ci: publish tested gVisor image to Docker Hub latest - #64
Merged
Conversation
Build the public all-in-one image with only gVisor and run the SDK gates and standalone E2E before publishing the same tested image. Restrict Docker Hub authentication and publishing to upstream main push events. Preserve main runs and serialize the build, test, and publication job. Check the main head before pushing so superseded commits and old reruns skip publication, and publish only latest without per-commit image tags. Document the public image contents and required Actions credentials while preserving the optional VM runtime defaults for source builds. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
Give the multi-section Dockerfile launch example a 600-second CI budget while retaining the 120-second limit for other examples. Its package installation RUN permits 300 seconds, so the previous outer limit killed the process before the SDK could report slow installation failures. Run examples with unbuffered output and bound forced termination so CI shows section progress and a stuck process cannot outlive the job budget. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
Use the Ubuntu base image shell for the core example's startup marker instead of installing Python from an apt mirror on every sandbox launch. This preserves the RUN, context-copy, permissions, environment, working directory, and startup assertions while removing an unrelated network failure from the Dockerfile capability checks. Keep unbuffered CI output and the multi-section example budget, and update the launch guide and agent instructions to describe the package-free path. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
Restore the project and deployment READMEs to their existing content. Keep the CI publication contract in agent guidance and retain the Dockerfile example documentation with its implementation change. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The main CI currently builds an image for E2E without publishing it. This change publishes the tested Linux/amd64
rrtimage toakerneldev/all-in-one:latestafter SDK, distribution, deployment-script, and standalone E2E checks pass. The public image includes only gVisor; Kata, Firecracker, virtiofsd, and runc are excluded and checked before E2E.PRs and forks skip Docker Hub login and publishing. Main runs are preserved and their build/test/publish jobs are serialized. The job checks the current main head before any push: superseded commits and reruns of older commits publish nothing. Only
latestis pushed, with no SHA or historical tags.Examples run with unbuffered output. The nine-section Dockerfile launch example gets a 600-second outer budget; other examples retain 120 seconds. Its core startup marker uses Ubuntu's existing shell instead of downloading Python from apt. All RUN, copy/ignore, permission, environment, working-directory, and startup assertions remain, while package-mirror availability no longer determines Dockerfile E2E results.
Uses the repository variable
DOCKERHUB_USERNAMEand secretDOCKERHUB_TOKEN. Source builds retain their existing optional VM runtime defaults. The Dockerfile guide and agent guidance describe the resulting behavior. The project and deployment READMEs are unchanged.Validation:
git diff --checkpassed. actionlint 1.7.12 passed with only its unsupportedconcurrency.queuediagnostic excluded; GitHub accepted this documented configuration and ran PR CI.The follow-up commit only restores the two READMEs; workflow and example code are unchanged from the successful CI run.