c8d10e21c5 AS alpine-plus
116116
ARG NGINX_PLUS_VERSION
117117

118118
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -131,7 +131,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
131131

132132

133133
############################################# Base image for Alpine with NGINX Plus and FIPS #############################################
134-
FROM alpine-plus as alpine-plus-fips
134+
FROM alpine-plus AS alpine-plus-fips
135135
ARG NGINX_PLUS_VERSION
136136

137137
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -144,7 +144,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
144144

145145

146146
############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
147-
FROM alpine:3.17@sha256:a6063e988bcd597b4f1f7cfd4ec38402b02edd0c79250f00c9e14dc1e94bebbc as alpine-plus-nap-fips
147+
FROM alpine:3.17@sha256:a6063e988bcd597b4f1f7cfd4ec38402b02edd0c79250f00c9e14dc1e94bebbc AS alpine-plus-nap-fips
148148
ARG NGINX_PLUS_VERSION
149149
ARG NGINX_AGENT
150150
ARG NGINX_PLUS_VERSION
@@ -180,7 +180,7 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \
180180

181181

182182
############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
183-
FROM alpine:3.17@sha256:a6063e988bcd597b4f1f7cfd4ec38402b02edd0c79250f00c9e14dc1e94bebbc as alpine-plus-nap-v5-fips
183+
FROM alpine:3.17@sha256:a6063e988bcd597b4f1f7cfd4ec38402b02edd0c79250f00c9e14dc1e94bebbc AS alpine-plus-nap-v5-fips
184184
ARG NGINX_PLUS_VERSION
185185
ARG NGINX_AGENT
186186
ARG NGINX_PLUS_VERSION
@@ -242,7 +242,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
242242

243243

244244
############################################# Base image for Debian with NGINX Plus and App Protect WAF/DoS #############################################
245-
FROM debian-plus as debian-plus-nap
245+
FROM debian-plus AS debian-plus-nap
246246
ARG NAP_MODULES
247247
ARG NGINX_AGENT
248248
ARG NGINX_PLUS_VERSION
@@ -286,7 +286,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
286286
&& if [ -z "${NAP_MODULES##*dos*}" ]; then nap-dos.sh; fi
287287

288288
############################################# Base image for Debian with NGINX Plus and App Protect WAFv5/DoS #############################################
289-
FROM debian-plus as debian-plus-nap-v5
289+
FROM debian-plus AS debian-plus-nap-v5
290290
ARG NAP_MODULES
291291
ARG NGINX_AGENT
292292
ARG NGINX_PLUS_VERSION
@@ -338,7 +338,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
338338

339339

340340
############################################# Base image for UBI with NGINX Plus and App Protect WAF #############################################
341-
FROM ubi-minimal as ubi-9-plus-nap
341+
FROM ubi-minimal AS ubi-9-plus-nap
342342
ARG NAP_MODULES
343343
ARG NGINX_AGENT
344344
ARG NGINX_PLUS_VERSION
@@ -382,7 +382,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
382382

383383

384384
############################################# Base image for UBI with NGINX Plus and App Protect WAFv5 #############################################
385-
FROM ubi-minimal as ubi-9-plus-nap-v5
385+
FROM ubi-minimal AS ubi-9-plus-nap-v5
386386
ARG NAP_MODULES
387387
ARG NGINX_AGENT
388388
ARG NGINX_PLUS_VERSION
@@ -427,7 +427,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
427427

428428

429429
############################################# Base image for UBI with NGINX Plus and App Protect WAF & DoS #############################################
430-
FROM redhat/ubi8@sha256:143123d85045df426c5bbafc6863659880ebe276eb02c77ee868b88d08dbd05d as ubi-8-plus-nap
430+
FROM redhat/ubi8@sha256:143123d85045df426c5bbafc6863659880ebe276eb02c77ee868b88d08dbd05d AS ubi-8-plus-nap
431431
ARG NAP_MODULES
432432
ARG NGINX_AGENT
433433
ARG NGINX_PLUS_VERSION
@@ -491,7 +491,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
491491

492492

493493
############################################# Base image for UBI with NGINX Plus and App Protect WAFv5 #############################################
494-
FROM redhat/ubi8@sha256:143123d85045df426c5bbafc6863659880ebe276eb02c77ee868b88d08dbd05d as ubi-8-plus-nap-v5
494+
FROM redhat/ubi8@sha256:143123d85045df426c5bbafc6863659880ebe276eb02c77ee868b88d08dbd05d AS ubi-8-plus-nap-v5
495495
ARG NAP_MODULES
496496
ARG NGINX_AGENT
497497
ARG NGINX_PLUS_VERSION
@@ -539,7 +539,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
539539

540540

541541
############################################# Create common files, permissions and setcap #############################################
542-
FROM ${BUILD_OS} as common
542+
FROM ${BUILD_OS} AS common
543543

544544
ARG BUILD_OS
545545
ARG IC_VERSION
@@ -773,9 +773,9 @@ USER 101
773773

774774

775775
############################################# Create image with nginx-ingress extracted from image on Docker Hub #############################################
776-
FROM nginx/nginx-ingress:${DOWNLOAD_TAG} as kic
776+
FROM nginx/nginx-ingress:${DOWNLOAD_TAG} AS kic
777777

778-
FROM common as download
778+
FROM common AS download
779779

780780
LABEL org.nginx.kic.image.build.version="binaries"
781781

0 commit comments

Comments
 (0)