Dockerfile does not contain reproducible build
c-nv-s opened this issue · comments
Dockerfile content does not contain instructions to build the binary but instead assumes a binary already exists in the folder and attempts to copy it.
It should instead contain steps to build the binary. Therefore using docker to pull from https://hub.docker.com/r/kailashnadh/otpgateway is pointless.
It is also very concerning for traceable builds considering that right now if you run ./otpgateway --version on the release builds it returns unknown
$ docker run --name test kailashnadh/otpgateway:latest
Unable to find image 'kailashnadh/otpgateway:latest' locally
latest: Pulling from kailashnadh/otpgatewayThe Dockerfile here is used for packaging and publishing an image (to DockerHub) via the Goreleaser build process.
CC: @mr-karan
Therefore using docker to pull from https://hub.docker.com/r/kailashnadh/otpgateway is pointless.
What is pointless about it? The docker images on Dockerhub have the same tags which are present on GitHub releases.
It is also very concerning for traceable builds considering that right now if you run ./otpgateway --version on the release builds it returns unknown
That's a separate issue. Typically make build should inject the buildString variable when doing go build but somehow that's not happening. Will take a closer look at it soon.
I am not saying it is pointless in a sense of trying to be confrontational, I mean pointless in that it will not yield the commonly expected result from a Dockerfile from a user perspective i.e.
git clone https://github.com/knadh/otpgateway
cd otpgateway
docker build . -t otpgateway:latest
that will fail because... as mentioned before... it doesn't actually build the otpgateway binary but expects an already built binary to be present.
Likewise, if you try to just pull the image from docker hub and run it, then it will fail:
docker pull kailashnadh/otpgateway && docker run -i -t -d kailashnadh/otpgateway
I might be mistaken, but I thought the main purpose of having a docker version of the app available was so you can reproduce exact working builds of the app.
The Dockerfile in the repo is specifically for Goreleaser for building+packaging+publishing to Dockerhub. Didn't have local Docker builds in mind.
Likewise, if you try to just pull the image from docker hub and run it, then it will fail:
docker pull kailashnadh/otpgateway && docker run -i -t -d kailashnadh/otpgateway
Why will it fail?
sorry I never realised it had a goreleaser dependency.
tbh that is a little misleading for most docker users
fyi it would actually be useful to have a conventional dockerfile/compose.yml for this project too