Deuxfleurs/garage
34
65
Fork 83
Code Issues 95 Pull requests 16 Releases 32 Wiki Activity

Upgrade CI pipeline, fix static builds #345

Merged
lx merged 7 commits from ci/bump-nix-img into main 2022-07-29 10:23:52 +00:00
Conversation 0 Commits 7 Files changed 7 +397 -461
quentin commented 2022-07-26 16:26:34 +00:00
Owner
Copy link

Changelog:

  • Add a check when a release binary is built to ensure it is static
  • Fix building logic of linux/arm and linux/arm64 that were wrongly built as dynamic
  • Upgrade building containers to nix 22.05
  • [X] Change runner requirements, we don't need specific runners anymore for Nix (you can drop the Nix tag, the volume mount and do not need to perform manual warmup anymore)
  • Make default.nix easier and more idiomatic to use. For example, you can build a release binary with nix-build -A pkgs.amd64.release now. This is closer to how Nix Flakes work.
  • Integrate Clippy in nix-build (nix-build -A clippy.amd64). It has 2 benefits compared to running clippy from a nix shell: 1. it leverages Nix caching 2. it builds a working binary that can be directly used in test-smoke.sh.
  • Use a patched version of cargo2nix that fixes this bug: https://github.com/cargo2nix/cargo2nix/issues/238 - When we have a complex project + a crate (eg. openssl) that has some "propagated build inputs", cargo2nix tends to duplicate similar values. In the end, the openssl propagated build inputs was repeated thousand of times. My patch to fix the bug: 486675c672. Later, I plan to bump cargo2nix on Garage, port this patch, and at the same time open a PR to upstream it.
  • Introduce a new type of Nix runner named nix-daemon. They have many benefits over the prior builder:
    • A nix maintenance step is not needed anymore in Drone
    • Mounting volumes on each step is not needed anymore, volumes are directly injected by the runner in each step. Theoretically, it could work even on non trusted builds (this is a Drone config parameter on some repo, required to mount host volumes for example).
    • Concurrent builds are correctly supported, even across different projects
    • nix-build are now sandboxed, so builds are even more reproducible
    • (bonus) the nix-daemon can be configured to distribute a single build on many other runners thanks to distributed builds
    • (bonus) currently, the runner can directly write in the nix store which breaks isolation. But the docker daemon can be configured to prevent this. Also, the drone-docker-runner can be patched to support mounting as read only /nix/store. One of this change would make our nix operations 100% sandboxed and isolated from one another.

Instructions to setup a new runner can be found here: https://git.deuxfleurs.fr/Deuxfleurs/infrastructure/src/branch/main/app/drone-ci/integration#install-the-runner

Changelog: - [X] Add a check when a release binary is built to ensure it is static - [X] Fix building logic of linux/arm and linux/arm64 that were wrongly built as dynamic - [X] Upgrade building containers to nix 22.05 - <del>[X] Change runner requirements, we don't need specific runners anymore for Nix (you can drop the Nix tag, the volume mount and do not need to perform manual warmup anymore)</del> - [X] Make default.nix easier and more idiomatic to use. For example, you can build a release binary with `nix-build -A pkgs.amd64.release` now. This is closer to how Nix Flakes work. - [X] Integrate Clippy in `nix-build` (`nix-build -A clippy.amd64`). It has 2 benefits compared to running clippy from a nix shell: 1. it leverages Nix caching 2. it builds a working binary that can be directly used in `test-smoke.sh`. - [X] Use a patched version of `cargo2nix` that fixes this bug: https://github.com/cargo2nix/cargo2nix/issues/238 - When we have a complex project + a crate (eg. openssl) that has some "propagated build inputs", cargo2nix tends to duplicate similar values. In the end, the openssl propagated build inputs was repeated thousand of times. My patch to fix the bug: https://github.com/superboum/cargo2nix/commit/486675c67249e735dd7eb68e1b9feac9db102be7. Later, I plan to bump cargo2nix on Garage, port this patch, and at the same time open a PR to upstream it. - [X] Introduce a new type of Nix runner named `nix-daemon`. They have many benefits over the prior builder: - A `nix maintenance` step is not needed anymore in Drone - Mounting volumes on each step is not needed anymore, volumes are directly injected by the runner in each step. Theoretically, it could work even on non trusted builds (this is a Drone config parameter on some repo, required to mount host volumes for example). - Concurrent builds are correctly supported, even across different projects - `nix-build` are now sandboxed, so builds are even more reproducible - (bonus) the nix-daemon can be configured to distribute a single build on many other runners thanks to [distributed builds](https://nixos.wiki/wiki/Distributed_build) - (bonus) currently, the runner can directly write in the nix store which breaks isolation. But the docker daemon can be configured to prevent this. Also, the drone-docker-runner can be patched to support mounting as read only `/nix/store`. One of this change would make our nix operations 100% sandboxed and isolated from one another. Instructions to setup a new runner can be found here: https://git.deuxfleurs.fr/Deuxfleurs/infrastructure/src/branch/main/app/drone-ci/integration#install-the-runner
quentin force-pushed ci/bump-nix-img from 684019c7fa to fcb04843f7 2022-07-26 16:27:58 +00:00 Compare
lx reviewed 2022-07-28 08:35:40 +00:00
.drone.yml Outdated
@ -26,3 +26,2 @@
commands:
- cp nix/nix.conf /etc/nix/nix.conf
- nix-build --no-build-output --no-out-link shell.nix --arg release false -A inputDerivation
- "[ -d /mnt/store/3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1/ ] || (mkdir -p /mnt/store && cp -r /nix/store/* /mnt/store/)"
lx commented 2022-07-28 08:23:23 +00:00
Owner
Copy link

What if the image nixos-22.05 is updated and the hash 3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1 changes? We don't want to copy files uselessly every time. Could we find another solution to detect whether the copy needs to be made? For instance we could have a custom file name and just touch it after copying files.

What if the image `nixos-22.05` is updated and the hash `3vpyn2qz5ay057nq9x68sh0r328d77ng-nix-2.8.1` changes? We don't want to copy files uselessly every time. Could we find another solution to detect whether the copy needs to be made? For instance we could have a custom file name and just `touch` it after copying files.
lx commented 2022-07-28 08:48:45 +00:00
Owner
Copy link

OR: freeze the docker image using a hash and not a tag

OR: freeze the docker image using a hash and not a tag
quentin commented 2022-07-29 06:48:17 +00:00
Author
Owner
Copy link

Solved by changing how we handle Nix runners

Solved by changing how we handle Nix runners
quentin force-pushed ci/bump-nix-img from 1b79852e64 to a20a55efa9 2022-07-28 10:13:30 +00:00 Compare
quentin changed title from Upgrade CI pipeline, fix static builds to WIP: Upgrade CI pipeline, fix static builds 2022-07-28 10:31:53 +00:00
quentin force-pushed ci/bump-nix-img from 19cd8ae752 to 3ef9b3a650 2022-07-29 06:36:17 +00:00 Compare
quentin force-pushed ci/bump-nix-img from 3ef9b3a650 to a184f0d0b5 2022-07-29 06:37:46 +00:00 Compare
quentin changed title from WIP: Upgrade CI pipeline, fix static builds to Upgrade CI pipeline, fix static builds 2022-07-29 06:46:52 +00:00
lx merged commit a184f0d0b5 into main 2022-07-29 10:23:52 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
action
check-aws
The behaviour should be checked against AWS S3

  
action
discussion-needed
We need to discuss if the feature is desirable and/or better specify the envisioned behavior or technical implementation

  
action
for-external-contributors
Core team does not plan working on this in the near future however an external contribution will be reviewed & merged

  
action
for-newcomers
An issue that should be newcomer friendly.

  
action
more-info-needed
More information is needed to investigate this issue

  
action
need-funding
This issue represents lots of work, we need to find money to pay our core team work

  
action
triage-required
It's not very clear what we want to do with this issue yet, more thoughts is required

  
kind
correctness
Issues of theoretical correctness that may impact edge-case scenarios

  
kind/experimental

PRs implementing experimental features / features used only for debugging

  
kind
ideas
For abstract ideas/proposal to make Garage better, to better communicate our not yet achieved aims

  
kind
improvement
Feature requests that do not fall in other categories

  
kind
performance
Deceptive performance observed OR idea to improve performances

  
kind
testing
Functional tests, integration tests, Jepsen, etc.

  
kind
usability
Propositions to make Garage easier to operate, by improving error reporting, CLI, etc.

  
kind
wrong-behavior
Unintended behavior

  
prio
critical
Could impact integrity or availability of production clusters

  
prio
low
For issues that we don't want to spend time on until made absolutely necessary

  
scope
admin-api
Issues concerning the administration API

  
scope
admin-sdk
Related to the admin SDKs that provide API bindings for various languages

  
scope
background-healing
Background healing covers repair tasks, anti-entropy, merkle trees, etc. ; everything related to replicating data appropriately.

  
scope
build
Issues with Nix, Drone, Rust Compiler, etc.

  
scope
documentation

  
scope
k8s
Kubernetes related, including Helm Charts

  
scope
layout
Linked to the cluster layout and storage management

  
scope
metadata
Metadata Engine (LMDB, sqlite, etc.)

  
scope
ops
Operations related to operations/maintenance issue, tooling related (like CLI missing info ; impossible, too dangerous, too complicated migration, etc.)

  
scope
rpc
Linked to RPC

  
scope
s3-api
Related to the S3 API (especially compatibility issues).

  
scope
security
Cryptography-related, auth-related, authorization-related issues

  
scope
telemetry
OpenTelemetry (traces, metrics, etc.)

No labels
action
check-aws
action
discussion-needed
action
for-external-contributors
action
for-newcomers
action
more-info-needed
action
need-funding
action
triage-required
kind
correctness
kind/experimental
kind
ideas
kind
improvement
kind
performance
kind
testing
kind
usability
kind
wrong-behavior
prio
critical
prio
low
scope
admin-api
scope
admin-sdk
scope
background-healing
scope
build
scope
documentation
scope
k8s
scope
layout
scope
metadata
scope
ops
scope
rpc
scope
s3-api
scope
security
scope
telemetry
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Deuxfleurs/garage#345
No description provided.
Delete branch "ci/bump-nix-img"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?