Replace docker-in-docker with buildah

This avoids the need of using privilledged namespaces and dind
as buildah are able to build images unprivilledged.

One thing to note is that buildah inside docker is not a
supported configuration and not tested in upstream podman,
but the possible fallout is still easier to deal with than
dind and requiring privileged runners.
This commit is contained in:
Jordan Petridis 2019-03-26 20:40:35 +02:00 committed by GStreamer Merge Bot
parent 95f9b25683
commit dd69902fbf

View file

@ -25,18 +25,15 @@ test manifest:
- "junit.xml" - "junit.xml"
.base: .base:
image: "docker:stable" image: 'registry.fedoraproject.org/fedora:31'
extends: extends:
- '.global_ci_policy' - '.global_ci_policy'
rules: rules:
- when: 'manual' - when: 'manual'
allow_failure: true allow_failure: true
services:
- docker:dind
variables: variables:
# When using dind, it's wise to use the overlayfs driver for STORAGE_DRIVER: 'vfs'
# improved performance. BUILDAH_FORMAT: 'docker'
DOCKER_DRIVER: "overlay2"
GIT_STRATEGY: fetch GIT_STRATEGY: fetch
script: script:
- export DATE=$(date +"%Y-%m-%d") - export DATE=$(date +"%Y-%m-%d")
@ -44,24 +41,29 @@ test manifest:
- export _UID="${IMAGE}:${DATE}-${CI_JOB_ID}" - export _UID="${IMAGE}:${DATE}-${CI_JOB_ID}"
- export LATEST="${IMAGE}:latest" - export LATEST="${IMAGE}:latest"
- docker build --pull --build-arg DEFAULT_BRANCH=${GST_UPSTREAM_BRANCH} -f ${DOCKERFILE} -t ${LATEST} ${CONTEXT_DIR} - dnf install -y buildah runc
# Newer versions of podman/buildah try to set overlayfs mount options when
# using the vfs driver, and this causes errors.
- sed -i '/^mountopt =.*/d' /etc/containers/storage.conf
- buildah bud --build-arg DEFAULT_BRANCH=${GST_UPSTREAM_BRANCH} -f ${DOCKERFILE} -t ${LATEST} ${CONTEXT_DIR}
# If we are in a fork, push the image to the reigstry regardless the branch # If we are in a fork, push the image to the reigstry regardless the branch
- | - |
if [ "$CI_PROJECT_NAMESPACE" != "gstreamer" ]; then if [ "$CI_PROJECT_NAMESPACE" != "gstreamer" ]; then
docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY buildah login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
docker push ${LATEST} buildah push ${LATEST}
fi fi
# Push the images to the upstream registry # Push the images to the upstream registry
- | - |
if [ "$CI_PROJECT_NAMESPACE" = "gstreamer" ]; then if [ "$CI_PROJECT_NAMESPACE" = "gstreamer" ]; then
# Tag the image with the git ref # Tag the image with the git ref
docker image tag ${LATEST} ${_UID}-${CI_COMMIT_REF_NAME} buildah image tag ${LATEST} ${_UID}-${CI_COMMIT_REF_NAME}
# Push the tags # Push the tags
docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY buildah login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
docker push ${_UID}-${CI_COMMIT_REF_NAME} buildah push ${_UID}-${CI_COMMIT_REF_NAME}
docker push ${LATEST} buildah push ${LATEST}
fi fi
alpine amd64 manifest builder docker: alpine amd64 manifest builder docker: