docker phase 2 notes

[Habbie]

near-term TODO

• write documentation
• automatic builds & uploads to docker hub
• write a docker hub README

TODO

• some tests
• figure out security updates (we are suddenly vendoring EVERYTHING); maybe have a docker section in secpoll? how do we make sure the user finds out?
• expose MAKEFLAGS during docker-compose build
• separate API key/webserver password/dnsdist console key
• make images land in a more sensible workdir
• a ton of useful comments in auth/rec/dnsdist: dockerise #9093
• see if debian:buster-slim makes us significantly smaller (yes, 50MB smaller for each image)
• make a separate ixfrdist image (could perhaps inherit from auth with just a changed entrypoint)

Make it easy for people to choose a nearby mirror

# Use local Ubuntu mirrors
RUN sed -i 's%http://archive.ubuntu.com/ubuntu/%mirror://mirrors.ubuntu.com/mirrors.txt%' /etc/apt/sources.list

ARG APT_URL=
ENV APT_URL ${APT_URL:-http://archive.ubuntu.com/ubuntu/}
RUN sed -i "s%http://archive.ubuntu.com/ubuntu/%${APT_URL}%" /etc/apt/sources.list
RUN ulimit -n 2000 && apt-get update && apt-get -y upgrade && apt-get -y clean

APT_URL=http://tw.archive.ubuntu.com/ubuntu/ in .env

[Habbie]

Add --disable-docs to all our configures to simplify these make invocations.

[kpfleming]

I've just begun using the builders to build packages locally, and I have caching proxies for Debian, PyPI and NPM repositories. I attempted to use APT_URL, PIP_INDEX_URL, and npm_registry_config, but they had no affect on the build process at all. If there's a desire to make these functional, I could spend some time working on this. Most likely the result would be a small script that is run at the appropriate time inside the container to create (or edit) the various configuration files which need these URLS injected into them.

[Habbie]

Yes, that would be welcome!