Use ghcr.io for build images (#1482)

Summary: This switches to using ghcr.io for our build images.
We will continue to maintain a copy on gcr.io for now and also
sync historic images to ghcr.io.

Type of change: /kind cleanup

Test Plan: All github actions on this PR should work.

---------

Signed-off-by: Vihang Mehta <vihang@pixielabs.ai>

Author: vihangm

.github/workflows/get_image.yaml

@@ -27,6 +27,6 @@ jobs:
         ref: ${{ inputs.ref }}
     - id: get-version
       run: >-
-        IMAGE_NAME="gcr.io/pixie-oss/pixie-dev-public/${{ inputs.image-base-name }}";
+        IMAGE_NAME="ghcr.io/pixie-io/${{ inputs.image-base-name }}";
         IMAGE_TAG="$(grep DOCKER_IMAGE_TAG docker.properties | cut -d'=' -f2)";
         echo "image=${IMAGE_NAME}:${IMAGE_TAG}" >> $GITHUB_OUTPUT

docker.properties

@@ -1,4 +1,4 @@
-DOCKER_IMAGE_TAG=202306071557
-LINTER_IMAGE_DIGEST=66c784bb0b1bc7ead721d8d45e3bd4a85a771ead79f3056de4c74c886cdeecef
-DEV_IMAGE_DIGEST=cc755b0afa75f3e1601c9e51ebe0dea81fdd611bebbdc8469bf0da69f9deefa1
-DEV_IMAGE_WITH_EXTRAS_DIGEST=b5b855b17072d76446b7a3bcf733339b44343baa82d5253b4a3fd60ba6c4e7d8
+DOCKER_IMAGE_TAG=202306140051
+LINTER_IMAGE_DIGEST=45fec24993780e6c2226642b098fc62e775733bd51ca738df33d1594add419a2
+DEV_IMAGE_DIGEST=5850a28fe3352b9b0753be2570fdd48e4e735af7b0949af9ce99736cf5f3bd53
+DEV_IMAGE_WITH_EXTRAS_DIGEST=79ff03b395485efdb1b3c231930dca41ee4dcc68c2be64588a0035538494815f

scripts/run_docker.sh

@@ -29,7 +29,7 @@ bold="\e[1m"
 resetcolor="\e[0m"
 
 # Docker image information.
-docker_image_base=gcr.io/pixie-oss/pixie-dev-public/dev_image_with_extras
+docker_image_base=ghcr.io/pixie-io/dev_image_with_extras
 os="$(uname)"
 version=$(grep DOCKER_IMAGE_TAG "${workspace_root}/docker.properties" | cut -d= -f2)
 digest=$(grep DEV_IMAGE_WITH_EXTRAS_DIGEST "${workspace_root}/docker.properties" | cut -d= -f2)

tools/chef/Makefile

@@ -20,6 +20,7 @@ DOCKER_PROPERTIES_FILE := $(TOT)/docker.properties
 # Commands.
 DOCKER := docker
 PACKER := packer
+REGSYNC := regsync
 
 BASE_IMAGE_VERSION := $(shell date "+%Y%m%d%H%M")
 BASE_IMAGE_VERSION_FILE := base_image_version.txt
@@ -48,6 +49,7 @@ build_and_push_base_image:
 		-var "generated_image_tag=$(BASE_IMAGE_VERSION)" \
 		packer_docker_base.json
 	echo $(BASE_IMAGE_VERSION) > $(BASE_IMAGE_VERSION_FILE)
+	$(MAKE) sync_images
 
 .PHONY: build_and_push_dev_images
 build_and_push_dev_images:
@@ -70,7 +72,11 @@ build_and_push_dev_images:
 		packer_docker_dev_extras.json
 
 	echo "DOCKER_IMAGE_TAG=$(DEV_IMAGE_VERSION)" > $(DOCKER_PROPERTIES_FILE)
-
 	echo "LINTER_IMAGE_DIGEST=$(LINTER_IMAGE_DIGEST)" >> $(DOCKER_PROPERTIES_FILE)
 	echo "DEV_IMAGE_DIGEST=$(DEV_IMAGE_DIGEST)" >> $(DOCKER_PROPERTIES_FILE)
 	echo "DEV_IMAGE_WITH_EXTRAS_DIGEST=$(DEV_IMAGE_WITH_EXTRAS_DIGEST)" >> $(DOCKER_PROPERTIES_FILE)
+	$(MAKE) sync_images
+
+.PHONY: sync_images
+sync_images:
+	$(REGSYNC) once --config image_sync.yaml

tools/chef/cookbooks/px_dev/recipes/golang.rb

@@ -48,6 +48,8 @@
             go install github.com/go-bindata/go-bindata/go-bindata@v3.1.2+incompatible && \
             go install github.com/google/go-containerregistry/cmd/crane@v0.15.2 && \
             go install github.com/sigstore/cosign/v2/cmd/cosign@v2.0.2 && \
+            go install github.com/regclient/regclient/cmd/regctl@v0.4.8 && \
+            go install github.com/regclient/regclient/cmd/regsync@v0.4.8 && \
             go clean -modcache && \
             go clean -cache)
 end

tools/chef/image_sync.yaml

@@ -0,0 +1,46 @@
+---
+version: 1
+creds:
+- registry: gcr.io
+- registry: ghcr.io
+  # These env vars may be left unset if the user running
+  # the sync has credentials for ghcr.io already in their
+  # active docker config.
+  user: "{{env \"GHCR_USER\"}}"
+  pass: "{{env \"GHCR_PASS\"}}"
+defaults:
+  ratelimit:
+    retry: 15m
+  parallel: 8
+sync:
+# The deny tags aren't strictly necessary since these are
+# supposed to be complete mirrors, but they just speed up
+# the sync by ignoring older images that are already copied.
+- source: gcr.io/pixie-oss/pixie-dev-public/base_image
+  target: ghcr.io/pixie-io/base_image
+  type: repository
+  tags:
+    deny:
+    - "202[0-2].*"
+    - "20230[1-5].*"
+- source: gcr.io/pixie-oss/pixie-dev-public/dev_image
+  target: ghcr.io/pixie-io/dev_image
+  type: repository
+  tags:
+    deny:
+    - "202[0-2].*"
+    - "20230[1-5].*"
+- source: gcr.io/pixie-oss/pixie-dev-public/dev_image_with_extras
+  target: ghcr.io/pixie-io/dev_image_with_extras
+  type: repository
+  tags:
+    deny:
+    - "202[0-2].*"
+    - "20230[1-5].*"
+- source: gcr.io/pixie-oss/pixie-dev-public/linter_image
+  target: ghcr.io/pixie-io/linter_image
+  type: repository
+  tags:
+    deny:
+    - "202[0-2].*"
+    - "20230[1-5].*"