Base image build process - #7270
Conversation
|
|
e2c8ca6 to
611f535
Compare
|
dc70509 to
b8f1ceb
Compare
d3cc9d8 to
1902e53
Compare
1902e53 to
578a92d
Compare
f90836f to
5d90e00
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ac604fe36
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - No `ADD` — use `COPY` for everything (no glob sources, no whole-directory copies, no remote | ||
| URLs). |
There was a problem hiding this comment.
This restriction contradicts the implementation and the base Dockerfiles added here: _dependency_paths() deliberately expands each source with context_root.glob(source) and enumerates files beneath matched directories, while files such as nodejs/express4.base.Dockerfile and php/php-fpm.base.Dockerfile use whole-directory COPY sources. Contributors following this page would avoid supported patterns that the repository itself relies on; remove the prohibition on globs and directory sources or change the implementation and existing Dockerfiles to reject them consistently. .cursor/rules/doc.mdcL19-L22
Useful? React with 👍 / 👎.
| if result.returncode == 0: | ||
| print(f"{image_tag} is available") | ||
| return | ||
|
|
||
| if time.monotonic() >= deadline: |
There was a problem hiding this comment.
When docker manifest inspect fails because of authentication, rate limiting, or another registry/CLI error rather than an absent tag, every nonzero result enters this polling path and is retried until the 900-second deadline. In the inspected GitHub workflows, this wait runs before the Docker Hub login performed by .github/actions/pull_images/main.sh, and build_end_to_end does not perform that login at all, so an already-published image can produce a misleading 15-minute timeout. Only a confirmed missing-manifest response should be polled; other errors should fail immediately, or the workflows should authenticate before this step.
Useful? React with 👍 / 👎.
1 participant
Content-Addressed Base Images via GitLab CI
Summary
Automate weblog base image publishing with content-addressed tags, replacing the manual label-driven workflow (
build-*-base-imagesPR labels + manual version bumps + human push coordination).What Changed
build_base_imagesGitLab CI job runs on every push: derives dependencies fromCOPYinstructions in each*.base.Dockerfile, computes a 12-char content hash, and pushesdatadog/system-tests:<name>.base-<hash>if the tag doesn't exist. Idempotent — never overwrites.utils/build/docker/base-images.lock.json) maps stable aliases (system_tests_base_nodejs_express4) → immutable tags. Consumer Dockerfiles useFROM <alias>, resolved via BuildKit--build-contextat build time.wait_for_base_image.py) for the locked tag instead.build-*-base-imageslabels,_build_weblog_base_imagesworkflow input, manual-vNtag management.New Workflow
python utils/scripts/build_base_images.py --update-lock+python utils/scripts/update_mirror_images.pyWorkflow
🚀 Once your PR is reviewed and the CI green, you can merge it!
🛟 #apm-shared-testing 🛟
Reviewer checklist
tests/ormanifests/is modified ? I have the approval from R&P teambuild-XXX-imagelabel is present