Merge pull request pmacct#847 from msune/docker_arm_support

* Docker: build and publish linux/arm64 images (experimental)

Author: paololucente

.dockerignore

@@ -51,3 +51,6 @@ src/external_libs/rootfs
 
 # Dockerfiles makes no sense in the build context
 **/Dockerfile
+
+# Exclude Makefile (dev only)
+docker/Makefile

.github/workflows/ci.yaml

@@ -107,40 +107,21 @@ jobs:
           docker exec -i $CONTAINER_ID ./ci/script.sh
           docker stop $CONTAINER_ID
 
-  ### Step 3: official docker image generation
-  pmacct-docker:
+  ### Step 3.1: test that local single-platform builds work fine
+  docker-build-test-local:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout pmacct
-        uses: actions/checkout@v4
+        uses: actions/checkout@v1 #Don't use v2 messes everything
         with:
           path: pmacct
-          fetch-depth: 0
-          fetch-tags: 1
 
-      - name: Check DAEMONS env. variable...
+      - name: Build single-platform
         run: |
-          #Sanity, avoid regression #816
-          N_DAEMONS="$(echo $DAEMONS | wc --words)"
-          if [[ "${N_DAEMONS}" != "7" ]]; then
-              echo "ERROR: invalid number of DAEMONS: ${N_DAEMONS}"
-              exit 1
-          fi
-
-      - name: Build containers
-        uses: ./pmacct/.github/actions/build_containers/
-        with:
-            daemons: ${{env.DAEMONS}}
-
-      - name: Docker save images
-        run: |
-          echo "Saving images as artifacts..."
-          mkdir -p /tmp/docker/
-          docker save -o /tmp/docker/pmacct_docker_images.tar base:_build $(for DAEMON in ${DAEMONS};do echo "${DAEMON}:_build "; done)
+          cd docker && V=1 make
 
       - name: Docker (compose) smoke test
         run: |
-          cd pmacct
           echo "Running smoke test using docker compose..."
           TAG=_build docker compose -f ci/smoke-test/docker-compose.yml up -d
           sleep 10
@@ -151,51 +132,31 @@ jobs:
           echo "Stopping containers..."
           TAG=_build docker compose -f ci/smoke-test/docker-compose.yml down
 
-      - name: Export pmacct docker images as an artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: pmacct_docker_images
-          retention-days: 1
-          path: /tmp/docker
-
-  ### Step 4: Upload images to dockerhub (bleeding-edge, latest and releases)
-  publish-dockerhub:
-    needs: [pmacct-docker, build-and-test]
+  ### Step 3.2: Build test and publish (bleeding-edge, latest and releases)
+  docker-multiplatform-build-test-publish:
     runs-on: ubuntu-22.04
-    if: github.event_name != 'pull_request' && vars.SKIP_DOCKERHUB_PUBLISH != 'true'
+    needs: [build-and-test, docker-build-test-local]
     env:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      PLATFORMS: linux/amd64,linux/arm64
     steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: pmacct_docker_images
-          path: /tmp/docker
-
-      - name: Import pmacct docker images in the local registry
-        run: |
-          docker load -i /tmp/docker/pmacct_docker_images.tar
-
       - name: Checkout pmacct
         uses: actions/checkout@v1 #Don't use v2 messes everything
         with:
           path: pmacct
 
-      - name: Build and upload containers
+      - name: Deduce PMACCT version and tags
         run: |
           echo "Fix mess with tags in actions/checkout..."
           git fetch -f && git fetch -f --tags
           echo "Deducing PMACCT_VERSION..."
           PMACCT_VERSION=$(git describe --abbrev=0 --match="v*")
-          echo "PMACCT_VERSION=$PMACCT_VERSION"
-          echo "Uploading to dockerhub ...";
-          echo ${DOCKER_PASSWORD} | docker login -u ${DOCKER_USERNAME} --password-stdin;
 
           #Always push bleeding-edge when pushed to master
           GIT_IS_BLEEDING_EDGE=$( (git branch --all --contains HEAD | grep master ) || echo "")
           echo "GIT_IS_BLEEDING_EDGE=$GIT_IS_BLEEDING_EDGE"
           if [ "$GIT_IS_BLEEDING_EDGE" != "" ]; then
             echo "Tagging and uploading 'bleeding-edge'..."
+            TAGS="$TAGS bleeding-edge"
           else
             echo "NOT uploading 'bleeding-edge'... Not HEAD of master"
           fi
@@ -205,32 +166,69 @@ jobs:
           if [ "$GIT_RELEASE_TAG" != "" ]; then
             echo "GIT_RELEASE_TAG=$GIT_RELEASE_TAG"
             echo "Tagging and uploading release '$GIT_RELEASE_TAG'..."
+            TAGS="$TAGS $GIT_RELEASE_TAG"
 
             #Latest tag
             GIT_LAST_TAG=$(git tag --sort=v:refname | tail -n 1);
             echo "GIT_LAST_TAG=$GIT_LAST_TAG"
             if [ "$GIT_RELEASE_TAG" == "$GIT_LAST_TAG" ]; then
               echo "Tagging and uploading 'latest'..."
+              TAGS="$TAGS latest"
             else
               echo "NOT uploading 'latest'..."
             fi
           else
             echo "NOT uploading '$GIT_RELEASE_TAG' nor 'latest'. Not a release!"
           fi
 
-          #Let's do it!
-          EXT_DAEMONS="base ${DAEMONS}"
-          for DAEMON in ${EXT_DAEMONS}; do
-            if [ "$GIT_IS_BLEEDING_EDGE" != "" ]; then
-              docker tag ${DAEMON}:_build ${DOCKER_USERNAME}/${DAEMON}:bleeding-edge;
-              docker push ${DOCKER_USERNAME}/${DAEMON}:bleeding-edge;
-            fi
-            if [ "$GIT_RELEASE_TAG" != "" ]; then
-              docker tag ${DAEMON}:_build ${DOCKER_USERNAME}/${DAEMON}:${PMACCT_VERSION};
-              docker push ${DOCKER_USERNAME}/${DAEMON}:${PMACCT_VERSION};
-              if [ "$GIT_RELEASE_TAG" == "$GIT_LAST_TAG" ]; then
-                docker tag ${DAEMON}:_build ${DOCKER_USERNAME}/${DAEMON}:latest;
-                docker push ${DOCKER_USERNAME}/${DAEMON}:latest;
-              fi
-            fi
-          done
+          #Summarize deduced tags
+          echo "Deduced tags: $TAGS"
+          echo "TAGS=$TAGS" >> $GITHUB_ENV
+
+      - name: Get Runner's IP Address
+        run: |
+           RUNNER_IP=$(hostname -I | awk '{print $1}')
+           echo "RUNNER_IP=$RUNNER_IP" >> $GITHUB_ENV
+           echo "Deduced RUNNER_IP: $RUNNER_IP"
+
+      - name: Spawn docker registry
+        run: |
+          echo "Instruct dockerd to trust $RUNNER_IP:5000 as an insecure registry..."
+          sudo mkdir -p /etc/docker
+          echo "{
+            \"insecure-registries\": [\"http://$RUNNER_IP:5000\"]
+          }" | sudo tee /etc/docker/daemon.json > /dev/null
+          sudo systemctl restart docker
+          echo "Starting temporary docker registry..."
+          docker run -d -p 5000:5000 --name registry registry:2
+
+      - name: Build for platforms
+        run: |
+          echo "Building platforms: ${{ env.PLATFORMS }}..."
+          echo "Got tags from previous step: $TAGS"
+          cd docker && BUILD_REGISTRY=$RUNNER_IP:5000 PLATFORMS="${{env.PLATFORMS}}" V=1 make
+
+      - name: Docker (compose) smoke test
+        run: |
+          echo "Running smoke test using docker compose..."
+          export DOCKER_OPTS="--insecure-registry $RUNNER_IP:5000"
+          TAG=_build REPO=$RUNNER_IP:5000/ docker compose -f ci/smoke-test/docker-compose.yml up -d
+          sleep 10
+          echo "Check that all containers are up and running, without restarts ..."
+          if [[ "$(docker inspect `docker ps -aq` | grep RestartCount | grep -v '\"RestartCount\": 0')" != "" ]]; then
+            echo "Some containers restarted!" && docker inspect `docker ps -aq` && /bin/false
+          fi
+          echo "Stopping containers..."
+          TAG=_build docker compose -f ci/smoke-test/docker-compose.yml down
+
+      - name: Tag and push to dockerhub
+        if: ${{ github.event_name != 'pull_request' && vars.SKIP_DOCKERHUB_PUBLISH != 'true' && env.TAGS != '' }}
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+        run: |
+          echo "Logging in...";
+          echo ${DOCKER_PASSWORD} | docker login -u ${DOCKER_USERNAME} --password-stdin
+          echo "Publishing platforms(archs): ${{ env.PLATFORMS }}..."
+          echo "Got tags from previous step: $TAGS"
+          cd docker && BUILD_REGISTRY=$RUNNER_IP:5000 PUSH=${{secrets.DOCKER_USERNAME}} TAGS="${TAGS}" PLATFORMS="${{env.PLATFORMS}}" V=1 make

.gitignore

@@ -63,3 +63,5 @@ test-framework/**/*.bak
 tests/**/*.bak
 test-framework/results/
 
+#Docker stuff
+docker/.buildx_config.toml

ci/deps.sh

@@ -35,10 +35,10 @@ mkdir -p /tmp
 cd /tmp
 
 # Dependencies (not fulfilled by Dockerfile)
-git clone --depth 1 https://github.com/akheron/jansson
+git clone --depth 1 -b v2.14 https://github.com/akheron/jansson
 cd jansson ; rm -rf ./.git ; autoreconf -i ; ./configure --prefix=/usr/local/ ; make ; sudo make install ; cd ..
 
-git clone --depth 1 https://github.com/edenhill/librdkafka
+git clone --depth 1 -b v2.6.1 https://github.com/confluentinc/librdkafka
 cd librdkafka ; rm -rf ./.git ; ./configure --prefix=/usr/local/ ; make ; sudo make install ; cd ..
 
 # rabbitmq-c 0.14.0 depends on cmake 3.22 or greater
@@ -50,7 +50,7 @@ else
     cd rabbitmq-c-0.13.0 ; mkdir build ; cd build ; cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_INSTALL_LIBDIR=lib .. ; sudo cmake --build . --target install ; cd .. ; cd ..
 fi
 
-git clone --depth 1 --recursive https://github.com/maxmind/libmaxminddb
+git clone --depth 1 -b 1.11.0 --recursive https://github.com/maxmind/libmaxminddb
 cd libmaxminddb ; rm -rf ./.git ; ./bootstrap ; ./configure --prefix=/usr/local/ ; make ; sudo make install ; cd ..
 
 git clone --depth 1 -b 4.8-stable https://github.com/ntop/nDPI

ci/smoke-test/docker-compose.yml

@@ -1,44 +1,42 @@
-version: "3"
-
 services:
   nfacctd:
-    image: nfacctd:${TAG}
+    image: ${REPO:-}nfacctd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure
 
   pmacctd:
-    image: pmacctd:${TAG}
+    image: ${REPO:-}pmacctd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure
 
   pmbgpd:
-    image: pmbgpd:${TAG}
+    image: ${REPO:-}pmbgpd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure
 
   pmbmpd:
-    image: pmbmpd:${TAG}
+    image: ${REPO:-}pmbmpd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure
 
   pmtelemetryd:
-    image: pmtelemetryd:${TAG}
+    image: ${REPO:-}pmtelemetryd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure
 
   sfacctd:
-    image: sfacctd:${TAG}
+    image: ${REPO:-}sfacctd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure
 
   uacctd:
-    image: uacctd:${TAG}
+    image: ${REPO:-}uacctd:${TAG}
     volumes:
       - ./etc/pmacct:/etc/pmacct
     restart: on-failure

docker/.gitignore

@@ -0,0 +1 @@
+!Makefile

docker/Makefile

@@ -0,0 +1,87 @@
+SHELL := /bin/bash
+.SHELLFLAGS := -e -c
+
+PLATFORMS ?= linux/amd64
+DAEMONS ?= pmacctd nfacctd sfacctd uacctd pmbgpd pmbmpd pmtelemetryd
+DEPS_DONT_CHECK_CERTIFICATE ?=
+N_WORKERS ?= 2
+PROGRESS ?= --progress=plain
+MEMORY ?= 8g
+TAGS ?=
+BUILD_REGISTRY ?=
+LOAD ?=
+PUSH ?=
+
+ifneq ($(strip $(PUSH)),)
+  PUSH_ARG = --push
+endif
+
+ifneq ($(strip $(BUILD_REGISTRY)),)
+  BUILD_REGISTRY_REPO=$(BUILD_REGISTRY)/
+  BUILD_REGISTRY_PUSH=--push
+else
+  LOAD=--load
+endif
+
+ifeq ($(V),1)
+  QUIET =
+else
+  QUIET = @
+endif
+
+all: build
+
+build: __dump_env __builder_setup build_base build_daemons
+
+__dump_env:
+	$(QUIET) echo "Env:"
+	$(QUIET) echo "  PLATFORMS: $(PLATFORMS)"
+	$(QUIET) echo "  DAEMONS: $(DAEMONS)"
+	$(QUIET) echo "  DEPS_DONT_CHECK_CERTIFICATE: $(DEPS_DONT_CHECK_CERTIFICATE)"
+	$(QUIET) echo "  N_WORKERS: $(N_WORKERS)"
+	$(QUIET) echo "  MEMORY: $(MEMORY)"
+	$(QUIET) echo "  BUILD_REGISTRY: $(BUILD_REGISTRY)"
+	$(QUIET) echo "  PUSH: $(PUSH)"
+	$(QUIET) echo "  TAGS: $(TAGS)"
+	$(QUIET) echo "  V: $(V)"
+	$(QUIET) echo "  ---"
+	$(QUIET) echo "  BUILD_REGISTRY_REPO: $(BUILD_REGISTRY_REPO)"
+	$(QUIET) echo "  PUSH_ARG: $(PUSH_ARG)"
+	$(QUIET) echo "  LOAD: $(LOAD)"
+	$(QUIET) echo "  QUIET: $(QUIET)"
+
+__builder_setup:
+	$(QUIET) echo "Installing QEMU-based multi-arch builder..."
+	$(QUIET) if [[ "$(BUILD_REGISTRY)" != "" ]]; then \
+			if [ -z "$$(docker buildx ls | grep xbuilder)" ]; then \
+				echo "" > .buildx_config.toml; \
+				echo '[registry."$(BUILD_REGISTRY)"]' >> .buildx_config.toml; \
+				echo '  http = true' >> .buildx_config.toml; \
+				docker buildx create --name xbuilder --driver docker-container --config .buildx_config.toml --use; \
+			fi; \
+			docker buildx use xbuilder; \
+		else \
+			echo "Using default buildx builder..."; \
+		fi; \
+		docker run --privileged multiarch/qemu-user-static --reset -p yes
+build_base:
+	$(QUIET) echo "Building base container..."
+	$(QUIET) TAGS_BASE=""; for TAG in $(TAGS); do TAGS_BASE="$$TAGS_BASE -t $(PUSH)/base:$${TAG} "; done; \
+	docker buildx build $(PROGRESS) --memory $(MEMORY) --platform $(PLATFORMS) -t $(BUILD_REGISTRY_REPO)base:_build $(LOAD) $(BUILD_REGISTRY_PUSH) --build-arg NUM_WORKERS=$(N_WORKERS) --build-arg DEPS_DONT_CHECK_CERTIFICATE=$(DEPS_DONT_CHECK_CERTIFICATE) -f base/Dockerfile .. ; \
+	if [ -n "$(PUSH)"  ]; then \
+		docker buildx build $(PROGRESS) --memory $(MEMORY) --platform $(PLATFORMS) $${TAGS_BASE} $(PUSH_ARG) --build-arg NUM_WORKERS=$(N_WORKERS) --build-arg DEPS_DONT_CHECK_CERTIFICATE=$(DEPS_DONT_CHECK_CERTIFICATE) -f base/Dockerfile .. ; \
+	fi
+
+build_daemons:
+	$(QUIET) for DAEMON in $(DAEMONS); do \
+		TAGS_DAEMON=""; for TAG in $(TAGS); do TAGS_DAEMON="$$TAGS_DAEMON -t $(PUSH)/$${DAEMON}:$${TAG} "; done; \
+		echo "Building '$${DAEMON}'"; \
+		docker buildx build $(PROGRESS) --memory $(MEMORY) --platform $(PLATFORMS) -t $(BUILD_REGISTRY_REPO)$${DAEMON}:_build $(LOAD) $(BUILD_REGISTRY_PUSH) --build-arg BUILD_REGISTRY=$(BUILD_REGISTRY) -f $${DAEMON}/Dockerfile .. ; \
+		if [ -n "$(PUSH)"  ]; then \
+			docker buildx build $(PROGRESS) --memory $(MEMORY) --platform $(PLATFORMS) $${TAGS_DAEMON} $(PUSH_ARG) --build-arg BUILD_REGISTRY=$(BUILD_REGISTRY) -f $${DAEMON}/Dockerfile .. ; \
+		fi \
+	done
+
+clean:
+	$(QUIET) docker run --privileged multiarch/qemu-user-static --reset
+	$(QUIET) docker buildx rm xbuilder