120 lines
No EOL
4.6 KiB
Org Mode
120 lines
No EOL
4.6 KiB
Org Mode
#+DATE: 2024-10-12
|
|
#+OPTIONS: toc:nil
|
|
#+macro: issue [[https://code.252.no/tommy/containers/issues/$1][issue #$1]]
|
|
#+macro: pr [[https://code.252.no/tommy/containers/pulls/$1][PR #$1]]
|
|
#+export_file_name: kagi
|
|
#+property: header-args:elisp :results none :exports code
|
|
|
|
#+BEGIN_EXPORT html
|
|
<div align="center">
|
|
<h1>Container Collection</h1>
|
|
<h3>Containers for Kubernetes deployment_</h3>
|
|
<img src="https://code.252.no/tommy/containers/raw/branch/main/assets/macchiato-palette.png" width="600" align="center"/>
|
|
<p></p>
|
|
<a href="https://nixos.wiki/wiki/Flakes" target="_blank">
|
|
<img alt="Nix Flakes Ready" src="https://img.shields.io/static/v1?logo=nixos&logoColor=d8dee9&label=Nix%20Flakes&labelColor=5e81ac&message=Ready&color=d8dee9&style=for-the-badge">
|
|
</a>
|
|
<p></p>
|
|
</div>
|
|
<hr/>
|
|
#+END_EXPORT
|
|
|
|
** Available Images
|
|
|
|
| Container | Version | Status | Description
|
|
|------------------------------------------------------------------------------------------+-----------+---------|------------------
|
|
| [[https://code.252.no/tommy/containers/src/branch/main/apps/lix-builder][flakes-action]] | latest | 🚧 | Image to streamline the code.252.no CI/CD workflows
|
|
| [[https://code.252.no/tommy/containers/src/branch/main/apps/kaniko][kaniko]] | v24.10.01 | 🚧 | A more secure image builder
|
|
|
|
|
|
** Container Rules
|
|
|
|
Containers in this project should be useful in Kubernetes. They will be:
|
|
|
|
- [[https://semver.org/][semantically versioned]]
|
|
- [[https://rootlesscontaine.rs/][rootless]]
|
|
- logging to stdout in JSON format if possible
|
|
- using [[https://testdriven.io/tips/59de3279-4a2d-4556-9cd0-b444249ed31e/][one process per container]]
|
|
- having no [[https://github.com/just-containers/s6-overlay][s6-overlay]]
|
|
- built on [[https://hub.docker.com/_/alpine][Alpine]]
|
|
- [[https://glossary.cncf.io/immutable-infrastructure/][immutable]]
|
|
- do no monkey business after deployed
|
|
|
|
Additionally I may in the future support:
|
|
|
|
- [[https://www.docker.com/blog/multi-arch-build-and-images-the-simple-way/][multiple architecture]]. For now containers are generated for amd64
|
|
|
|
|
|
** Tag immutability
|
|
|
|
Instead of using immutable version tags as seen on e.g. [[https://fleet.linuxserver.io/][linuxserver.io]] we
|
|
use [[https://www.letsdebug.it/post/41-calendar-versioning/][calver]] and sha256-digests.
|
|
|
|
If pinning an image to the sha256 digest, tools like [Renovate](https://github.com/renovatebot/renovate) support
|
|
updating the container on a digest or application version change.
|
|
|
|
The schema used is: =YYYY.MM.Minor@sha256:digest=. This is not as pretty, but functional and immutable. Examples:
|
|
|
|
| Container | Immutable |
|
|
|------------------------------------------------------------------------+-----------|
|
|
| =code.252.no/tommy/containers/flakes-action:v24.10.1= | ❌ |
|
|
| =code.252.no/tommy/containers/flakes-action:v24.10.1@sha256:1234...= | ✅ |
|
|
|
|
|
|
|
|
** Kubernetes Pod Security Standard
|
|
|
|
In Kubernetes we assume that you have pod-security.kubernetes.io/enforce set to
|
|
[[https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted][restricted]]. There may be
|
|
some exceptions to this if the container actually requires more privileges.
|
|
|
|
E.g. for the =flakes-action=, which runs as user ID =1000=, this means that the following settings should be
|
|
used for the pod (all containers in a pod):
|
|
|
|
#+begin_src yaml
|
|
spec:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
#+end_src
|
|
|
|
For a container this means:
|
|
|
|
#+begin_src yaml
|
|
spec:
|
|
[...]
|
|
containers:
|
|
- name: flakes-action
|
|
[...]
|
|
securityContext:
|
|
runAsUser: 1001
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
privileged: false
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
#+end_src
|
|
|
|
** Configuration volume
|
|
|
|
For applications that need to have persistent configuration data the config volume is hardcoded to `/config`
|
|
inside the container.
|
|
|
|
|
|
** Deprecations
|
|
|
|
Containers here can be **deprecated** at any point, this could be for any reason described below.
|
|
|
|
1. The upstream application is **no longer actively developed**
|
|
2. The upstream application has an **official upstream container** that follows closely to the mission statement described here
|
|
3. The upstream application has been **replaced with a better alternative**
|
|
4. The **maintenance burden** of keeping the container here **is too bothersome**
|
|
|
|
|
|
** Credits
|
|
|
|
A big thanks goes to [[https://github.com/buroa/containers/tree/master][Buroa@github]] for the inspiration to the repo structure and
|
|
concept. |