feat(release): publish a multi-arch Docker image to ghcr.io - #26
Merged
Merged
Conversation
Adds a linux/amd64+linux/arm64 image via GoReleaser's dockers_v2 (not the older dockers/docker_manifests, already deprecated as of the pinned 2.18.1), alpine-based with ca-certificates and openssh-client so every address scheme this project supports (tcp+tls, ssh://) actually works inside the container, not just the ones that need nothing extra. Two things found in review and fixed before merging: - dockers_v2's multi-platform buildx build needs a builder that actually supports multi-platform output plus QEMU to emulate the non-native arch. Docker Desktop bundles both automatically, which is why this worked untouched in local testing and would NOT have worked the first time a real tag reached a bare GitHub Actions runner. Both release.yml and the new ci.yml docker check job now run docker/setup-qemu-action and docker/setup-buildx-action first -- GoReleaser's own documented prerequisite for this on Linux. - The full snapshot build moved into its own ci.yml job rather than being folded into the existing lint job -- a heavier, differently- scoped check than golangci-lint/go mod tidy/goreleaser check, and keeping it separate means a red "lint" status still means what it's always meant. Also: the alpine base is pinned by digest (dependabot.yml gained a docker ecosystem entry to keep it bumped), and the Dockerfile documents why it deliberately doesn't drop to a non-root USER (docker.sock access needs root-equivalent privilege regardless of container UID). See docs/decisions/010-docker-image.md, including two things verified by actually running them: the socket-mount case against a real local Docker socket, and the ssh:// case against a real SSH-reachable host (needs known_hosts mounted and the agent forwarded, not just the config file -- confirmed by hitting "Host key verification failed" first).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
linux/amd64+linux/arm64Docker image, published toghcr.io/nikitamikhailov/dashsyncon every release, via GoReleaser'sdockers_v2(not the olderdockers/docker_manifests, already deprecated as of the pinned 2.18.1). Alpine-based withca-certificatesandopenssh-clientso every address scheme this project supports (tcp://+TLS,ssh://) actually works inside the container.Two things found in review, fixed before merging — see docs/decisions/010:
release.ymland a newci.ymljob now set these up explicitly.ci.ymljob, not folded intolint— a heavier, differently-scoped check that shouldn't muddy what a red "lint" status means.Also: alpine pinned by digest (with a new
dependabot.ymldockerecosystem entry to keep it bumped), and the Dockerfile documents why it deliberately runs as root (docker.sock access needs root-equivalent privilege regardless of container UID).Test plan
inspectagainst a mounted/var/run/docker.sock) and a real SSH-reachable host (ssh://case — found and documented that it also needsknown_hostsmounted and the agent forwarded, not just the config file).docker-build-checkCI job runs the exact multi-arch buildx build on a bareubuntu-latestrunner, which local Docker Desktop testing couldn't validate (it bundles QEMU/buildx automatically, masking exactly this gap).go build/go test ./... -race/golangci-lint run/goreleaser checkall clean (no Go source touched).