So I wanted to setup automatic mounting (read as autofs) with systemd, without using fstab.
Unfortunately, the man page didn’t have any examples so it wasn’t that easy to figure out. Luckily there is an excellent guide at RHCSA course [1].
Tl;dr
…So I got asked about this topic after my DevConf 2016 talk: there is a solution available on internets which describes how one can use two dockerfiles to build an image. Whole article can be found here.
What I didn’t like about the solution is that the first image outputs whole
build artifact as a tarball to standard output. To me that’s a bit hacky. Since
docker 1.8 you can cp files and directories between containers and host.
Let’s try to do that!
All of this is because of build secrets. It may happen that you need to
authenticate with an external service when building a docker image. In order to
do that, you need to have a secret available during build. That’s a problem.
This key may leak into a final image (whether via docker history or will be
available directly in some layer).
Here’s a solution!
Split your build process into two steps, each step represents its own dockerfile.
Authenticate with external service in order to fetch sources (use private SSH key to authenticate with GitHub so you can clone a repo) and build the project.
Get build artifacts from step 1 and install them.
After my yesterday talk at DevConf 2016 I got asked about some tips and tricks how to write Dockerfiles. I know we have plenty of resources for that in Red Hat, Fedora and Project Atomic. So, here we go!
…It may happen that you need to install a python project with pip from git(hub). That’s pretty easy:
…It’s really simple to copy your private GPG keys to another machine of yours. Let’s do public key first: $ gpg --export --armor KEY | ssh me@my-other-machine 'gpg --import' gpg: keyring `/home/me/.gnupg/secring.gpg' created gpg: keyring `/home/me/.gnupg/pubring.gpg' created gpg: /home/me/.gnupg/trustdb.gpg: trustdb created gpg: key 4937B925: public key "KEY" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) It worked! Now the private: $ gpg --export-secret-key --armor KEY | ssh me@my-other-machine 'gpg --import --allow-secret-key-import' gpg: key 4937B925: secret key imported gpg: key 4937B925: "KEY" not changed gpg: Total number processed: 1 gpg: unchanged: 1 gpg: secret keys read: 1 gpg: secret keys imported: 1 (--armor is optional, it’s just for sake of checking the output first before piping it to ssh)…
It’s not that hard, here are a couple pain points:
GOPATH is right — you want to compile against your checked out docker, not master dockerUpdate (October 13th): The encoding mismatch is made on purpose as described in this issue. The current work is present in this repo.
So I needed to get a digest of a manifest. Manifest is a text file in JSON format which contains metadata for a docker image. Manifest is part of v2 docker registry API.
We want to have this functionality (f(manifest) → digest) in pulp so I needed to do that in python. I guess it would pretty easy to do in Go because I would be able to use code from distribution directly.