Container image entrypoints on Gitlab (was: Re: Building a Docker image for GitLab-CI)

[Simon Josefsson via <help-guix@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 2722 bytes --]

Simon Josefsson via <help-guix@gnu.org> writes:

> I didn't test now but I think Debian images handle all three entrypoint
> values, but the 'guix pack' image doesn't.

That was not true!  Here the situation:

https://gitlab.com/debdistutils/guix/container/-/pipelines/1600726433

Debian fails on these two GitLab .gitlab-ci.yml variants:

  image:
    name: debian:stable
    entrypoint: ["/bin/sh"]

  image:
    name: debian:stable
    entrypoint: ["/bin/sh", "-c"]

And works on these two variants:

  image:
    name: debian:stable
    entrypoint: [""]

  image: debian:stable

The last one is what I suppose most people want to use.  One shouldn't
have to specify entrypoint's when using GitLab CI/CD images.

My Guix container:latest works on these three variants:

  image:
    name: debian:stable
    entrypoint: ["/bin/sh", "-c"]

  image:
    name: debian:stable
    entrypoint: [""]

  image: debian:stable

And fail on this variant:

  image:
    name: debian:stable
    entrypoint: ["/bin/sh"]

At least we are not worse than Debian here.

However there is another difference, local run of Debian images handle
both these variants:

jas@kaka:~/src/guix-container$ podman run -it --rm debian:trixie-slim
root@f9634c8d6b63:/# 
exit
jas@kaka:~/src/guix-container$ podman run --entrypoint /bin/sh -it --rm debian:trixie-slim
# 
jas@kaka:~/src/guix-container$ 

But my Guix images doesn't:

jas@kaka:~/src/guix-container$ podman run -it --rm registry.gitlab.com/debdistutils/guix/container:latest
Error: no command or entrypoint provided, and no CMD or ENTRYPOINT from image
jas@kaka:~/src/guix-container$ podman run --entrypoint /bin/sh -it --rm registry.gitlab.com/debdistutils/guix/container:latest
sh-5.1# exit
jas@kaka:~/src/guix-container$ 

Presumably because of a missing '--entry-point=/bin/sh' when building
the images using 'guix pack'.  So let's add it!  Yes this now works:

jas@kaka:~/src/guix-container$ podman run -it --rm registry.gitlab.com/debdistutils/guix/container:latest2
sh-5.1# exit
jas@kaka:~/src/guix-container$ podman run --entrypoint /bin/sh -it --rm registry.gitlab.com/debdistutils/guix/container:latest2
sh-5.1# exit
jas@kaka:~/src/guix-container$ 

However this breaks GitLab CI/CD usage:

  image: $CI_REGISTRY_IMAGE:latest2

https://gitlab.com/debdistutils/guix/container/-/jobs/8713593164

Ouch, that is the primary use-case we want to support!

So until someone figures this one out, I've opted that the default
images require --entrypoint when invoked local on laptops with podman
but work without any configuration from GitLab shared runners and normal
.gitlab-ci.yml usage.

/Simon

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 255 bytes --]