refactor(docker): multi-arch docker 🐳 build overhaul 🏗️ #258

kaffolder7 · 2025-02-08T20:52:36Z

Summary 🚀

This PR includes multiple improvements and fixes related to Docker configuration, GitHub Actions workflows, and documentation. The key highlights are:

Fixed broken Docker build and improved security by running as a non-root user.
Refactored and optimized GitHub Actions workflows, adding better version tagging, security enhancements, and multi-platform support.
Updated Docker configurations to enhance stability, security, and maintainability, including version pinning, improved healthchecks, and reduced permissions.
Optimizes the Docker build to almost a 60-70% reduction in size!! 💥 (~1.5GB -> 315MB)
Expanded Docker documentation with improved README badges, detailed version tagging explanations, and an automated process to keep the README up-to-date.
General README improvements with proofreading, formatting fixes, and removal of broken icons.

Changes Made

Docker Improvements 🐳

Fixed build issues and enforced running as a non-root user for better security.
Version pinning for more stable and predictable builds.
Added container healthcheck to improve monitoring and reliability.
Refined permissions of key directories (/uploads and /database).
Introduced entrypoint.sh to handle startup behavior.
Properly mapped container timezone for consistency.
Removed unnecessary environment variables and improved ordering.
Added TODO comments for future improvements/considerations.

GitHub Actions Workflow Enhancements ⚙️

Refactored the publishImage.yml workflow:
- Unified support for Alpine and Debian variants using a matrix strategy.
- Improved tagging strategy for better semantic versioning and organization.
- Implemented Cosign signing for security.
- Optimized multi-platform builds and caching.
- Allowed manual triggering for repo admin(s) to build images on demand.

Documentation & README Updates 📖

Expanded Docker section in README:
- Created a dynamic version table that updates automatically via a new GitHub job (update_readme).
- Improved readability and structure of Docker-specific documentation.
General README refinements:
- Fixed broken icons and misaligned table headers.
- Proofread and polished content for clarity.

Impact 🌟

Security: Runs as a non-root user, implements Cosign signing, and restricts unnecessary permissions.
Stability: Version pinning ensures consistent builds, and healthchecks improve container reliability.
Maintainability: Simplified workflows, reduced complexity, and added automated updates to documentation.
Developer Experience: Improved documentation, tagging strategies, and the ability to manually trigger builds make the project easier to work with.

@rajnandan1 – I'm thinking this should probably be a new minor version bump (e.g. ver. 3.0.10 -> ver. 3.1.0)? Also, I did quite the overhaul on your existing GitHub Actions workflow. We'll probably wanna first test this as a ‘dry-run’. 😅

* Switch to multi-stage build pattern for smaller image size * Add support for both Alpine and Debian variants via build args * Change default image base to `node:23-slim` instead of using `node:23` (no need for full Debian base present in `node:23` since now prioritization is given to production-ready builds) * Improve caching with --mount for npm dependencies * Separate build and runtime dependencies * Remove unnecessary Node.js packages in final stage * Fix permissions on uploads/database directories * Add proper scoping for build arguments * Set NODE_ENV=production for better performance This change reduces the final image size and improves build caching while adding flexibility to choose between Alpine and Debian base images. Original: ~1.2GB New Alpine: ~350MB New Debian: ~450MB

Streamlined the GitHub `publishImage.yml` workflow with the following functionality: * Handle both Alpine and Debian variants through matrix strategy * Push to both Docker Hub and GitHub Container Registry * Add comprehensive tagging strategy, handling both branches (aka release version, e.g. 1.0.0), semantic versions (major.minor and major), and latest versions (`latest` and `alpine`) * Add security aspects (cosign signing, proper permissions) * Add better caching and multi-platform build settings With this revised workflow, the following Docker image variants will be built for every successful release. As an example, if the release version is “3.0.9”, then the following Docker image variants will be built: Debian variants (default): - `kener:3.0.9` (Semver of current release) - `kener:latest` (Latest Debian release, ’latest’ label points to 3.0.9) - `kener:3.0` (major.minor version, major.minor ‘3.0’ label points to 3.0.9) - `kener:3` (major version, major ‘3’ label points to 3.0.9) Alpine variants (smallest filesize): - `kener:3.0.9-alpine` (Semver of current release) - `kener:alpine` (Latest Alpine release, ‘alpine’ label points to 3.0.9) - `kener:3.0-alpine` (major.minor version, major.minor ‘3.0-alpine’ label points to 3.0.9) - `kener:3-alpine` (major version, major ‘3-alpine’ label points to 3.0.9)

* add: version pinning (better stability) * remove: unnecessary KENER_BASE_PATH env. variable * update: reduce permissions of /uploads and /database directories * add: `entrypoint.sh` file * add: properly map container timezone and localtime * add: container healthcheck * change: restrict to non-root “node” user

* Expanded upon existing Docker README section. * Created table which will contains version placeholder variables that will be replaced by new GitHub workflow job: “update_readme”. Job automatically runs after new images have been built & pushed to container registries.

add direct links to filtered image(s) on Docker Hub, based on whether Debian or Alpine Linux variant badges are clicked

kaffolder7 · 2025-02-09T05:53:56Z

Alright @rajnandan1, I was able to update and quickly test including only the files you mentioned in discussion #247. Please review and let me know if you have any questions! I'm happy to coordinate a time to jump on Discord if that's easier. I know you had mentioned the Docker side of things isn't necessarily something you're most comfortable with, so I'm happy to try and continuing to support as I have the time, if you would like. ☺️

Noticed when doing some cleanup, that you had two awesome tags, but they both point to different URLs/repos. I added back in the one I had inadvertently removed.

rajnandan1 · 2025-02-10T06:02:07Z

Will merge this tonight IST

kaffolder7 · 2025-02-10T13:03:25Z

Thanks @rajnandan1! This is so very exciting!! Thank you for trusting me with your project. I am very happy to support it. You've got a very good thing started. 😊

I caught an issue where the README will only auto-update listed Docker versions the first time. Commenting out for now (in case this PR gets merged before I have time to fix this). Will revisit this and fix this week.

🔄 Automate README Generation via Mustache Templating - Use Mustache to dynamically generate `README.md` from `README.template.md`. - Populate README with environment variables (e.g., `KENER_BUILD_FULL_VERSION`). - Prevent direct edits to `README.md` by enforcing updates via the template. - Enhance GitHub Actions workflow to auto-generate and commit the README. - Add GitHub Action workflow (`protect-readme.yml`) to prevent others from direct updates to `README.md` via PR.

rajnandan1 · 2025-02-10T16:40:03Z

@kaffolder7 the build seems to be broken https://github.com/rajnandan1/kener/actions/runs/13245732187
can you get this fixed?

kaffolder7 · 2025-02-10T17:10:16Z

@kaffolder7 the build seems to be broken https://github.com/rajnandan1/kener/actions/runs/13245732187 can you get this fixed?

Yes, let me take a look here.

rajnandan1 · 2025-02-10T17:24:50Z

@kaffolder7 the build seems to be broken https://github.com/rajnandan1/kener/actions/runs/13245732187 can you get this fixed?

Yes, let me take a look here.

It has something to do with your latest commit where mustache is used to create readme

kaffolder7 · 2025-02-10T17:29:18Z

@rajnandan1 – Maybe issue as simple as me forgetting to push an updated package-lock.json file? Could you try regenerating this and push it to this PR and then re-run the workflow? I'm currently AFK for a bit.

rajnandan1 · 2025-02-10T17:32:20Z

@rajnandan1 – Maybe issue as simple as me forgetting to push an updated package-lock.json file? Could you try regenerating this and push it to this PR and then re-run the workflow? I'm currently AFK for a bit.

Did :(

kaffolder7 and others added 25 commits February 5, 2025 14:03

update(docker): simplified variable name

fdad329

add(docker): docker-specific README badges

1336628

fix(docker): broken build & run as non-root user

52a8cca

Merge branch 'rajnandan1:main' into feature/multi-arch-docker-build

374eda4

update: tweaked ordering of env variables

1dd05fe

update(docker): healthcheck port & path + cleanup

1e77253

add(workflow): allow admin to manually build

43673e3

add(docker): missing entrypoint.sh file

ec73512

fix(README): remove broken icons that were added

2a338ba

fix(README): table subheading alignment

820eeb0

fix(README): table subheading alignment

654c07a

update(README): proofread and polished ☺️

e923f4d

update(README): adjusted emoji spacing

c00aae5

update(README): fix typo

d03a8fd

update(docker): add TODO comments for future work

d0ea855

update(docker): add TODO comments for future work

9bbe665

update(docker): expanded on existing examples

974976b

Merge branch 'rajnandan1:main' into feature/multi-arch-docker-build

a7c27a6

Merge branch 'main' into feature/multi-arch-docker-build

d46d02e

fix(docker): remove unnecessary files from build

d552f54

update(docker): README badge direct links

f583ba4

add direct links to filtered image(s) on Docker Hub, based on whether Debian or Alpine Linux variant badges are clicked

kaffolder7 and others added 2 commits February 9, 2025 01:04

fix(README): restore accidentally removed tag

ff864fb

Noticed when doing some cleanup, that you had two awesome tags, but they both point to different URLs/repos. I added back in the one I had inadvertently removed.

Merge branch 'rajnandan1:main' into feature/multi-arch-docker-build

d03bf41

kaffolder7 mentioned this pull request Feb 10, 2025

feat: automate dependency updates 🤖 #263

Open

kaffolder7 changed the title ~~refactor(docker): multi-arch docker build overhaul~~ refactor(docker): multi-arch docker 🐳 build overhaul 🏗️ Feb 10, 2025

kaffolder7 added 3 commits February 10, 2025 09:27

update(docker): temporarily remove README updating

eda98ba

I caught an issue where the README will only auto-update listed Docker versions the first time. Commenting out for now (in case this PR gets merged before I have time to fix this). Will revisit this and fix this week.

fix(docker): action version number

e556514

rajnandan1 merged commit 8bde322 into rajnandan1:main Feb 10, 2025
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(docker): multi-arch docker 🐳 build overhaul 🏗️ #258

refactor(docker): multi-arch docker 🐳 build overhaul 🏗️ #258

kaffolder7 commented Feb 8, 2025 •

edited

Loading

kaffolder7 commented Feb 9, 2025

rajnandan1 commented Feb 10, 2025

kaffolder7 commented Feb 10, 2025

rajnandan1 commented Feb 10, 2025 •

edited

Loading

kaffolder7 commented Feb 10, 2025

rajnandan1 commented Feb 10, 2025

kaffolder7 commented Feb 10, 2025

rajnandan1 commented Feb 10, 2025

refactor(docker): multi-arch docker 🐳 build overhaul 🏗️ #258

refactor(docker): multi-arch docker 🐳 build overhaul 🏗️ #258

Conversation

kaffolder7 commented Feb 8, 2025 • edited Loading

Summary 🚀

Changes Made

Docker Improvements 🐳

GitHub Actions Workflow Enhancements ⚙️

Documentation & README Updates 📖

Impact 🌟

kaffolder7 commented Feb 9, 2025

rajnandan1 commented Feb 10, 2025

kaffolder7 commented Feb 10, 2025

rajnandan1 commented Feb 10, 2025 • edited Loading

kaffolder7 commented Feb 10, 2025

rajnandan1 commented Feb 10, 2025

kaffolder7 commented Feb 10, 2025

rajnandan1 commented Feb 10, 2025

kaffolder7 commented Feb 8, 2025 •

edited

Loading

rajnandan1 commented Feb 10, 2025 •

edited

Loading