Pomerium: deployment: add multi-arch docker support

[deltabweb]

Follow-up of #125
I've been using a workaround until now as I didn't have time to open this issue (+needed to gather more information to make it useful)

Describe the bug
If I try to start the docker container on my arm64 SBC using docker swarm, I get this error:
no suitable node (unsupported platform on 1 node)

To Reproduce

1. Install portainer on arm64 board
2. Create a stack with pomerium/pomerium:latest or pomerium/pomerium:arm64v8-latest as one of the services
3. The service doesn't start and the error message is displayed

I'm almost sure the result will be the same if doing it with docker swarm CLI

Expected behavior

Container starts

Environment

• Pomerium version (retrieve with pomerium --version):
  v0.2.1

• Server Operating System/Architecture/Cloud:
  Debian 9 + Docker on Odroid N2

Additional context

I've made some tests with vanilla docker and found out the following:

1. docker run pomerium/pomerium:latest exits with standard_init_linux.go:211: exec user process caused "exec format error" ==> means that the wrong image was fetched (probably amd64 instead of arm64v8)
2. docker run pomerium/pomerium:arm64v8-latest exits with {"level":"info","version":"v0.2.1+47f7a44","time":"2019-08-15T06:04:00Z","message":"cmd/pomerium"} {"level":"fatal","error":"authenticate: missing setting: authenticate-service-url","time":"2019-08-15T06:04:00Z","message":"cmd/pomerium: authenticate"} ==> means that vanilla docker (unlike docker swarm) is able to run the image if we force the architecture with the tag

The workaround I am using is simply to create a tag docker tag pomerium/pomerium:arm64v8-latest pomerium:aarch64-latest and then use this tag in my service stack. I reckon this prevents portainer / docker swarm from verifying the architecture of the image because it's a local image.

I've also found this article which talks about multiple architectures with docker and more specifically docker manifest
https://dev.to/toolboc/publish-multi-arch-docker-images-to-a-single-repo-with-docker-manifests-329n
I am thinking that my problem could be coming from the architecture not being set properly in the manifest or something like that - don't take my word for it though as I'm not an expert in this, I'm just a simple docker user :)

[desimone]

Thanks for following up about this @deltabweb .

I would _love_ to support multiple architectures with docker in line with the link you provided but when I last looked at using the (still experimental?) manifest tool I wan't able to get things working. And I would especially love to have this hook into our existing build process, maybe using something like travis/docker?

Unfortunately, I likely won't have time to work on this in the near term, would this be something you'd be interested in implementing @deltabweb

See also:

• https://github.com/goreleaser/goreleaser/issues/530
• https://github.com/zeerorg/BlogPosts/blob/ab9f89d89d0f055a4e767a87f50954b2ab36770f/src/MultiArchDockerTravis.md
• https://github.com/pomerium/pomerium/pull/102
• https://github.com/pomerium/pomerium/pull/95

[deltabweb]

Hi @desimone , thanks for the answer.
Unfortunately, I don't have time to implement it either.

I guess we can just leave this issue open until someone can take care of it? It's a minor problem and probably doesn't affect many users.

[travisgroth]

Hi @deltabweb

It looks like two different items here:

1. the arm images have the wrong arch.

2. we aren't publishing a multi-arch manifest.

(1) is a definite problem and (2) is a nice to have, but I believe it needs the first fixed.

Could you test using the image pomerium/pomerium:arm64v8-test and see if it behaves as expected WRT architecture? This is a manual build, so please don't use beyond testing for the moment.

[travisgroth]

@deltabweb FYI, we've changed the build automation and should start spitting out proper images going forward. There is also now an arm64 master that will keep up with the git master build.

Once we've verified the full release pipeline, we'll move to a multi-arch manifest.

Thanks again for reporting!

[deltabweb]

@travisgroth Awesome, thanks for working on that!
Sorry that I haven't had time to test the other image, I'll try to run the latest build as soon as I can and report back.

[desimone]

Closing as multi-arch support is going to be constrained by envoy arch support.

[stuartpb]

Shouldn't this be re-opened? As of 1.16.0 (released October 8), Envoy ships multiarch compatible images.

[desimone]

@stuartpb maybe!

[desimone]

GoReleaser v0.148.0 is out, and with it, the ability to release multi-platform Docker images, a.k.a. Docker Manifests. This should make cross platform builds much easier.

• https://github.com/goreleaser/goreleaser/pull/1923
• https://carlosbecker.com/posts/multi-platform-docker-images-goreleaser-gh-actions/