Best Practices In Implementing Container Image Promotion Pipelines
•
0 likes•48 views
Presented by: Baruch Sadogursky, JFrog Presented at All Things Open 2020 Abstract: Surprisingly, implementing a secure, robust and fast promotion pipelines for container images is not as easy as it might sound. Automating dependency resolution (base images), implementing multiple registries for different maturity stages and making sure that we actually run in production containers from the images we intended can be tricky. In this talk, we will compare different approaches, compile a wish-list of features and create a pipeline that checks all the boxes using free and open-source tools.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Best Practices In Implementing Container Image Promotion Pipelines
Similar to Best Practices In Implementing Container Image Promotion Pipelines (20)
More from All Things Open
More from All Things Open (20)
Recently uploaded
Recently uploaded (20)
Best Practices In Implementing Container Image Promotion Pipelines
- 1. Best Practices In Implementing Container Image Promotion Pipelines
- 3. Software I like Software I know really well @jbaruch #ATO http://jfrog.com/shownotes
- 6. shownotes Øhttp://jfrog.com/shownotes ØSlides ØVideo ØLinks ØComments, Ratings ØRaffle @jbaruch #ATO http://jfrog.com/shownotes
- 9. Copyright @ 2020 JFrog - All rights reserved. The Promotion Pyramid Development builds Dev Integration tests Integr. tests Staging Pre-Prod Prod Amount of builds Build/Deploytime Amount of binaries @jbaruch #ATO http://jfrog.com/shownotes
- 10. Pipeline: quality gates and visibility CI SERVER Integration System Testing If quality requirments are hit If quality requirments are hit If quality requirments are hit Staging - Quality gates - Production 1 2 3 4 * @jbaruch #ATO http://jfrog.com/shownotes
- 11. $docker build @jbaruch #ATO http://jfrog.com/shownotes
- 13. Let’s docker build in every env! @jbaruch #ATO http://jfrog.com/shownotes
- 15. That’s why. FROM ubuntu RUN apt-get install -y software-properties-common python RUN apt-get install -y nodejs RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"] Latest version Latest version Latest version Latest version @jbaruch #ATO http://jfrog.com/shownotes
- 16. That’s why. FROM ubuntu:19.04 RUN apt-get install -y software-properties-common python RUN apt-get install -y nodejs RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"] Better now? @jbaruch #ATO http://jfrog.com/shownotes
- 17. That’s why. FROM ubuntu:4033353383af19ec179c01dda7f355a246c6adcafaf93c8f98 RUN apt-get install -y software-properties-common python RUN apt-get install -y nodejs RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"] And now? @jbaruch #ATO http://jfrog.com/shownotes
- 18. That’s why. FROM ubuntu:4033353383af19ec179c01dda7f355a246c6adcafaf93c8f98 RUN apt-get install -y software-properties-common python RUN apt-get install -y nodejs RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"] What about those? @jbaruch #ATO http://jfrog.com/shownotes
- 19. That’s why. FROM ubuntu:4033353383af19ec179c01dda7f355a246c6adcafaf93c8f98 RUN mvn clean install CMD ”java –jar Main.class" What about this? @jbaruch #ATO http://jfrog.com/shownotes
- 20. That’s why. FROM ubuntu:4033353383af19ec179c01dda7f355a246c6adcafaf93c8f98 RUN download_random_sh*t_from_the_internet.sh CMD ["/usr/bin/node", "/var/www/app.js"] And how about this? @jbaruch #ATO http://jfrog.com/shownotes
- 21. That’s why you don’t trust Docker @jbaruch #ATO http://jfrog.com/shownotes
- 24. What’s up with the gates?! - QA shouldn’t test dev images - non-tested images shouldn't be staged - non-staged, non-tested or dev images shouldn’t end up in production!!! @jbaruch #ATO http://jfrog.com/shownotes
- 25. Let’s build Rock-solid pipeline!
- 26. How do I separate dev from prod?! @jbaruch #ATO http://jfrog.com/shownotes
- 27. Option 1: metadata tags @jbaruch #ATO http://jfrog.com/shownotes
- 29. Option 2: Docker Repositories
- 31. Separate registries per environment CI SERVER Integration System Testing If quality requirments are hit If quality requirments are hit If quality requirments are hit Staging - Quality gates - Production 1 2 3 4 * @jbaruch #ATO http://jfrog.com/shownotes
- 33. Trumped-up limitations @jbaruch #ATO http://jfrog.com/shownotes
- 34. The Anatomy of Docker Tag @jbaruch #ATO http://jfrog.com/shownotes
- 35. Wait a second, how can I have more than one registry per host now?! @jbaruch #ATO http://jfrog.com/shownotes
- 36. How can we support this? https://host:8081/registry/docker-dev/busybox https://host:8081/registry/docker-staging/busybox https://host:8081/registry/docker-qa/busybox https://host:8081/registry/docker-prod/busybox @jbaruch #ATO http://jfrog.com/shownotes
- 37. “ONE REGISTRY PER HOST OUGHT TO BE ENOUGH FOR ANYBODY.”
- 39. Virtual hosts/ports to the rescue Registry host Tag name docker tag host:port/busybox @jbaruch #ATO http://jfrog.com/shownotes
- 40. Virtual hosts/ports to the rescue https://host:port/v2/busybox Registry host Tag name docker tag host:port/busybox @jbaruch #ATO http://jfrog.com/shownotes
- 41. Virtual hosts/ports to the rescue https://host:port/v2/busybox Registry host Tag name docker tag host:port/busybox https://host:8081/registry/docker-dev/busybox Registry name Tag nameContext name
- 42. server { listen 5001; server_name 192.168.99.100; if ($http_x_forwarded_proto = '') { set $http_x_forwarded_proto $scheme; } rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/docker-dev/$1/$2; … } } @jbaruch #ATO http://jfrog.com/shownotes
- 44. Let’s abuse things! @jbaruch #ATO http://jfrog.com/shownotes
- 45. Let’s abuse things! @jbaruch #ATO http://jfrog.com/shownotes
- 46. But then you realize… Wait a second, now I need to pull, retag and push for every step?! @jbaruch #ATO http://jfrog.com/shownotes
- 48. dev cluster prod cluster staging cluster test cluster @jbaruch #ATO http://jfrog.com/shownotes
- 49. Win-win-win - Single point of access to multiple registries when needed - Completely isolated environments - Immediate and free promotions
- 50. But what about the rest of the dependencies?
- 55. Own your dependencies - Your base image - Your infra - Your application files @jbaruch #ATO http://jfrog.com/shownotes
- 56. Isn’t it a shame? FROM ubuntu RUN apt-get install -y software-properties-common python RUN apt-get install -y nodejs RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"] Latest version – BAD! @jbaruch #ATO http://jfrog.com/shownotes
- 57. Static Tagging vs Dynamic tagging ØAssigned once, remains unchanged ØReproducible builds ØLatest good state image ØEasy to use ØBut what version is it?! @jbaruch #ATO http://jfrog.com/shownotes
- 58. Copyright @ 2020 JFrog - All rights reserved. Double Tagging FTW @jbaruch #ATO http://jfrog.com/shownotes
- 60. conclusions - Build only once - Separate environments - Promote what you’ve built - Own your dependencies @jbaruch #ATO http://jfrog.com/shownotes