bug#51505: Request for official docker image on dockerhub

bug#51505: Request for official docker image on dockerhub

[Jacob Hrbek]

[-- Attachment #1.1.1: Type: text/plain, Size: 1174 bytes --]

Please set up an official docker image on dockerhub (e.g. https://hub.docker.com/_/debian) i wanted to use docker to test GUIX configuration, but i can't define a dockerfile for it since `FROM scratch` can't fetch remote tarball without using `ADD` from a local file (which is not an option in the development environment) so i had to resort to a 3rd party alpine + guix (https://raw.githubusercontent.com/bmpvieira/Dockerfiles/master/guix/Dockerfile).

... also need an official docker image for WoodpeckerCI to handle CI/CD for my systems to avoid deploying broken configuration.

See howto on
https://docs.docker.com/develop/develop-images/baseimages/

The following should be sufficient:

$ wget
https://ftp.gnu.org/gnu/guix/guix-binary-1.3.0.x86_64-linux.tar.xz
`$ docker import -` guix-binary-1.3.0.x86_64-linux.tar.xz

Or:

```dockerfile
FROM scratch
MAINTAINER Jon Doe Von GNU <user@domain.tld>

# Add the tarball from
https://ftp.gnu.org/gnu/guix/guix-binary-1.3.0.x86_64-linux.tar.xz on the image
ADD ./guix-binary-1.3.0.x86_64-linux.tar.xz /

ENTRYPOINT [ "/bin/sh" ]

```

-- Jacob "Kreyren" Hrbek

Sent with ProtonMail Secure Email.

[-- Attachment #1.1.2.1: Type: text/html, Size: 2410 bytes --]

[-- Attachment #1.2: publickey - kreyren@rixotstudio.cz - 0x1677DB82.asc --]
[-- Type: application/pgp-keys, Size: 737 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 249 bytes --]

bug#51505: Request for official docker image on dockerhub

[Eugen Stan]

[-- Attachment #1: Type: text/plain, Size: 379 bytes --]

Hi,

I also think it would be a great idea to have guix running inside docker.

I tried to adopt guix as a package maanger in our CI/CD pipeline and I 
could not run it inside a debian Docker image.

It seems guix has issues when running inside docker.
I found prior work here: https://github.com/metacall/guix .

Thanks,
-- 
Eugen Stan

+40770 941 271  / https://www.netdava.com

[-- Attachment #2: eugen_stan.vcf --]
[-- Type: text/vcard, Size: 181 bytes --]

begin:vcard
fn:Eugen Stan
n:Stan;Eugen
email;internet:eugen.stan@netdava.com
tel;cell:+40720898747
x-mozilla-html:FALSE
url:https://www.netdava.com
version:2.1
end:vcard

bug#51505: Request for official docker image on dockerhub

[Denis 'GNUtoo' Carikli]

[-- Attachment #1: Type: text/plain, Size: 3531 bytes --]

Hi,

If the idea is to be able to use a Guix docker image, as I understand
dockerhub is not strictly required.

For instance Fedora has its own docker registry[1] that works out of
the box with docker pull. More generally to download an image one can
just run: 'docker pull <repository>/<image/path>'. As I understand that
is usable in Dockerimages in the same way.

If I understood well, your issue is to integrate Guix docker images in
test environments that require you to use only a Dockerfile.

For publishing Guix docker images, Guix has several options that are not
mutually exclusive:
- It could use dockerhub. Note that the dockerhub registry/repository
  itself is not FSDG compliant as it contains nonfree software like
  Windows images.
- Guix could setup its own docker registry. There is a work in progress
  patch for the docker registry (bug #60770) that works but it still
  needs to un-vendor the dependencies. We also need to look how to use
  it to deploy public registries (I've only tested it on localhost so
  far, so without certificates and authentication). Also nobody
  reviewed that patch yet and there seems to be a huge backlog with
  patches review.
- Someone could setup a general FSDG compliant registry for various
  docker images, and Guix could add official images there.
- Someone could also do some research to see if it's possible to
  host images on a simple web server and make docker think it's a
  registry. If that works, it could integrate well with
  guix.gnu.org/en/download and guix.gnu.org/en/download/latest and the
  Guix release infrastructure. Though one issue here is that docker
  somehow expects yaml files on directory paths.

If Guix uses a third party registry, the third party will not have the
same policies and priorities than Guix. And in practice the third party
will be able to modify the images, as it hosts images that lack
signatures, and as far as I know there is also no way to automatically
verify some signatures before running the images.

PureOS also uses dockerhub, and as far as I know their docker images
are FSDG compliant. So if you need FSDG compliant images you could use
that and download and run Guix there.

Parabola and Trisquel also have what is needed to make docker images
but the images are not published anywhere as far as I know, so other
FSDG compliant distributions didn't really solve the issue either.

Alternatively Guix could just publish additional docker images in
guix.gnu.org/en/download and guix.gnu.org/en/download/latest but here I
guess that this doesn't work for your test environment.

As for the Debian images you mentioned they are somehow semi-official
according to Debian. Maybe it's because they are made by some Debian
maintainers and are not part of the regular Debian release process.

Personally I'd like to be able to use docker and more specifically
Dockerfiles in an FSDG compliant and trustworthy way, so I've started
looking a bit into it, for all FSDG compliant distributions in
general[2], but we have no drop-in solution that integrate well with
distributions release processes yet.

Also note that I'm new to docker so I might have missed some stuff, and
I'm also not a Guix maintainer so I can't take decisions for the Guix
project.

References:
-----------
[1]https://registry.fedoraproject.org It is probably not FSDG compliant.
[2]https://libreplanet.org/wiki/Group:Software/research/ExternalRepositories/DockerRegistries

Denis.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#51505: Request for official docker image on dockerhub

[zimoun]

Hi,

On Thu, 09 Feb 2023 at 18:20, Eugen Stan <eugen.stan@netdava.com> wrote:

> I also think it would be a great idea to have guix running inside docker.
>
> I tried to adopt guix as a package maanger in our CI/CD pipeline and I 
> could not run it inside a debian Docker image.

Yeah, it could be helpful.  In addition to Denis comment, I just would
like to point that you do not necessary need that Guix is running inside
Docker but you often only need some packages inside this Docker.

Other said, for deploying on non-Guix infrastructure, I often use Guix
as a Docker factory via “guix pack -f docker -m manifest.scm” where
manifest.scm only contains the packages required by my pipeline (or even
sometime only one pack for each node of the pipeline).

Similarly, I use “guix system image -t docker”, barely.

Cheers,
simon