{"action":"created","issue":{"url":"https://api.github.com/repos/drone/drone/issues/2462","repository_url":"https://api.github.com/repos/drone/drone","labels_url":"https://api.github.com/repos/drone/drone/issues/2462/labels{/name}","comments_url":"https://api.github.com/repos/drone/drone/issues/2462/comments","events_url":"https://api.github.com/repos/drone/drone/issues/2462/events","html_url":"https://github.com/drone/drone/issues/2462","id":345490340,"node_id":"MDU6SXNzdWUzNDU0OTAzNDA=","number":2462,"title":"Native Docker build and publish support","user":{"login":"bradrydzewski","id":817538,"node_id":"MDQ6VXNlcjgxNzUzOA==","avatar_url":"https://avatars1.githubusercontent.com/u/817538?v=4","gravatar_id":"","url":"https://api.github.com/users/bradrydzewski","html_url":"https://github.com/bradrydzewski","followers_url":"https://api.github.com/users/bradrydzewski/followers","following_url":"https://api.github.com/users/bradrydzewski/following{/other_user}","gists_url":"https://api.github.com/users/bradrydzewski/gists{/gist_id}","starred_url":"https://api.github.com/users/bradrydzewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradrydzewski/subscriptions","organizations_url":"https://api.github.com/users/bradrydzewski/orgs","repos_url":"https://api.github.com/users/bradrydzewski/repos","events_url":"https://api.github.com/users/bradrydzewski/events{/privacy}","received_events_url":"https://api.github.com/users/bradrydzewski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/drone/drone/milestones/12","html_url":"https://github.com/drone/drone/milestone/12","labels_url":"https://api.github.com/repos/drone/drone/milestones/12/labels","id":2541376,"node_id":"MDk6TWlsZXN0b25lMjU0MTM3Ng==","number":12,"title":"v1.0.0","description":"Issues and enhancements that should be resolved or implemented for a 1.0 release.","creator":{"login":"bradrydzewski","id":817538,"node_id":"MDQ6VXNlcjgxNzUzOA==","avatar_url":"https://avatars1.githubusercontent.com/u/817538?v=4","gravatar_id":"","url":"https://api.github.com/users/bradrydzewski","html_url":"https://github.com/bradrydzewski","followers_url":"https://api.github.com/users/bradrydzewski/followers","following_url":"https://api.github.com/users/bradrydzewski/following{/other_user}","gists_url":"https://api.github.com/users/bradrydzewski/gists{/gist_id}","starred_url":"https://api.github.com/users/bradrydzewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradrydzewski/subscriptions","organizations_url":"https://api.github.com/users/bradrydzewski/orgs","repos_url":"https://api.github.com/users/bradrydzewski/repos","events_url":"https://api.github.com/users/bradrydzewski/events{/privacy}","received_events_url":"https://api.github.com/users/bradrydzewski/received_events","type":"User","site_admin":false},"open_issues":38,"closed_issues":19,"state":"open","created_at":"2017-05-24T18:45:29Z","updated_at":"2018-10-22T22:12:33Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2018-07-29T00:46:36Z","updated_at":"2018-10-28T09:36:35Z","closed_at":null,"author_association":"MEMBER","body":"The goal with this change will be to support the `docker build` command natively in Drone. This should help teams that desire to build a Docker image, test inside the Docker image, and then push on success.\r\n\r\n__BUILDING:__\r\n\r\nThe existing docker-compose build syntax would be supported (we are not accepting proposals that deviate from this syntax):\r\n\r\n```yaml\r\npipeline:\r\n- name: build\r\n  build:\r\n    image: octocat/hello-world\r\n    context: .\r\n```\r\n\r\nExample specifies custom dockerfile:\r\n\r\n```yaml\r\npipeline:\r\n- name: build\r\n  build:\r\n    image: octocat/hello-world\r\n    context: .\r\n    dockerfile: Dockerfile\r\n```\r\n\r\nExample demonstrates all available fields (per docker-compose specification):\r\n\r\n```yaml\r\npipeline:\r\n- name: build\r\n  build:\r\n    content: .\r\n    dockerfile: Dockerfile\r\n    args:\r\n      foo: bar\r\n      baz: boo\r\n    labels:\r\n      foo: bar\r\n      baz: boo\r\n```\r\n\r\nIt should be possible to build the image, and then use the image in subsequent steps:\r\n\r\n```yaml\r\npipeline:\r\n- name: build\r\n  build:\r\n    image: octocat/hello-world\r\n    context: .\r\n- name: test\r\n  image: octocat/hello-world\r\n  commands:\r\n  - go build\r\n  - go test\r\n```\r\n\r\n__PUBLISHING:__\r\n\r\nYou optionally have the ability to publish the image at the end of a successful pipeline:\r\n\r\n```yaml\r\npipeline:\r\n- name: build\r\n  build:\r\n    image: octocat/hello-world\r\n    context: .\r\n- name: test\r\n  image: octocat/hello-world\r\n  commands:\r\n  - go build\r\n  - go test\r\n- name: publish\r\n  image: octocat/hello-world\r\n```\r\n\r\nWe need to limit when images are published:\r\n\r\n```yaml\r\npublish:\r\n- name: publish\r\n  image: octocat/hello-world\r\n  when:\r\n    branch:\r\n    - master\r\n    event:\r\n    - push\r\n    - pull_request\r\n```\r\n\r\n__SECURITY:__\r\n\r\nThe plan is to build on the host machine Docker daemon and to use unique container names (hashes) in place of the tagged names. This will enable the host machine docker cache to reduce build time. This will require us to use the Docker API to push to Dockerhub and push a manifest, so that we can use the original tagged image name, instead of the unique hash.\r\n\r\nFor example the below image (octocat/hello-world) will be replaced with a unique hash, like ee7fd16f988c7b5156b7de9a1a8cfc10, to prevent it from overwriting tags on the host machine.\r\n\r\n```\r\npipeline:\r\n- name: build\r\n  build:\r\n    image: octocat/hello-world\r\n    context: .\r\n```\r\n\r\nwould look like\r\n\r\n```\r\ndocker build -t ee7fd16f988c7b5156b7de9a1a8cfc10 .\r\n```\r\n\r\n__CHALLENGE:__\r\n\r\nThe main challenge is that I cannot figure out a way to publish and re-tag an image. For example, there is no easy way to do something like this:\r\n\r\n```\r\ndocker push ee7fd16f988c7b5156b7de9a1a8cfc10 --rename octocat/hello-world\r\n```\r\n\r\nIt is critical that we never tag an image on the host machine, otherwise a malicious use could (in theory) submit a pull request to overwrite popular images (golang, node, etc) and inject malicious code. __I have no clue how to achieve this yet ...__\r\n\r\nI need something like this, but for docker:\r\n\r\n```\r\nbuildah push imageID docker://registry.example.com/repository:tag\r\n```"},"comment":{"url":"https://api.github.com/repos/drone/drone/issues/comments/433689865","html_url":"https://github.com/drone/drone/issues/2462#issuecomment-433689865","issue_url":"https://api.github.com/repos/drone/drone/issues/2462","id":433689865,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzY4OTg2NQ==","user":{"login":"blakepettersson","id":1227954,"node_id":"MDQ6VXNlcjEyMjc5NTQ=","avatar_url":"https://avatars1.githubusercontent.com/u/1227954?v=4","gravatar_id":"","url":"https://api.github.com/users/blakepettersson","html_url":"https://github.com/blakepettersson","followers_url":"https://api.github.com/users/blakepettersson/followers","following_url":"https://api.github.com/users/blakepettersson/following{/other_user}","gists_url":"https://api.github.com/users/blakepettersson/gists{/gist_id}","starred_url":"https://api.github.com/users/blakepettersson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blakepettersson/subscriptions","organizations_url":"https://api.github.com/users/blakepettersson/orgs","repos_url":"https://api.github.com/users/blakepettersson/repos","events_url":"https://api.github.com/users/blakepettersson/events{/privacy}","received_events_url":"https://api.github.com/users/blakepettersson/received_events","type":"User","site_admin":false},"created_at":"2018-10-28T09:36:35Z","updated_at":"2018-10-28T09:36:35Z","author_association":"NONE","body":"> _CHALLENGE_:\r\n> \r\n> The main challenge is that I cannot figure out a way to publish and re-tag an image. For example, there is no easy way to do something like this:\r\n>\r\n> It is critical that we never tag an image on the host machine, otherwise a malicious use could (in theory) submit a pull request to overwrite popular images (golang, node, etc) and inject malicious code. I have no clue how to achieve this yet ...\r\n> \r\n> I need something like this, but for docker:\r\n>\r\n> `buildah push imageID docker://registry.example.com/repository:tag`\r\n\r\nFWIW it looks like Docker 18.09 is adding support for [remote commands over SSH](https://github.com/docker/cli/pull/1014). Then it should be possible to do something like this right?\r\n\r\n```\r\ndocker tag docker://registry.example.com/ee7fd16f988c7b5156b7de9a1a8cfc10\r\ndocker push docker://registry.example.com/ee7fd16f988c7b5156b7de9a1a8cfc10\r\ndocker -H ssh://me@server tag docker://registry.example.com/ee7fd16f988c7b5156b7de9a1a8cfc10 repository:tag\r\n```\r\n"}}
{"actor":{"display_login":"blakepettersson"}}