Skip to content

Improving provenance of image #4834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnsimons merged 11 commits into from
Feb 25, 2025
Merged

Improving provenance of image #4834

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
4ad6686
Improving provenance of image
johnsimons Feb 24, 2025
1bd4aa8
Update .github/workflows/build-containers.yml
johnsimons Feb 25, 2025
5b8b149
Update .github/workflows/build-containers.yml
johnsimons Feb 25, 2025
e76f415
Update .github/workflows/build-containers.yml
johnsimons Feb 25, 2025
9a8308a
Update .github/workflows/build-db-container.yml
johnsimons Feb 25, 2025
282db9d
Update .github/workflows/build-db-container.yml
johnsimons Feb 25, 2025
f06578f
Update .github/workflows/push-container-images.yml
johnsimons Feb 25, 2025
97cf2a5
Update .github/workflows/container-integration-test.yml
johnsimons Feb 25, 2025
a3f01f8
Update .github/workflows/push-container-images.yml
johnsimons Feb 25, 2025
986397c
Update .github/workflows/push-container-images.yml
johnsimons Feb 25, 2025
14c63fd
setting both annotations
johnsimons Feb 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 47 additions & 24 deletions .github/workflows/build-containers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,16 @@ jobs:
include:
- name: servicecontrol
project: ServiceControl
description: ServiceControl error instance
title: ServiceControl
description: Gather status, performance and monitoring data for multiple endpoints from a single location.
- name: servicecontrol-audit
project: ServiceControl.Audit
description: ServiceControl audit instance
title: ServiceControl Audit Instance
description: Provide valuable information about the message flow through a system.
- name: servicecontrol-monitoring
project: ServiceControl.Monitoring
description: ServiceControl monitoring instance
title: ServiceControl Monitoring Instance
description: Track the health of a distributed system.
fail-fast: false
steps:
- name: Check for secrets
Expand All @@ -40,24 +43,44 @@ jobs:
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3.9.0
- name: Log in to GitHub container registry
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
- name: Build & inspect image
env:
TAG_NAME: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || env.MinVerVersion }}
run: |
docker buildx build --push --tag ghcr.io/particular/${{ matrix.name }}:${{ env.TAG_NAME }} \
--file src/${{ matrix.project }}/Dockerfile \
--build-arg VERSION=${{ env.MinVerVersion }} \
--annotation "index:org.opencontainers.image.title=${{ matrix.name }}" \
--annotation "index:org.opencontainers.image.description=${{ matrix.description }}" \
--annotation "index:org.opencontainers.image.created=$(date '+%FT%TZ')" \
--annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
--annotation "index:org.opencontainers.image.authors=Particular Software" \
--annotation "index:org.opencontainers.image.vendor=Particular Software" \
--annotation "index:org.opencontainers.image.version=${{ env.MinVerVersion }}" \
--annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}/tree/${{ github.sha }}" \
--annotation "index:org.opencontainers.image.url=https://hub.docker.com/r/particular/${{ matrix.name }}" \
--annotation "index:org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/" \
--annotation "index:org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra" \
Comment on lines -51 to -61
Copy link
Member

@DavidBoike DavidBoike Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By removing all of this stuff, that means we're not setting any annotations at the index level, only the image level. Is there a way to maintain this data at the index level as well using the build actions?

Copy link
Member Author

@johnsimons johnsimons Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@DavidBoike do we need it? What does it do for us?
Also, how do I check what is set and what is not?
I am asking because if you look at the cli call it produces, it creates some metadata, see https://github.com/Particular/ServiceControl/actions/runs/13491741985/job/37690969138?pr=4834#step:9:175, so maybe it does set it.

Copy link
Member

@DavidBoike DavidBoike Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you log in to GHCR with your PAT, and then look at an existing manifest, let's say for 6.4.0-alpha.0.22 using the following: (--raw gives it to you as raw JSON that doesn't strip stuff out)

docker buildx imagetools inspect ghcr.io/particular/servicecontrol:6.4.0-alpha.0.22 --raw

You'll see all the annotations there, this is the "index" level, the thing that points to the amd64/arm64 digests as well as the "unknown" architecture digests that are attestation metadata for each of the 2 architecures.

You can also pull the amd64 metadata by referencing the SHA:

docker buildx imagetools inspect ghcr.io/particular/servicecontrol:6.4.0-alpha.0.22@sha256:8997a5697b96a0d0a363a9f6b922d337847c3fa85a20a38b90e2a58739f9b91c --raw

No annotations/attestations, just pointing to the layers.

If you do an attestation manifest:

docker buildx imagetools inspect ghcr.io/particular/servicecontrol:6.4.0-alpha.0.22@sha256:c97784a1668a0aeb58ac319881f29c1111a2f83773e8459b9e32a769f1c3cdd1 --raw

Not much to see there.

So all to say the hope was that we were annotating everything at the "index" level which would apply to the whole version including all architectures, which this PR is currently losing.

If I repeat for the tag pr-4834 built by this PR:

docker buildx imagetools inspect ghcr.io/particular/servicecontrol:pr-4834 --raw

docker buildx imagetools inspect ghcr.io/particular/servicecontrol:pr-4834@sha256:9f4649f3780631024b3c4d24baf220fdcc53b2e23e25b3b872ef96ab3c0cf0a0 --raw

docker buildx imagetools inspect ghcr.io/particular/servicecontrol:6.4.0-alpha.0.22@sha256:e616aee45bbb8f7bfb29dcce810c269a3004dd88cc7085834c046860a3c6c942 --raw

First one loses the annotations and doesn't really "replace" it anywhere.

So Docker Hub doesn't currently show this anywhere (other registries might? GHCR only shows the description on pages like this one but that's just a staging area) but given the annotations are a standard it seems reasonable to assume that someday it might?? So while not critical it does concern me to just throw it away.

Copy link
Member Author

@johnsimons johnsimons Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@DavidBoike I think this may work 14c63fd (#4834)
but there is still a bit of repetition, but at least it is all in the same file.
What do you think?

Copy link
Member

@DavidBoike DavidBoike Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From docker buildx imagetools inspect ghcr.io/particular/servicecontrol:pr-4834 --raw looks like it does the trick for the annotations, but I have to admit I don't even remember (if I ever knew) how to validate that the labels are applied.

Copy link
Member Author

@johnsimons johnsimons Feb 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll check the labels

--platform linux/arm64,linux/amd64 .
docker buildx imagetools inspect ghcr.io/particular/${{ matrix.name }}:${{ env.TAG_NAME }}
uses: docker/login-action@v3.3.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Get current date
id: date
run: echo "date=$(date '+%FT%TZ')" >> $GITHUB_OUTPUT
- name: Build and push image to GitHub container registry
uses: docker/build-push-action@v6.14.0
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
sbom: true
labels: |
org.opencontainers.image.source=https://github.com/Particular/ServiceControl/tree/${{ github.sha }}
org.opencontainers.image.authors="Particular Software"
org.opencontainers.image.vendor="Particular Software"
org.opencontainers.image.url=https://hub.docker.com/r/particular/${{ matrix.name }}
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/
org.opencontainers.image.version=${{ env.MinVerVersion }}
org.opencontainers.image.revision=${{ github.sha }}
org.opencontainers.image.created=${{ steps.date.outputs.date }}
org.opencontainers.image.title=${{ matrix.title }}
org.opencontainers.image.description=${{ matrix.description }}
org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
annotations: |
index:org.opencontainers.image.source=https://github.com/Particular/ServiceControl/tree/${{ github.sha }}
index:org.opencontainers.image.authors="Particular Software"
index:org.opencontainers.image.vendor="Particular Software"
index:org.opencontainers.image.url=https://hub.docker.com/r/particular/${{ matrix.name }}
index:org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/
index:org.opencontainers.image.version=${{ env.MinVerVersion }}
index:org.opencontainers.image.revision=${{ github.sha }}
index:org.opencontainers.image.created=${{ steps.date.outputs.date }}
index:org.opencontainers.image.title=${{ matrix.title }}
index:org.opencontainers.image.description=${{ matrix.description }}
index:org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
file: src/${{ matrix.project }}/Dockerfile
tags: ghcr.io/particular/${{ matrix.name }}:${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || env.MinVerVersion }}
8 changes: 7 additions & 1 deletion .github/workflows/build-db-container.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,14 @@ jobs:
uses: ./.github/actions/validate-version
with:
version: ${{ env.MinVerVersion }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3.9.0
- name: Log in to GitHub container registry
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
uses: docker/login-action@v3.3.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Install Docker arm64 emulation
run: docker run --privileged --rm tonistiigi/binfmt --install arm64
- name: Build images
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/container-integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,11 @@ jobs:
- name: Run MinVer
uses: Particular/run-minver-action@v1.0.0
- name: Log in to GitHub container registry
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Log in to Docker Hub
uses: docker/login-action@v3.3.0
with:
Expand Down
24 changes: 14 additions & 10 deletions .github/workflows/push-container-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,28 +22,32 @@ jobs:
with:
version: ${{ inputs.version }}
- name: Log in to GitHub container registry
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
uses: docker/login-action@v3.3.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Login to Docker Hub
uses: docker/login-action@v3.3.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3.9.0
- name: Publish to Docker Hub
run: |
$containers = @('servicecontrol', 'servicecontrol-audit', 'servicecontrol-monitoring', 'servicecontrol-ravendb')
$tags = "${{ steps.validate.outputs.container-tags }}" -Split ','
$sourceTag = "${{ inputs.version }}"

foreach ($tag in $tags)
foreach($name in $containers)
{
foreach($name in $containers)
{
Write-Output "::group::Pushing $($name):$($tag)"
$cmd = "docker buildx imagetools create --tag particular/$($name):$($tag) ghcr.io/particular/$($name):$($sourceTag)"
Write-Output "Command: $cmd"
Invoke-Expression $cmd
Write-Output "::endgroup::"
}
Write-Output "::group::Pushing $name with $tags tags"
$tagsCLI = $tags -replace "^", "--tag particular/${name}:"
$cmd = "docker buildx imagetools create $tagsCLI ghcr.io/particular/${name}:$sourceTag"
Write-Output "Command: $cmd"
Invoke-Expression $cmd
Write-Output "::endgroup::"
}
- name: Update Docker Hub Description - ServiceControl
if: ${{ steps.validate.outputs.latest == 'true' }}
Expand Down
9 changes: 0 additions & 9 deletions src/ServiceControl.Audit/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,8 @@ RUN dotnet publish src/HealthCheckApp/HealthCheckApp.csproj --arch $TARGETARCH -

# Runtime image
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
ARG VERSION
WORKDIR /app

LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl \
org.opencontainers.image.authors="Particular Software" \
org.opencontainers.image.url=https://docs.particular.net/servicecontrol/ \
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/ \
org.opencontainers.image.version=$VERSION \
org.opencontainers.image.title=ServiceControl.Audit \
org.opencontainers.image.description="ServiceControl audit instance"

EXPOSE 44444

COPY --from=build /deploy/Particular.ServiceControl.Audit /app
Expand Down
9 changes: 0 additions & 9 deletions src/ServiceControl.Monitoring/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,8 @@ RUN dotnet publish src/HealthCheckApp/HealthCheckApp.csproj --arch $TARGETARCH -

# Runtime image
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
ARG VERSION
WORKDIR /app

LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl \
org.opencontainers.image.authors="Particular Software" \
org.opencontainers.image.url=https://docs.particular.net/servicecontrol/ \
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/ \
org.opencontainers.image.version=$VERSION \
org.opencontainers.image.title=ServiceControl.Monitoring \
org.opencontainers.image.description="ServiceControl monitoring instance"

EXPOSE 33633

COPY --from=build /deploy/Particular.ServiceControl.Monitoring /app
Expand Down
9 changes: 0 additions & 9 deletions src/ServiceControl/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,8 @@ RUN dotnet publish src/HealthCheckApp/HealthCheckApp.csproj --arch $TARGETARCH -

# Runtime image
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
ARG VERSION
WORKDIR /app

LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl \
org.opencontainers.image.authors="Particular Software" \
org.opencontainers.image.url=https://docs.particular.net/servicecontrol/ \
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/ \
org.opencontainers.image.version=$VERSION \
org.opencontainers.image.title=ServiceControl \
org.opencontainers.image.description="ServiceControl primary instance"

EXPOSE 33333

COPY --from=build /deploy/Particular.ServiceControl /app
Expand Down