opendev/system-config
Code Issues Proposed changes
07d453d4e6
system-config/docker/gerrit/base/Dockerfile

81 lines
2.7 KiB
Docker
Raw Normal View History

Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
# Copyright (c) 2019 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied.
# See the License for the specific language governing permissions and
# limitations under the License.
Update Gerrit 3.7 to 3.7.2 This is mostly a bookkeeping update, but it reflects that upstream made a release to fix the related changes issue. https://www.gerritcodereview.com/3.7.html#372 Change-Id: Iecbda339d0af4cc625df7be3925010ce643808bd
2023-03-27 08:13:33 -07:00
# Mon Mar 27 15:13:11 UTC 2023 - trigger rebuild
Trigger promote for gerrit 3.3 image Ib7e7d7313e0827a40009df840119444611d74ca2 did not match the promote job file filter, so the image wasn't promoted. Bump to create a new image build. Change-Id: I31e8368ec309e62a9cf3607acfd5157aa5b6c61e
2021-02-12 08:58:18 +11:00
Build our gerrit images on Bullseye This is a bit of spring cleaning. Previously we based on images on Buster but Bullseye exists now so give it a go. Change-Id: Icc3d79b361e41df2f2f063993fd206ab7d992f75
2021-09-15 13:45:31 -07:00
FROM docker.io/opendevorg/python-builder:3.9-bullseye as builder
Install jeepyb into the gerrit images We need jeepyb installed because the content of the gerrit hook scripts we install is done via jeepyb commands. Use python-builder so that we can just install the jeepyb wheel. Should we maybe transition these hooks into being zuul jobs? Depends-On: https://review.opendev.org/683146/ Change-Id: I8899885b05d1e9f48b3f354ca22b360b54d455a3
2019-09-17 12:18:02 +02:00
COPY . /tmp/src
RUN assemble
Build Gerrit on top of our python-base images This is done for a number of reasons. First it will allow us to update the python version used in the images as we can have a 3.10 builder and base images (but not a 3.10 openjdk:11 image). Second it will allow us to easily switch to openjdk 17 by simply updating the package we install and some paths for the jdk location. The goal here is to have more control over the images so that we can do things like change python and java versions when we want to. Depends-On: https://review.opendev.org/c/opendev/jeepyb/+/870873 Change-Id: I7ea2658caf71336d582c01be17a91759e9ac2043
2023-01-17 15:24:40 -08:00
FROM docker.io/opendevorg/python-base:3.9-bullseye as gerrit-base
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
Disable recommends in python-base and python-builder We disable these on our VM images, so might as well make our container images follow suit. Could make them a smidge smaller. Also do it in the gerrit-base image. Change-Id: Iba60cf5c7009d57c4910f9e4464aff9231598ad6
2020-02-26 16:10:58 -06:00
RUN echo 'APT::Install-Recommends "0";' > /etc/apt/apt.conf.d/95disable-recommends
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
RUN apt-get update \
Switch gerrit container from jre to jdk packages The debian openjdk-11-jre-headless package lacks tools like jcmd which can be useful for debugging the jvm and applications running on top of the jvm. In particular I had to use `kill -3 $JVM_PID` to get a thread dump (which worked) instead of jcmd during a recent Gerrit outage. Since you don't know that you'll need these tools until its too late go ahead and switch to the jdk package instead of the jre package to be prepared in the future. Change-Id: I09a81f1abc6e528b4ffd624050698a99c264f499
2023-02-27 12:56:03 -08:00
&& apt-get install -y dumb-init git openssh-client openjdk-11-jdk-headless unzip \
Build Gerrit on top of our python-base images This is done for a number of reasons. First it will allow us to update the python version used in the images as we can have a 3.10 builder and base images (but not a 3.10 openjdk:11 image). Second it will allow us to easily switch to openjdk 17 by simply updating the package we install and some paths for the jdk location. The goal here is to have more control over the images so that we can do things like change python and java versions when we want to. Depends-On: https://review.opendev.org/c/opendev/jeepyb/+/870873 Change-Id: I7ea2658caf71336d582c01be17a91759e9ac2043
2023-01-17 15:24:40 -08:00
# This next set of installs helps align us with the old openjdk image \
# but they may not all be necessary \
&& apt-get install -y xz-utils bzip2 wget curl gnupg \
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
&& apt-get clean \
Build Gerrit on top of our python-base images This is done for a number of reasons. First it will allow us to update the python version used in the images as we can have a 3.10 builder and base images (but not a 3.10 openjdk:11 image). Second it will allow us to easily switch to openjdk 17 by simply updating the package we install and some paths for the jdk location. The goal here is to have more control over the images so that we can do things like change python and java versions when we want to. Depends-On: https://review.opendev.org/c/opendev/jeepyb/+/870873 Change-Id: I7ea2658caf71336d582c01be17a91759e9ac2043
2023-01-17 15:24:40 -08:00
&& rm -rf /var/lib/apt/lists/*
Install jeepyb into the gerrit images We need jeepyb installed because the content of the gerrit hook scripts we install is done via jeepyb commands. Use python-builder so that we can just install the jeepyb wheel. Should we maybe transition these hooks into being zuul jobs? Depends-On: https://review.opendev.org/683146/ Change-Id: I8899885b05d1e9f48b3f354ca22b360b54d455a3
2019-09-17 12:18:02 +02:00
COPY --from=builder /output/ /output
RUN /output/install-from-bindep
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
Fix files matcher and bazel for gerrit base image Use latest bazel It seems 0.27 is now too old. This is what happens when I go on vacation apparently. Add in a hack to override the bazelversion. We'll remove this once https://gerrit-review.googlesource.com/c/gerrit/+/237495 lands and has been merged up. Change-Id: Ib7a6d33ce8bf8498fd5cd09b25087dc09acb8df4
2019-09-16 20:23:22 +02:00
# 3000 is what the existing opendev gerrit2 uid is
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
RUN addgroup gerrit --gid 3000 --system \
&& adduser \
--system \
--uid 3000 \
--home /var/gerrit \
--shell /bin/bash \
--ingroup gerrit \
gerrit
gerrit: add mariadb_container option This adds a local mariadb container to the gerrit host to hold the accountPatchReviewDb database. This is inspired by a few things - since migration to NoteDB, there is only one table left where Gerrit records what files have been reviewed for a change. This logically scales with the number of reviews users are doing. Pulling the stats on this, we can see since the NoteDB upgrade this went from a very busy database (~300 queries/70 commits per second) to barely registering one hit per second : https://imgur.com/a/QGJV7Fw Thus separating the db to an external host for performance reasons is not a large concern any more. - emperically we've done a bad job in keeping the existing hosted db up-to-date; it's still running mysql 5.1 and we have been hit by bugs such as the one referenced in-line which silently drops backups. - The other gerrit option is to use an on-disk H2 database. This is certainly an option, however you need special tools to interact with it for migration, etc. and it's not safe to backup from files on disk (as opposed to mysqldump). Upstream advice is unclear, and varies between H2 being a performance bottleneck to this being ephemeral data that users don't care about. We know how to admin mariadb/mysql and this allows us to migrate and backup data, so seems like the best choice. - we have a pressing need to update the server to a new operating system. Running the db alongside the gerrit instance minimises fiddling we have to do manging connections to and migrating the hosted db systems. - related to that, we are tending towards more provider independence for control-plane servers. A hosted database product is not always provided, so this gives us more flexibility in moving things around. - the main concern here is memory usage. "docker stats" reports a quiescent container, freshly started on a 8GB host: gerrit-compose_mariadb_1 67.32MiB After loading a copy of the production table, and then dumping it back to a file the same container reports: gerrit-compose_mariadb_1 462.6MiB The existing remote mysql configuration path remains mostly the same. We move the gerrit startup into a script rather than a CMD so we can call it after a "wait for db" script in the mariadb_container case (this is the reccommeded way to enforce ordering [1]). Backups of the local container need different dump commands; backups are relocated to a new file and updated. Testing is converted to use this rather than a local H2 database. [1] https://docs.docker.com/compose/startup-order/ Change-Id: Iec981ef3c2e38889f91e9759e66295dbfb499c2e
2021-02-17 15:23:19 +11:00
# Startup scripts
COPY wait-for-it.sh /wait-for-it.sh
RUN chmod +x /wait-for-it.sh
COPY run-gerrit.sh /run-gerrit.sh
RUN chmod +x /run-gerrit.sh
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
USER gerrit
Expose volume for tmp dir, add dirs for hooks and static Our existing config management puts files into hooks and static. We can bind mount those in, but having the mount-points in the image is useful. The tmp dir is important for gerrit to be able to write plugin expansions and javaamelody data. Change-Id: Idd917c268ed7bdead412620dfe3ca842736b7463
2019-08-27 13:19:18 +02:00
RUN mkdir /var/gerrit/bin \
&& mkdir /var/gerrit/hooks \
&& mkdir /var/gerrit/static
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
Remove the mysql support from our gerrit role and image We are now using the mariadb jdbc connector in production and no longer need to include the mysql legacy connector in our images. We also don't need support for h2 or mysql as testing and prod are all using the mariadb connector and local database. Note this is a separate change to ensure everything is happy with the mariadb connector before we remove the fallback mysql connector from our images. Change-Id: I982d3c3c026a5351bff567ce7fbb32798718ec1b
2021-08-03 09:09:41 -07:00
# Download mariadb java client.
# Modern gerrit stopped downloading missing libs during init which means we
# need to do the downland and install ourselves.
Use add instead of wget to download things for gerrit images The jitsi image showed you can ADD a url. Instead of installing wget into the images and wgetting in a shell, use ADD. Presumably this will help docker cache things better? Change-Id: I7bc92952804c1257fc6569e3847d898ab2385eeb
2022-03-16 10:49:49 -07:00
# Note the perms on this are 0600 hence the need for the chown otherwise
# they are root owned and Gerrit can't use the jdbc driver.
ADD --chown=gerrit:gerrit https://repo1.maven.org/maven2/org/mariadb/jdbc/mariadb-java-client/2.7.2/mariadb-java-client-2.7.2.jar /var/gerrit/lib/mariadb-java-client.jar
Base 2.13 image on gerrit-base We install jeepyb and launchpadlib in gerrit-base. Those are important. We also need to add cgi for gitweb. The gerrit init command does two things that we don't actually want it to do at runtime. It extracts the plugins into the plugins dir, and it downloads the right database library. We can extract the plugins for it during image creation, and then we can also download the plugin it would have downloaded. We can also download the mysql library for it: https://gerrit.googlesource.com/gerrit/+/refs/heads/stable-2.13/gerrit-pgm/src/main/resources/com/google/gerrit/pgm/init/libraries.config Finally, we tell it to not download or expand anything during init, because we're running in a container and next time we run the process that dir isn't going to be there. Our gerrit integration tests don't depend on our gerrit image builds. Put in image depends between run-review and gerrit builds. We also need to depend directly on opendev-buildset-registry. Add java.security.egd setting to java invocation This tells java to be secure. https://stackoverflow.com/questions/58991966/what-java-security-egd-option-is-for Add support for setting heap limit properly The gerrit init script does this based on the value in container.javaOptions. We could, but then we'd have to run an entrypoint script. Instead, set the value via the JAVA_OPTIONS env var setting based on a value from ansible. Finally, make gerrit-master image build non-voting It looks like there might be a real issue, but debugging that is not important for us at this moment. Depends-On: https://review.opendev.org/714216 Change-Id: I01e94c10f470fb3c8ddfce7b0e201357e5050679
2020-03-20 09:41:23 -05:00
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
# Allow incoming traffic
Gerrit image cleanups/fixes We name the base image we build gerrit-base and we expose port 8081 not 8080 as opendev's gerrit listens on 8081. Also explicitly build the javamelody plugin deps jar and copy it into the review_site/lib dir on Gerrit 2 bazel builds. This is necessary according to javamelody plugin build docs. In order to split Gerrit 2.x and 3.x behavior in the Bazel builds we convert our Dockerfile into a multi stage build. All this ended up down a thread pull where the script in the Dockerfile dir called build-gerrit.sh isn't actually used to build gerrit :/ clarify that. The script may be useful for local builds so we haven't removed it yet. Finally update gerrit plugin checkouts to tags or master as appropriate where stable branches don't exist for the specified version. Change-Id: I155a20685b3462e965c4216d134b3b36978fbcc7
2020-08-10 15:01:08 -07:00
# OpenDev Gerrit listens on 8081 not default of 8080
EXPOSE 29418 8081
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
Bind mount Gerrit's review_site/data dir The replication, manage-plugins, and delete-project plugins all seem to want to write content out to /var/gerrit/data within the Gerrit container. At /home/gerrit2/review_site/data we've got an old carried over dir from previous installations but this does not appear to be bind mounted. Best I can tell the replication plugin may use this disk location to keep track of tasks that are queued,running,etc and this may work around the issues with autoreloading gerrit replication configs. However, we don't get those benefits when we delete the container (as with docker-compose down/up-d) as the content is ephemeral within the container. Address this by bind mounting the location along with the other bind mounts. Note I have excluded this from backups as I think we don't need backups of things like replication queues. That said depending on what the other plugins use this for we may need to refine our backup rules in the future. Change-Id: If3a91aeb1bd86c8514179b8ecfde17e98c29af6a
2023-02-27 13:14:34 -08:00
VOLUME /var/gerrit/git /var/gerrit/index /var/gerrit/cache /var/gerrit/db /var/gerrit/etc /var/log/gerrit /var/gerrit/tmp /var/gerrit/data
Split out bazel builder and gerrit base image There is a bunch of duplication which needs to be redone almost never. Split those into their own images so we can run them once and reuse them. Change-Id: I923d4bff96dae75eb52a1c271fa52d5ae79933a0
2019-07-27 11:12:46 -04:00
RUN ln -s /var/log/gerrit /var/gerrit/logs
# container.javaOptions
# Also include container.heapLimit - but with -Xmx prefixing it
ENV JAVA_OPTIONS ""
# Ulimits should be set on command line or in docker-compose.yaml
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
gerrit: add mariadb_container option This adds a local mariadb container to the gerrit host to hold the accountPatchReviewDb database. This is inspired by a few things - since migration to NoteDB, there is only one table left where Gerrit records what files have been reviewed for a change. This logically scales with the number of reviews users are doing. Pulling the stats on this, we can see since the NoteDB upgrade this went from a very busy database (~300 queries/70 commits per second) to barely registering one hit per second : https://imgur.com/a/QGJV7Fw Thus separating the db to an external host for performance reasons is not a large concern any more. - emperically we've done a bad job in keeping the existing hosted db up-to-date; it's still running mysql 5.1 and we have been hit by bugs such as the one referenced in-line which silently drops backups. - The other gerrit option is to use an on-disk H2 database. This is certainly an option, however you need special tools to interact with it for migration, etc. and it's not safe to backup from files on disk (as opposed to mysqldump). Upstream advice is unclear, and varies between H2 being a performance bottleneck to this being ephemeral data that users don't care about. We know how to admin mariadb/mysql and this allows us to migrate and backup data, so seems like the best choice. - we have a pressing need to update the server to a new operating system. Running the db alongside the gerrit instance minimises fiddling we have to do manging connections to and migrating the hosted db systems. - related to that, we are tending towards more provider independence for control-plane servers. A hosted database product is not always provided, so this gives us more flexibility in moving things around. - the main concern here is memory usage. "docker stats" reports a quiescent container, freshly started on a 8GB host: gerrit-compose_mariadb_1 67.32MiB After loading a copy of the production table, and then dumping it back to a file the same container reports: gerrit-compose_mariadb_1 462.6MiB The existing remote mysql configuration path remains mostly the same. We move the gerrit startup into a script rather than a CMD so we can call it after a "wait for db" script in the mariadb_container case (this is the reccommeded way to enforce ordering [1]). Backups of the local container need different dump commands; backups are relocated to a new file and updated. Testing is converted to use this rather than a local H2 database. [1] https://docs.docker.com/compose/startup-order/ Change-Id: Iec981ef3c2e38889f91e9759e66295dbfb499c2e
2021-02-17 15:23:19 +11:00
CMD "/run-gerrit.sh"
Copy Permalink