Skip to content

Commit b17d70d

Browse files
itskingoriitskingori
authored
Merge pull request #1 from Intellection/setup-image-builder
[SRE-5664] Create and set up `zappi/image-builder` Docker image
2 parents 97d1f57 + 547e703 commit b17d70d

7 files changed

Lines changed: 211 additions & 0 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "[0-9]+.[0-9]+.[0-9]+"
7+
8+
env:
9+
IMAGE: zappi/image-builder
10+
11+
jobs:
12+
github-release:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v6
17+
- name: Create Release
18+
env:
19+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20+
run: gh release create "${{ github.ref_name }}" --title "Version ${{ github.ref_name }}"
21+
docker-hub-release:
22+
needs: github-release
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@v6
27+
- name: Prepare image metadata
28+
id: metadata
29+
uses: docker/metadata-action@v6
30+
with:
31+
images: ${{ env.IMAGE }}
32+
- name: Set up QEMU
33+
uses: docker/setup-qemu-action@v4
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@v4
36+
- name: Login to Docker Hub
37+
uses: docker/login-action@v4
38+
with:
39+
username: ${{ secrets.DOCKER_HUB_USERNAME }}
40+
password: ${{ secrets.DOCKER_HUB_TOKEN }}
41+
- name: Build, tag, and push image to Docker Hub
42+
uses: docker/build-push-action@v7
43+
with:
44+
cache-from: type=gha
45+
cache-to: type=gha,mode=max
46+
context: .
47+
labels: ${{ steps.metadata.outputs.labels }}
48+
platforms: linux/amd64,linux/arm64
49+
push: true
50+
tags: ${{ steps.metadata.outputs.tags }}
51+
- name: Update description on Docker Hub
52+
uses: peter-evans/dockerhub-description@v5
53+
with:
54+
username: ${{ secrets.DOCKER_HUB_USERNAME }}
55+
password: ${{ secrets.DOCKER_HUB_TOKEN }}
56+
repository: ${{ env.IMAGE }}

‎.github/workflows/test.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Test
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- "main"
7+
8+
env:
9+
IMAGE: zappi/image-builder
10+
11+
jobs:
12+
build:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v6
17+
- name: Prepare image metadata
18+
id: metadata
19+
uses: docker/metadata-action@v6
20+
with:
21+
images: ${{ env.IMAGE }}
22+
- name: Set up QEMU
23+
uses: docker/setup-qemu-action@v4
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@v4
26+
- name: Test multi-arch building of image
27+
uses: docker/build-push-action@v7
28+
with:
29+
cache-from: type=gha
30+
cache-to: type=gha,mode=max
31+
context: .
32+
labels: ${{ steps.metadata.outputs.labels }}
33+
platforms: linux/amd64,linux/arm64
34+
push: false
35+
tags: ${{ steps.metadata.outputs.tags }}

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Changelog
2+
3+
## 1.0.0
4+
5+
* Use Ubuntu 24.04 (LTS) as upstream base image.
6+
* Set up `builder` user and group with UID and GID of `1001`.
7+
* Install `ca-certificates` and `curl`.
8+
* Install Docker CLI v`29.3.0`.
9+
* Install Docker Buildx Plugin v`0.31.1`.
10+
* Install Amazon ECR Credential Helper v`0.12.0`.

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @Intellection/SRE

‎Dockerfile‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
FROM ubuntu:24.04
2+
3+
SHELL ["/bin/bash", "-c"]
4+
5+
ARG DEBIAN_FRONTEND=noninteractive
6+
ARG TARGETARCH
7+
8+
RUN apt-get update -y && \
9+
apt-get install --no-install-recommends -y \
10+
ca-certificates \
11+
curl && \
12+
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
13+
14+
# Docker
15+
ARG DOCKER_BUILDX_PLUGIN_VERSION="0.31.1-1"
16+
ARG DOCKER_CLI_VERSION="5:29.3.0-1"
17+
RUN mkdir -p /etc/apt/keyrings && \
18+
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
19+
chmod a+r /etc/apt/keyrings/docker.asc && \
20+
echo "deb [arch=${TARGETARCH} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list && \
21+
apt-get update -y && \
22+
apt-get install --no-install-recommends -y \
23+
docker-buildx-plugin=${DOCKER_BUILDX_PLUGIN_VERSION}~ubuntu.24.04~noble \
24+
docker-ce-cli=${DOCKER_CLI_VERSION}~ubuntu.24.04~noble && \
25+
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
26+
27+
# AECH (Amazon ECR Credential Helper)
28+
ARG AECH_VERSION="0.12.0"
29+
RUN cd /tmp && \
30+
curl -fSL -o "docker-credential-ecr-login" "https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/${AECH_VERSION}/linux-${TARGETARCH}/docker-credential-ecr-login" && \
31+
curl -fSL -o "docker-credential-ecr-login.sha256" "https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/${AECH_VERSION}/linux-${TARGETARCH}/docker-credential-ecr-login.sha256" && \
32+
cat "docker-credential-ecr-login.sha256" | sha256sum -c - && \
33+
chmod +x "./docker-credential-ecr-login" && \
34+
mv "./docker-credential-ecr-login" "/usr/local/bin/docker-credential-ecr-login" && \
35+
rm -rf /tmp/*
36+
37+
# Create user
38+
ARG APP_USER="builder"
39+
RUN groupadd -g 1001 ${APP_USER} && \
40+
useradd --create-home -u 1001 -g 1001 ${APP_USER}
41+
42+
WORKDIR /home/${APP_USER}
43+
USER ${APP_USER}:${APP_USER}
44+
CMD ["/bin/bash"]

‎LICENSE.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 Zappi
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,45 @@
11
# Docker Image Builder
2+
3+
A purpose-built image for building and pushing container images via remote [BuildKit](https://github.com/moby/buildkit) daemons. It carries only what is needed for this role — no Docker Engine daemon, no `git`, no build toolchains.
4+
5+
Published to Docker Hub as [`zappi/image-builder`](https://hub.docker.com/r/zappi/image-builder). Built for `linux/amd64` and `linux/arm64`.
6+
7+
## Contents
8+
9+
| Component | Version |
10+
|-----------|---------|
11+
| Base image | Ubuntu 24.04 LTS |
12+
| [Docker CLI](https://github.com/docker/cli) | 29.3.0 |
13+
| [Docker Buildx plugin](https://github.com/docker/buildx) | 0.31.1 |
14+
| [Amazon ECR Credential Helper](https://github.com/awslabs/amazon-ecr-credential-helper) | 0.12.0 |
15+
16+
The image runs as a non-root `builder` user (UID/GID `1001`).
17+
18+
## Docker CLI Configuration
19+
20+
No `~/.docker/config.json` is baked into the image. It is expected to be provided at runtime — for example, mounted via a Kubernetes ConfigMap.
21+
22+
### AWS ECR Credential Helper Configuration
23+
24+
The config should wire the ECR credential helper for the registries the builder needs to authenticate with:
25+
26+
```json
27+
{
28+
"credHelpers": {
29+
"public.ecr.aws": "ecr-login",
30+
"<account-id>.dkr.ecr.<region>.amazonaws.com": "ecr-login"
31+
}
32+
}
33+
```
34+
35+
The ECR credential helper (`docker-credential-ecr-login`) is already present in the image. It follows the standard [AWS credential chain](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html#credentialProviders), so no static credentials need to be baked into the image.
36+
37+
## Releases
38+
39+
Images are tagged and pushed to Docker Hub on every [GitHub Release](https://github.com/Intellection/docker-image-builder/releases). Tags follow the version in the release (e.g. `zappi/image-builder:1.0.0`).
40+
41+
## References
42+
43+
- [docker/cli](https://github.com/docker/cli)
44+
- [docker/buildx](https://github.com/docker/buildx)
45+
- [awslabs/amazon-ecr-credential-helper](https://github.com/awslabs/amazon-ecr-credential-helper)

0 commit comments

Comments
 (0)