Docker on Bill Glover

Dockerfile Revisited

hello@bill.dev (Bill) — Fri, 26 Jul 2024 16:08:00 +0100

For years I’ve been building container images by using the COPY command to bring files from my Docker context into the build container.

FROM golang:1.22 AS build

WORKDIR /src/build
COPY . .

RUN go mod verify
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o /app .

FROM scratch
COPY --from=build /app .
CMD ["./app"]

Today I came across the following section in the Docker documentation.

“You’ll mostly want to use COPY for copying files from one stage to another in a multi-stage build. If you need to add files from the build context to the container temporarily to execute a RUN instruction, you can often substitute the COPY instruction with a bind mount instead.”

Docker Desktop (Mac) Unix Socket

hello@bill.dev (Bill) — Sat, 13 Apr 2024 18:37:00 +0000

Two of the tools in my container toolkit stopped working at some point recently. To demonstrate the issue, I first make sure that I have an image pulled locally.

bg@Bills-MBP ~ % docker image ls
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
golang       1.22      824aa3c1d42c   10 days ago   830MB
demo         latest    cf12555b1219   10 days ago   830MB

The first tool, Dive, started producing errors like this.

bg@Bills-MBP tmp % dive demo
Image Source: docker://demo
Fetching image... (this can take a while for large images)
Handler not available locally. Trying to pull 'demo'...
Using default tag: latest
Error response from daemon: pull access denied for demo, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
cannot fetch image
exit status 1

The image was present locally and the docker daemon definitely running. I logged out, logged in again and tried different accounts. When I first hit this error I assumed that this was an issue with Dive. The workaround I used was to export the image to a .tar file and then use dive to browse the disk image. But then I hit this error with Trivy.

Docker and LetsEncrypt

hello@bill.dev (Bill) — Thu, 20 Oct 2022 20:14:45 +0100

If you are running a private container registry and using a certificate provided by LetsEncrypt, make sure you are using fullchain.pem and not cert.pem. If you miss this, the Docker CLI will report that your certificate is signed by an unknown authority.

I have an instance of Harbor running as a private container registry. The certificate used by this instance is provided by LetsEncrypt and yet the Docker CLI refused to let me log in.

Dive Through the Layers

hello@bill.dev (Bill) — Fri, 28 Feb 2020 06:16:35 +0000

Dive Through the Layers

I’ve been working with a container image for a Django application and was surprised to find that an image for a simple application was 1.2 GB. This was particularly jarring as, coming from the world of Go, I’m used to images that come in at under 20 MB.

It’s not the size of the container image that’s the problem. Layer caching and re-use means that you are rarely transferring the full image around and that storage on disk is usually less than the sum of all your images. The worry I have with an image that is 1.2 GB is that everything that makes up that image needs to be maintained, patched, watched for security vulnerabilities, etc. 1.2 GB is a lot of software.

Docker Compose: Conditional Services

hello@bill.dev (Bill) — Fri, 21 Feb 2020 06:16:35 +0000

I recently added a docker-compose definition of services to make it easier for people to contribute to the new CodeBuddies back-end. This addresses some of the pain new contributors were feeling with setting up a local development environment. The CodeBuddies backend is an API built using the Django REST Framework. PostgreSQL provides the data store. Everything is fronted by an Nginx reverse proxy. This is often referred to as a three-tier architecture.