Juice-shop: Multi-Arch DockerHub builds [🚀]

[bkimminich]

Following the blog post by @everflux in https://www.trion.de/news/2019/10/14/docker-multi-arch-dockerhub.html I've implemented a multi-arch Docker build process for Juice Shop. There are some unsolved issues and some missing functionality still, but I'm not sure my Docker skills are sufficient to address these.

1. :bug: The snapshot-arm64v8 tag is downloading the x64 modules for iltorb, libxml2js and sqlite3 because it seems to think it is running on an x64 architecture. This is a dealbreaker as the resulting image simply cannot work on e.g. a RasPi3 or other ARM-chip computer.
2. 💡 Currently the manifest is only configured for the snapshot builds from develop branch. If 1. gets eventually fixed, building latest from master and vX.Y.Z from Git tags would be needed. @everflux recommended to stick to one manifest file and replace the tag names e.g. via sed in the pre_build hook.

The additional hooks, Dockerfile for Arm64v8 and manifest file are available on https://github.com/bkimminich/juice-shop/tree/develop for anyone who wants to assist in this endeavor.

[J12934]

I guess the best / most stable thing to do is do run the docker builds on travis, as we actually have access to ARM CPU's there.

[bkimminich]

So, introducing a new build stage "docker" and once that works switch off the Automated Builds on DockerHub?

[bkimminich]

  - stage: docker
    if: "(branch = develop) AND NOT type = pull_request"
    install: docker build --build-arg VCS_REF=`git rev-parse --short HEAD` --build-arg
      BUILD_DATE=`date -u +”%Y-%m-%dT%H:%M:%SZ” -t bkimminich/juice-shop:snapshot-amd64
      .
    script:
    - echo "$DOCKER_ACCESS_TOKEN" | docker login -u bkimminich --password-stdin
    - docker push bkimminich/juice-shop:snapshot-amd64
    after_success:
    - curl -Lo manifest-tool https://github.com/estesp/manifest-tool/releases/download/v0.9.0/manifest-tool-linux-amd64
    - chmod +x manifest-tool
    - "./manifest-tool push from-spec multi-arch-manifest.yaml"

This attempt covers the regular Docker build plus

• injecting the Git ref/date meta data (previously done via pre_build hook)
• login to DockerHub and pushing the image
• Downloading the manifest tool and pushing it to DockerHub (previously via post_push hook)

All that currently in a separate stage (which limits it to the default matrix job (Node 14 on Amd64 Linux) and only for develop branch. Once this works, it could be extended to also run on master, tag pushes and finally on Node 14 on Arm64 matrix job.

[bkimminich]

The arm64 builds have terrible performance on Travis-CI unfortunately, so bad that it often doesn't even finish to install the Docker service before the default 10min timeout. Unfortunately I cannot influence the timeout, because this happens before any build step that I could prefix with travis_wait 30 ...

Fingers crossed for https://travis-ci.com/github/bkimminich/juice-shop/builds/170994720 to make it ...

[bkimminich]

If it keeps failing I might have to install Docker manually as a before_install step, but having to do a thing like that would kind of hurt my feelings... 😢

[J12934]

Mh thats weird.
This is just on arm, right?

Have used travis many times before to build docker images, always worked without any problems, but never on arm. Would have hoped it would just work 😕

[bkimminich]

On amd64 the entire build takes 10min, which makes it even a lot faster than it was on DockerHub... Only arm64 is causing trouble. I switched to manually installing Docker and try to increase the timeout for the long running steps on ARM now...

[bkimminich]

Hell, this is frustrating... while most builds just timed out before even doing _anything_ this one at least got the server-side built successfully and then timed out before/while doing the Angular compile step... 😭 ... https://travis-ci.com/github/bkimminich/juice-shop/jobs/348091021

[J12934]

Hell, this is frustrating... while most builds just timed out before even doing _anything_ this one at least got the server-side built successfully and then timed out before/while doing the Angular compile step... 😭 ... https://travis-ci.com/github/bkimminich/juice-shop/jobs/348091021

I've previously had problems with the angular build on my raspberry.
I think the problem is the --max-old-space-size=8192 in https://github.com/bkimminich/juice-shop/blob/master/package.json#L55

This seems to tries to allocate 8gigs of ram. When i removed this flag the build worked flawlessly on my raspberry. Might be a similar problem here.

[bkimminich]

I removed the RAM allocation completely from the build script in package.json, but the job still times out... I'm giving it one more try with travis_wait but then I'm out of ideas.

[bkimminich]

I'm officially out of ideas... ❌

[bkimminich]

But: Amd64 builds work like a charm, though, so even for that it might be worth switching away from DockerHub auto-builds.

[bkimminich]