Aws-codebuild-docker-images: Can we have latest docker so that we can use multi-stage dockerfile?

[rui-ktei]

Hi, I'm a heavy AWS user who leverages the power of CodeBuild.

As per subject, I really wanna use multi-stage docker build feature:

https://docs.docker.com/engine/userguide/eng-image/multistage-build/

Is there any update possible that can let me use this feature?

Thanks a lot!

[dhilsand]

Thank you for your feedback and feature request. We've noted the request and will prioritize an updated version of Docker in the next release cycle of our curated images.

[rui-ktei]

Hi, do we habe any update on this issue? Would we be expecting a release date soon?

Thank you

[subinataws]

Thanks for your patience. This issue continues to be on our backlog. However, we don't have an ETA.

[awsnitin]

You can use a custom docker image to unblock yourself.
https://hub.docker.com/_/docker/ Use the one that has the tag 'dind' (eg. 17.06-dind)

Sample: http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker-custom-image.html

[orzarchi]

Is there any way to make use of docker's layer caching mechanism to speed up builds when using this technique?

[maxwellimpact]

I would also love to see a newer version of Docker for this exact same reason. I started an issue today and then saw this one. I'm closing mine in favor of promoting this. 👍

[maxwellimpact]

This took a few frustrating bouts, but I finally figured out how to use the latest version of Docker with CodeBuild and without having to build/maintain my own image. First do like @awsnitin said and use dind tag. In my case I'm using docker:stable-dind.

The gotcha is in both installing the awscli and getting the docker daemon running. Because AWS is taking over the entrypoint you will need to run it manually and then wait for it. Below is my pre-build step that should work fine for others.

  pre_build:
    commands:
      - dockerd-entrypoint.sh &
      - |
        until docker info >/dev/null 2>&1
        do
            sleep 1
        done
      - apk -Uuv add groff less python py-pip && pip install awscli
      - $(aws ecr get-login --no-include-email)

[rubyisbeautiful]

This is cool thanks @maxwellimpact. I created a PR before I saw this...I still can't get it to work without CodeBuild running the container with privileges.

[maxwellimpact]

@rubyisbeautiful sorry, forgot to mention that privileged mode is required for custom images that build an image with Docker (at least from what I've read in the docs). This is an option in CodeBuild, here is a snippet of the CloudFormation template for my CodeBuild project.

      Environment:
        ComputeType: "BUILD_GENERAL1_MEDIUM"
        Image: "docker:stable-dind"
        Type: "LINUX_CONTAINER"
        PrivilegedMode: true

You should be able to turn on privileged mode and have no issues, unless there is something more complicated with what/how you are building your image.

[maxwellimpact]

I re-read your comment and it sounds like you are using privileges and its working, but is there a reason you are trying to avoid it?

I ended up finding this as well, and it looks like they do something very similar except they are not using the already defined entry point that starts the daemon for the container:
http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker-custom-image.html

[rubyisbeautiful]

@maxwellimpact that's awesome, i somehow missed that actually. I was using privileged on my local environment to validate, but assumed it would never work on CodeBuild. And now I have several options...the image from the PR I pushed, or the 17.09-dind from Docker with the steps in buildspec. I hope AWS updates though. Thanks for the tip!

[subinataws]

CodeBuild now has a Docker 17 image. We have a sample that uses "aws/codebuild/docker:17.09.0" @ http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html

Marking this resolved.

[maxwellimpact]

@subinataws and team, nice work!

[kingdonb]

Where do I find the list of legal docker upstreams?

I have found aws/codebuild/docker:17.09.0 mentioned in a number of tutorials, but I've tried some revisions I thought would work in the 18.x and 19.x branches and haven't found any valid ones. I'm not sure how to list image tags in this repo. Is there a public reference?

Thanks!

[subinataws]

@kingdonb - Dockerfile for this images is at https://github.com/aws/aws-codebuild-docker-images/blob/master/ubuntu/unsupported_images/docker/17.09.0/Dockerfile. These are hosted out of CodeBuild's Amazon ECR and aren' distributed publicly.

[kingdonb]

Thank you, that's helpful, but is there a pipeline or such in place which builds later versions than aws/codebuild/docker:17.09.0? I found this reference in a couple of tutorials and assumed it was some kind of image stream or listing, but I can find no other version refs that work. I can alter the parameters of the Dockerfile which you posted and build similar such images for my own upstream, I guess, but I was trying to follow the reference architecture.

My build works fine, as long as I use this specific image ref. I thought there might be a tag list for aws/codebuild/docker but I'm not sure how to resolve this into such a list of available tags.

I want to build from the ecs reference arch but invoking docker pull -q in buildspec to improve my caching opportunities, hopefully without polluting my log with the noisy output of docker pull; but that option isn't apparently present in Docker til 19.0.x. (My work is in progress at kingdonb/ecs-refarch-continuous-deployment, so you can review it if you want. I don't have a roadmap yet, but I'm simply trying to build images with CodeBuild for FluxCD.)

I also have some other problems besides docker version, but they are not relevant to this report.

[subinataws]

We don't offer support for Docker 19.03 yet. It will be added in a future release.

Best place to track the supported runtimes in CodeBuild is: https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html.

There is also an API, which lists the supported image versions: https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListCuratedEnvironmentImages.html

Note that if you are using CodeBuild's newer images (based on Amazon Linux2 or Ubuntu 18.04) that support polyglot builds, you will need to provide a "runtime-versions" in your buildspec: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-runtime-versions.html.

If there are any more questions, please open a new issue, which would be easier to track.