chore: Distribute as docker image #1875

mircea-pavel-anton · 2024-10-21T20:04:16Z

This is currently a WIP to solve #1801

Some notes

I chose debian as a base for the docker image instead of alpine, for example, such that I can load the bash completion
I set the workdir to /workspace to facilitate mounting volumes into the container via ad-hoc docker commands, i.e.:
```
docker run -it -v $PWD:/workspace ghcr.io/go-task/task:v3.39.2-amd64 lint # equivalent of `task lint`
```
I set the cmd instead of the entrypoint to the task executable such that it is easier to just exec into the container like so:
```
docker run -it -v $PWD:/workspace ghcr.io/go-task/task:v3.39.2-amd64 /bin/bash
```
the current implementation pushes both to dockerhub and ghcr.io
the current implementation pushes:
- version tagged images (ghcr.io/go-task/task:v3.39.2)
- version and arch tagged images (ghcr.io/go-task/task:v3.39.2-amd64)
- latest images (ghcr.io/go-task/task:latest)

TODO

update release workflow to login to ghcr and/or dockerhub
figure out bash completion

mircea-pavel-anton · 2024-12-07T14:09:56Z

@pd93 @andreynering

What do you think about this implementation?

I moved to using scratch as a base for the image and put in only the binary and the shell completions so that they can both be easily imported.

I also added some documentation about the changes, though I decided to keep it rather minimal. Not sure about the Note section. I'm open to suggestions.

I also modified the goreleaser to only push to GHCR (initially it was configured to push to docker.io as well).

P.S. Ignore the devcontainer file, that was only for my local testing. I will drop that commit once this PR is ready

pd93

We should probably also add additional tags for latest, 3, 3.40 etc.

pd93 · 2024-12-07T14:16:26Z

.goreleaser.yml

+    use: buildx
+    dockerfile: Dockerfile
+    extra_files:
+      - completion/bash/task.bash


Direct usage of these files is deprecated.

Oh damn, I completely missed that. Will fix!

FWIW, they still seem to be referenced throughout the goreleaser config. If I understand correctly, the brew installer also uses them as well as the nfpms?

Yeah unfortunately, they are still used in a few places. This is why we deprecated them instead of removing them. We need to slowly remove the references to them. We could probably still add completions to the image by writing a .bashrc during the build and using the new method

I thought about generating the completions in the container, but then I decided against it.

It doesn't make much sense to generate the bash completions given the image is based on scratch IMHO, and even then, if we generate and include one set of completions we might as well generate all.

I think that, given the completions can be generated from the binary, it is just as simple to add a RUN command in your dockerfile to set up your required completions.

There are already instructions for generating the completions so that should have it covered. At the end of the day, the container image is a means to distribute the binary, right?

Let me know what you think!

andreynering

Haven't attempted to build it yet, but added some comments for now.

.devcontainer/devcontainer.json

.goreleaser.yml

website/docs/installation.mdx

andreynering

Hi @mircea-pavel-anton, this looks good!

It still misses the login step, right? Anything needed from my part to move this forward?

Co-authored-by: Andrey Nering <[email protected]>

mircea-pavel-anton · 2025-02-02T09:35:34Z

Hi @andreynering !

Sorry for the delay, I've been a bit busy. I have added the login step and rebased my branch. It should be all good now

.goreleaser.yml

Dockerfile

mircea-pavel-anton · 2025-05-30T17:24:42Z

@reneleonhardt thanks for the feedback! I added your suggestions to this PR and made sure my branch is updated

@andreynering @pd93 anything else I can help with to move this forward?

I am not 100% sure on that ghcr login step as I think it depends on the permissions configured for this repo. I could try to use secrets.GH_PAT as well but idk what permissions are set on that either. If you could confirm which one I should go with, that would be great!

reneleonhardt · 2025-05-31T05:51:11Z

Dockerfile

@@ -0,0 +1,3 @@
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY task /task
+CMD ["/task"]


Probably better if you would actually run this container for whatever reasons 😅

Suggested change

CMD ["/task"]

ENTRYPOINT ["/task"]

Since its based on distroless, would you ever run it by itself though? I think this would maybe make sense with a usable base. Dunno

You could use the CLI / help at least if you're curious 😉

reneleonhardt · 2025-05-31T05:51:47Z

website/docs/installation.mdx

+:::
+
+```Dockerfile
+FROM ubuntu:22.04


Back to the future... 🚀

Suggested change

FROM ubuntu:22.04

FROM ubuntu:24.04

At this point we might as well put latest as a tag rather than keep updating the example, I'd say.

Of course, it's just an example anyway. Convention is not to use latest, the user should override anyway.

reneleonhardt · 2025-05-31T05:52:42Z

website/docs/installation.mdx

+```Dockerfile
+FROM ubuntu:22.04
+# ...
+COPY --from=ghcr.io/go-task/task:v3.40.2 /usr/local/bin/task /usr/local/bin/task


Let's use the nice new "shortcut"

Suggested change

COPY --from=ghcr.io/go-task/task:v3.40.2 /usr/local/bin/task /usr/local/bin/task

COPY --from=ghcr.io/go-task/task /task /usr/local/bin/task

reneleonhardt · 2025-05-31T05:58:23Z

Dockerfile

@@ -0,0 +1,3 @@
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY task /task


I don't know if the build is "hardened", let's just make sure that users can read and execute automatically

Suggested change

COPY task /task

COPY --chmod=555 task /task

IMO this isn't really necessary. We started under the assumption this is a means to distribute the binary. You can just copy it from this container and apply whatever permissions you want on it in your container

Just a suggestion. Most users don't know or care about permissions, this argument would make it easier for everyone, it's a binary after all.

mircea-pavel-anton mentioned this pull request Oct 21, 2024

Distribute as Docker Image #1801

Open

andreynering self-requested a review October 21, 2024 20:09

mircea-pavel-anton force-pushed the main branch 3 times, most recently from 7ee6ad0 to 1795ad5 Compare December 7, 2024 13:33

mircea-pavel-anton marked this pull request as ready for review December 7, 2024 14:09

pd93 reviewed Dec 7, 2024

View reviewed changes

mircea-pavel-anton force-pushed the main branch 3 times, most recently from c05b218 to 4ca75d4 Compare December 8, 2024 13:25

mircea-pavel-anton requested a review from pd93 December 8, 2024 13:26

andreynering reviewed Dec 12, 2024

View reviewed changes

mircea-pavel-anton requested a review from andreynering December 12, 2024 21:25

andreynering approved these changes Jan 18, 2025

View reviewed changes

andreynering requested a review from vmaerten January 18, 2025 14:14

mircea-pavel-anton force-pushed the main branch from 89a14a7 to 48c8985 Compare February 2, 2025 09:26

mircea-pavel-anton and others added 13 commits February 2, 2025 11:27

add goreleaser config for docker images

a938d5b

add basic dockerfile

ef67e13

DROPME: add devcontainer

751643b

use scratch as a base for the dockerfile

933a0d3

copy over all shell completions under /etc/completion

0b36547

add example in docs

ee2a48a

only push to GHCR, not docker.io

68ffcd5

add note about compatibility?

499d774

Remove references to the shell completions file in the repo

ed262a6

update goreleaser config docker tags

d4eb798

update docker image labels

61e8748

Co-authored-by: Andrey Nering <[email protected]>

fix style in docs

6809a1d

Co-authored-by: Andrey Nering <[email protected]>

fix: add line break at the end of the file

070567f

remove devcontainer configuration

e09b7dc

mircea-pavel-anton force-pushed the main branch from 48c8985 to e09b7dc Compare February 2, 2025 09:27

add step to login to ghcr

bd155e2

reneleonhardt reviewed May 24, 2025

View reviewed changes

.goreleaser.yml Outdated Show resolved Hide resolved

reneleonhardt reviewed May 24, 2025

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

mircea-pavel-anton added 4 commits May 30, 2025 20:19

Merge branch 'go-task:main' into main

fff0b84

fix(Dockerfile): use distroless image as base

d903835

fix(Dockerfile): put executable in / directly

528970e

fix(goreleaser): remove v8 prefix from arm64 builds

a447222

mircea-pavel-anton requested review from reneleonhardt and andreynering May 30, 2025 17:24

reneleonhardt reviewed May 31, 2025

View reviewed changes

	COPY --from=ghcr.io/go-task/task:v3.40.2 /usr/local/bin/task /usr/local/bin/task
	COPY --from=ghcr.io/go-task/task /task /usr/local/bin/task

		@@ -0,0 +1,3 @@
		FROM gcr.io/distroless/static-debian12:nonroot
		COPY task /task

Uh oh!

chore: Distribute as docker image #1875

Are you sure you want to change the base?

chore: Distribute as docker image #1875

Uh oh!

Conversation

mircea-pavel-anton commented Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Some notes

TODO

Uh oh!

mircea-pavel-anton commented Dec 7, 2024

Uh oh!

pd93 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mircea-pavel-anton Dec 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andreynering left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andreynering left a comment

Choose a reason for hiding this comment

Uh oh!

mircea-pavel-anton commented Feb 2, 2025

Uh oh!

Uh oh!

Uh oh!

mircea-pavel-anton commented May 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mircea-pavel-anton May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

reneleonhardt May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mircea-pavel-anton commented Oct 21, 2024 •

edited

Loading

mircea-pavel-anton Dec 8, 2024 •

edited

Loading

mircea-pavel-anton commented May 30, 2025 •

edited

Loading

mircea-pavel-anton May 31, 2025 •

edited

Loading

reneleonhardt May 31, 2025 •

edited

Loading