Container Dependencies

[gilesknap]

DLS has a hierarchy of containers built upon each other. At present the source for each resides in its own repo and CI pushes the built image to a package registry. We have no way of automatically updating the hierarchy when one of the images is modified.

SKA places the docker files for a hierarchy of images in a single source repository. This is then updated using a Makefile before committing and tagging the repo.

Please add your own approaches or suggestions.

[thomascobb]

We could make a periodic action for each repo that checks if any of its dependencies needs updating, then updates to the latest release, then makes a PR against the latest releases. Come to think about it, this is what dependabot does, maybe we can tell it how to update dependencies of EPICS container builds?

[gilesknap]

That is a great idea. Someone already thought of it and dependabot already supports it!

https://dev.to/oracle2025/how-to-keep-a-dockerfile-updated-with-dependabot-1mdn

[gilesknap]

So I tried this and it just works. The one thing I had to do was change

ARG REGISTRY=ghcr.io/epics-containers
ARG EPICS_VERSION=7.0.5r3.0
FROM ${REGISTRY}/epics-base:${EPICS_VERSION} AS developer

to

FROM ghcr.io/epics-containers/epics-base:7.0.5r3.0 AS developer

So dependabot is not smart enough to expand ARGS presently.

It takes the repo owner maybe 3 clicks to follow the link in the notification email and accept the PR and obviously that will mount up with a large dependency hierarchy. However I feel that a little manual intervention with the developer having final say if the update is required is a good thing.

TLDR:
To make this work add the following to .github/dependabot.yml in each repo:

version: 2
updates:
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "daily"

[tynanford]

In GRETA, we use a makefile based build system that closely resembles the EPICS IOC build system. And then our gitlab CI scripts use these build commands as well as developers.

$ ls
configure
images
Makefile
src

Here are some common commands:

make init - clones repositories into src
make update - git pull on repositories
make build - builds docker images
make push - push to registry

Then for dependencies you can do this in for instance configure/RULES_BUILD:

build.my-ioc: build.epics-base build.blah-blah
    docker build ... -f $(TOP)/images/Dockerfile.my-ioc

[gilesknap]

So it sounds like you have a repo per image?

Then the CI clones the dependencies in?

If your repos are public please share the link :-)

[tynanford]

Our repos are not public at the moment but we have talked about getting approval for that. I will see what our options our and let you know.

We actually have multiple images per repo, and each docker build command is a CI job in gitlab inside a "build" stage. The build system has variables like SRC_URL and TAG to specify the git repository and git branch to use.

Here would be a rough example of the CI to build one image for an "epics-ioc" component using the build repo.

epics-ioc-build:
  ...
  script:
    - git clone https://.../build.git
    - cd build
    - echo SRC_URL=https://... > configure/RELEASE.local
    # make docker tag equal "ci-branchname"
    - echo TAG=ci-${CI_COMMIT_BRANCH} >> configure/RELEASE.local
    # clone IOC repo into src directory, checkout branch CI_COMMIT_BRANCH
    - make SRC_TAG=${CI_COMMIT_BRANCH} init.epics-ioc-repo
    - make SRC_TAG=${CI_COMMIT_BRANCH} init.example-repository-dependency
    # Docker build epics-ioc in epics-ioc-repo
    - make build.epics-ioc
    # Docker push
    - make push.epics-ioc

The CI either has to clone the dependent repository before running the "make build.component" stage, or the "init.repository" make rule has to be a dependency of the build rule. Sorry, this would hopefully make more sense if I could show you the code.

[gilesknap]

Thanks Tynan, I'm not sure I fully get what you are doing but it sounds like you have an established solution. I would like to take a look once you have published the source.