Can we publish images only on every tag instead of every push for avoiding unstable code published?

it is already like that?

name: Release
on:
  push:
    tags:
      - 'v*'

Could we use docker/build-push-action to simplify this? (maybe we don't need to use hcl)
https://github.com/docker/build-push-action/blob/master/docs/advanced/multi-platform.md

IMHO, the best option would be "bake" because it really simplifies everything and improves reusability.

typo? repositor_owner

ah yes, let me fix this, good catch.

runc should be need to make buildg work.

I saw that runc has a apk pkg, should we use this to install runc ?

Can't we use GOARCH instead of xx-go ?

it uses GOARCH and GOOS under the good, what it really does is that it only parses the variable in form of "linux/amd64" provided by buildx and adds the right values to GOOS and GOARCH.

It seems that there are no such files in this repo?

Let me replace these with the correct ones.

I've updated them fyi @ktock

@ktock I've added runc binary to the image, is there anything else we need to add to final image?

We should use the released runc binaries.

We are using version 1.1.3 for the runc binary, which is also one of the released versions of it.
Would you mind giving a little bit more context?

runc needs to be stored at the location accessible from buildg (through PATH) otherwise buildg doesn't work.

$ docker run --rm -it -v /tmp/ctx:/ctx test debug /ctx/
WARN[2022-07-06T07:17:56Z] using host network as the default            
failed to find runc binary
github.com/moby/buildkit/executor/runcexecutor.New
	/go/pkg/mod/github.com/ktock/[email protected]/executor/runcexecutor/executor.go:88
github.com/moby/buildkit/worker/runc.NewWorkerOpt
	/go/pkg/mod/github.com/ktock/[email protected]/worker/runc/runc.go:56
github.com/ktock/buildg/pkg/buildkit.newWorker
	/src/pkg/buildkit/client.go:341
github.com/ktock/buildg/pkg/buildkit.newClient
	/src/pkg/buildkit/client.go:242
github.com/ktock/buildg/pkg/buildkit.Debug.func1
	/src/pkg/buildkit/client.go:68
runtime.goexit
	/usr/local/go/src/runtime/asm_amd64.s:1571

Ah thank you for testing this, I've configured the location of runc as one of the executable paths which is a "/usr/local/bin"

Needs comments why we need them. I think having only vX.X.X tag is just enough.

I agree with you, removed the unnecessary ones.

BuildKit doesn't provide the release image for this platform so we cannot provide it.

Thanks for the information 🫶

It seems that this Dockerfile cannot provide non-amd64 and non-arm64 image so we need to docker-bake.hcl not to build non-amd64 and non-arm64 images.

That makes a lot of sense, thank you.

We aren't using bypass4netns.

This also defined in the Dockerfile. We need an explanation comment why we need this duplication.

It's here because from now on we manage containerization process through bake command, so, if we want to override the Go version, we'll be overriding it through the bake command using a syntax like "--set *.args.GO_VERSION=x.x.x"

Needs explanation why we need this.

This is one of the builtin build-args provided by the BuildKit itself.

• BUILDKIT_CONTEXT_KEEP_GIT_DIR= trigger git context to keep the .git directory

You can reach out to the official documentation to get more detail about them.

https://docs.docker.com/engine/reference/commandline/buildx_build/#build-arg

Thank you for the explanation. Yes, I know what is this variable. Could you add the comment to docker-bake.hcl about the reason "why" this variable being needed?

I'm not sure about that it is necessary thing, so, I'm removing.

We should run buildg as a non-root user (can be following-up).

Where is this used?

this has to be a RUNC_VERSION environment variable, my bad.

When buildg is executed as a non-root user, it requires rootlesskit wrapper (i.e. buildg.sh) https://github.com/ktock/buildg#rootless-mode
Otherwise buidlg fails with permission errors.

$ docker run --rm -it --privileged -v /tmp/ctx:/ctx test debug /ctx/
mkdir /var/lib/buildg: permission denied

I think we can work on rootless execution in a following PR.

sounds like a plan 🤘 what should we do for this, run buildg.sh with RUN instruction?

Thank you for the explanation. Yes, I know what is this variable. Could you add the comment to docker-bake.hcl about the reason "why" this variable being needed?

base is only used by stage build. The stage build looks like it caches the go modules at /go/pkg/mod. So this pre-filling of modules seems to be unneeded.

So this pre-filling of modules seems to be unneeded.

Sorry, don't understand what you mean here, can you give a bit more context?

Downloading go modules will be done in the stage build and the modules are also cached because --mount=type=cache,target=/go/pkg/mod is specified in that stage. So this line running go mod download and cacheing go modules looks duplicated with the stage build. I thought we can safely eliminated this. WDYT?

Ah okay, now I get it, yes you are right, removed.

The created image still doesn't seems work. Could we use ubuntu image as the base image instead?

$ docker run --rm -it --privileged -v /tmp/ctx:/ctx test debug /ctx/
mkdir /var/lib/buildg: permission denied

Yep, but as you know, it ends up having a large image but anyways, to test whether it is working, we can do that.

Can we use 20.04 which is well tested in our GithubActions CI ?
And, could you add ca-certificates apt pkg for allowing buildg to access DockerHub etc. from the container.
Currently it fails.

$ docker run --rm -it --privileged -v /tmp/ctx:/ctx test debug /ctx/
WARN[2022-07-27T08:30:03Z] using host network as the default            
WARN[2022-07-27T08:30:03Z] git source cannot be enabled: failed to find git binary: exec: "git": executable file not found in $PATH 
#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile:
#1 transferring dockerfile: 237B done
#1 DONE 0.2s

#2 [internal] load .dockerignore
#2 transferring context: 2B done
#2 DONE 0.2s

#3 [internal] load metadata for docker.io/library/busybox:latest
INFO[2022-07-27T08:30:04Z] trying next host                              error="failed to do request: Head \"https://registry-1.docker.io/v2/library/busybox/manifests/latest\": x509: certificate signed by unknown authority" host=registry-1.docker.io
#3 ERROR: failed to do request: Head "https://registry-1.docker.io/v2/library/busybox/manifests/latest": x509: certificate signed by unknown authority
------
 > [internal] load metadata for docker.io/library/busybox:latest:
------
failed to build: failed to solve: failed to do request: Head "https://registry-1.docker.io/v2/library/busybox/manifests/latest": x509: certificate signed by unknown authority

Of course 🙋🏻‍♂️

Downloading go modules will be done in the stage build and the modules are also cached because --mount=type=cache,target=/go/pkg/mod is specified in that stage. So this line running go mod download and cacheing go modules looks duplicated with the stage build. I thought we can safely eliminated this. WDYT?