Docker First Cut

.dockerignore

@@ -9,7 +9,7 @@
 **/.webassets-cache
 **/__pycache__
 .webpack_cache
-.cache
+.eslintcache
 
 # MacOS file
 **/.DS_Store
@@ -74,6 +74,9 @@ env/
 # Versioning files
 .git
 
+# github workflow files
+.github
+
 # Local DBs
 dump.rdb
 test.db

.github/workflows/pytest-docker.yml

@@ -0,0 +1,92 @@
+name: 'Pytest Docker'
+
+on:
+  push:
+    paths:
+      - '**.py'
+      - '**.js'
+      - '**.scss'
+      - '**.jinja2'
+      - '.flaskenv'
+      - '.testenv'
+      - 'requirements/base.txt'
+      - 'requirements/test.txt'
+      - '.github/workflows/pytest-docker.yml'
+      - 'Dockerfile'
+      - 'Makefile'
+      - 'pyproject.toml'
+      - 'docker-compose.ci.yml'
+      - 'docker/entrypoints/ci.sh'
+      - 'docker/initdb.sh'
+      - 'package.json'
+      - 'package-lock.json'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build funnel-ci image
+        id: build-funnel-ci
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: Dockerfile
+          target: ci
+          tags: funnel-ci
+          load: true
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Set permissions for coverage
+        run: docker compose -f docker-compose.ci.yml run --rm -u root --entrypoint "" --no-deps --quiet-pull main chown -R 1000:1000 coverage
+      - name: Test with pytest
+        run: docker compose -f docker-compose.ci.yml up --quiet-pull --no-attach db --no-attach redis --no-log-prefix --exit-code-from main
+      - name: Upload coverage report to Coveralls
+        uses: coverallsapp/github-action@master
+        with:
+          github-token: ${{ secrets.github_token }}
+          path-to-lcov: coverage/funnel.lcov
+          flag-name: docker-3.11
+      - name: Set short git commit SHA
+        if: ${{ github.ref_name == 'main' || github.ref_name == 'docker' }}
+        id: sha
+        run: |
+          short_sha=$(git rev-parse --short ${{ github.sha }})
+          echo "short=$short_sha" >> "$GITHUB_OUTPUT"
+      - name: Login to Docker Hub
+        if: ${{ github.ref_name == 'main' || github.ref_name == 'docker' }}
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        if: ${{ github.ref_name == 'main' || github.ref_name == 'docker' }}
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GHCR_WRITE_TOKEN }}
+      - name: Build & push funnel image
+        if: ${{ github.ref_name == 'main' || github.ref_name == 'docker' }}
+        id: build-funnel
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: Dockerfile
+          target: app
+          tags: |
+            hasgeek/funnel:${{ github.ref_name }}
+            hasgeek/funnel:sha-${{ steps.sha.outputs.short }}
+            ghcr.io/hasgeek/funnel:${{ github.ref_name }}
+            ghcr.io/hasgeek/funnel:sha-${{ steps.sha.outputs.short }}
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -12,8 +12,6 @@
 __pycache__
 .nox
 monkeytype.sqlite3
-.ci-cache
-.cache
 
 # MacOS file
 .DS_Store

.pre-commit-config.yaml

@@ -204,10 +204,10 @@ repos:
   #   hooks:
   #     - id: dockerfile_lint
   #       files: .*Dockerfile.*
-  # - repo: https://github.com/hadolint/hadolint
-  #   rev: v2.12.1-beta
-  #   hooks:
-  #     - id: hadolint-docker
+  - repo: https://github.com/hadolint/hadolint
+    rev: v2.12.1-beta
+    hooks:
+      - id: hadolint-docker
   - repo: https://github.com/IamTheFij/docker-pre-commit
     rev: v3.0.1
     hooks:

.testenv

@@ -46,9 +46,7 @@ FLASK_IMAGE_URL_DOMAINS='["images.example.com"]'
 FLASK_IMAGE_URL_SCHEMES='["https"]'
 FLASK_SES_NOTIFICATION_TOPICS=null
 # Per app config
-APP_FUNNEL_SITE_ID=hasgeek-test
 APP_FUNNEL_SERVER_NAME=funnel.test:3002
 APP_FUNNEL_SHORTLINK_DOMAIN=f.test:3002
 APP_FUNNEL_DEFAULT_DOMAIN=funnel.test
 APP_FUNNEL_UNSUBSCRIBE_DOMAIN=bye.test
-APP_SHORTLINK_SITE_ID=shortlink-test

Dockerfile

@@ -1,112 +1,70 @@
 # syntax=docker/dockerfile:1.4
 
-FROM nikolaik/python-nodejs:python3.11-nodejs20-bullseye as base
+# https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/reference.md
 
-# https://github.com/zalando/postgres-operator/blob/master/docker/logical-backup/Dockerfile
-# https://stackoverflow.com/questions/68465355/what-is-the-meaning-of-set-o-pipefail-in-bash-script
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+FROM node:lts-alpine as assets
+USER node
+WORKDIR /home/node/app
+RUN mkdir -pv /home/node/app/funnel/static/build /home/node/app/funnel/static/build_cache
+COPY --chown=node:node package.json package-lock.json ./
+RUN --mount=type=cache,target=/home/node/.npm/,uid=1000,gid=1000 npm ci
+COPY --chown=node:node ./funnel/assets/ ./funnel/assets/
+COPY --chown=node:node webpack.config.js .eslintrc.js ./
+RUN --mount=type=cache,target=/home/node/app/.webpack_cache/,uid=1000,gid=1000 \
+    --mount=type=cache,target=/home/node/app/funnel/static/build_cache/,uid=1000,gid=1000 \
+    cp -R funnel/static/build_cache funnel/static/build \
+    && npm run build \
+    && cp -R funnel/static/build funnel/static/build_cache \
+    && cp -R funnel/static/build funnel/static/built
 
-LABEL Name=Funnel
-LABEL Version=0.1
+FROM python:3.11-bullseye as app
+LABEL maintainer="Hasgeek"
+RUN chsh -s /usr/sbin/nologin root
+# hadolint ignore=DL3008
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    apt-get update -yqq \
+    && apt-get install -yqq --no-install-recommends supervisor curl \
+    && apt-get autoclean -yqq \
+    && apt-get autoremove -yqq \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -pv /var/log/supervisor
+RUN addgroup --gid 1000 funnel && adduser --uid 1000 --gid 1000 funnel
+ENV PATH "$PATH:/home/funnel/.local/bin"
+USER funnel
+# hadolint ignore=DL4006
+RUN curl --proto '=https' --tlsv1.3 https://sh.rustup.rs -sSf | /bin/bash -s -- -y
+ENV PATH "/home/funnel/.cargo/bin:$PATH"
+WORKDIR /home/funnel/app
 
-USER pn
-RUN \
-    mkdir -pv /home/pn/.cache/pip /home/pn/.npm /home/pn/tmp /home/pn/app /home/pn/app/coverage && \
-    chown -R pn:pn /home/pn/.cache /home/pn/.npm /home/pn/tmp /home/pn/app /home/pn/app/coverage
-EXPOSE 3000
-WORKDIR /home/pn/app
+COPY --chown=funnel:funnel Makefile Makefile
+COPY --chown=funnel:funnel requirements/base.txt requirements/base.txt
+RUN mkdir -pv /home/funnel/.cache/pip
+# hadolint ignore=DL3013,DL3042
+RUN --mount=type=cache,target=/home/funnel/.cache/pip,uid=1000,gid=1000 make install-python && pip install --upgrade uwsgi
 
-ENV PATH "$PATH:/home/pn/.local/bin"
+COPY --chown=funnel:funnel . .
+COPY --from=assets --chown=funnel:funnel /home/node/app/funnel/static/built/ funnel/static/build
+RUN mkdir -pv /home/funnel/app/logs
+ENTRYPOINT [ "uwsgi", "--ini" ]
 
-FROM base as devtest_base
+FROM app as ci
 USER root
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update -yqq && \
-    apt-get install -yqq --no-install-recommends lsb-release && \
-    sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list' && \
-    wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
-    apt-get update -yqq && apt-get upgrade -yqq && \
-    echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections && \
-    DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends firefox-esr postgresql-client-15 && \
-    cd /tmp/ && \
-    curl -fsSL $(curl -fsSL https://api.github.com/repos/mozilla/geckodriver/releases/latest | grep browser_download_url | grep 'linux64.tar.gz\"'| grep -o 'http.*\.gz') > gecko.tar.gz && \
-    tar -xvzf gecko.tar.gz && \
-    rm gecko.tar.gz && \
-    chmod +x geckodriver && \
-    mv geckodriver /usr/local/bin && \
-    apt-get autoclean -yqq && \
-    apt-get autoremove -yqq && \
-    cd /home/pn/app
-USER pn
-
-FROM base as assets
-COPY --chown=pn:pn package.json package.json
-COPY --chown=pn:pn package-lock.json package-lock.json
-RUN --mount=type=cache,target=/root/.npm \
-    --mount=type=cache,target=/home/pn/.npm,uid=1000,gid=1000 npm ci
-COPY --chown=pn:pn ./funnel/assets ./funnel/assets
-COPY --chown=pn:pn .eslintrc.js .eslintrc.js
-COPY --chown=pn:pn webpack.config.js webpack.config.js
-RUN --mount=type=cache,target=/root/.npm \
-    --mount=type=cache,target=/home/pn/.npm,uid=1000,gid=1000 npm run build
-
-FROM base as dev_assets
-COPY --chown=pn:pn package.json package.json
-COPY --chown=pn:pn package-lock.json package-lock.json
-RUN --mount=type=cache,target=/root/.npm \
-    --mount=type=cache,target=/home/pn/.npm,uid=1000,gid=1000 npm install
-COPY --chown=pn:pn ./funnel/assets ./funnel/assets
-COPY --chown=pn:pn .eslintrc.js .eslintrc.js
-COPY --chown=pn:pn webpack.config.js webpack.config.js
-RUN --mount=type=cache,target=/root/.npm \
-    --mount=type=cache,target=/home/pn/.npm,uid=1000,gid=1000 npx webpack --mode development --progress
-
-FROM base as deps
-COPY --chown=pn:pn Makefile Makefile
-RUN make deps-editable
-COPY --chown=pn:pn requirements/base.txt requirements/base.txt
-RUN --mount=type=cache,target=/home/pn/.cache/pip,uid=1000,gid=1000 \
-    pip install --upgrade pip && \
-    pip install --use-pep517 -r requirements/base.txt
-
-FROM devtest_base as test_deps
-COPY --chown=pn:pn Makefile Makefile
-RUN make deps-editable
-COPY --chown=pn:pn requirements/base.txt requirements/base.txt
-COPY --chown=pn:pn requirements/test.txt requirements/test.txt
-RUN --mount=type=cache,target=/home/pn/.cache/pip,uid=1000,gid=1000 pip install --use-pep517 -r requirements/test.txt
-
-FROM devtest_base as dev_deps
-COPY --chown=pn:pn Makefile Makefile
-RUN make deps-editable
-COPY --chown=pn:pn requirements requirements
-RUN --mount=type=cache,target=/home/pn/.cache/pip,uid=1000,gid=1000 pip install --use-pep517 -r requirements/dev.txt
-COPY --from=dev_assets --chown=pn:pn /home/pn/app/node_modules /home/pn/app/node_modules
-
-FROM deps as production
-COPY --chown=pn:pn . .
-COPY --chown=pn:pn --from=assets /home/pn/app/funnel/static /home/pn/app/funnel/static
-ENTRYPOINT ["uwsgi", "--ini"]
-
-FROM production as supervisor
-USER root
-RUN \
-    apt-get update -yqq && \
-    apt-get install -yqq --no-install-recommends supervisor && \
-    apt-get autoclean -yqq && \
-    apt-get autoremove -yqq && \
-    mkdir -pv /var/log/supervisor
-COPY ./docker/supervisord/supervisord.conf /etc/supervisor/supervisord.conf
-# COPY ./docker/uwsgi/emperor.ini /etc/uwsgi/emperor.ini
-ENTRYPOINT ["/usr/bin/supervisord"]
-
-FROM test_deps as test
-ENV PWD=/home/pn/app
-COPY --chown=pn:pn . .
-
-COPY --chown=pn:pn --from=assets /home/pn/app/funnel/static /home/pn/app/funnel/static
-ENTRYPOINT ["/home/pn/app/docker/entrypoints/ci-test.sh"]
-FROM dev_deps as dev
-RUN --mount=type=cache,target=/home/pn/.cache/pip,uid=1000,gid=1000 cp -R /home/pn/.cache/pip /home/pn/tmp/.cache_pip
-RUN mv /home/pn/tmp/.cache_pip /home/pn/.cache/pip
-COPY --chown=pn:pn --from=dev_assets /home/pn/app/funnel/static /home/pn/app/funnel/static
+RUN mkdir -pv /home/funnel/app/coverage && chown -R 1000:1000 /home/funnel/.cache /home/funnel/app/coverage
+# hadolint ignore=DL3008,DL4006,SC2046
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    apt-get update -yqq \
+    && apt-get install -yqq --no-install-recommends xvfb firefox-esr \
+    && apt-get autoclean -yqq \
+    && apt-get autoremove -yqq \
+    && rm -rf /var/lib/apt/lists/* \
+    && curl -fsSL $(curl -fsSL https://api.github.com/repos/mozilla/geckodriver/releases/latest \
+    | grep browser_download_url \
+    | grep 'linux64.tar.gz\"' \
+    | grep -o 'http.*\.gz') \
+    | tar -xvz -C /usr/local/bin
+USER funnel
+ENV PYTHONUNBUFFERED=1
+ENV GITHUB_ACTIONS=true
+COPY --chown=funnel:funnel requirements/base.txt requirements/test.txt ./requirements/
+RUN --mount=type=cache,target=/home/funnel/.cache/pip,uid=1000,gid=1000 make install-python-test
+ENTRYPOINT [ "/home/funnel/app/docker/entrypoints/ci.sh" ]