5 ms·

We are using base images but unfortunately some github actions are pulling docker images in their prepare phase - so while my application would build, I cannot

We are using base images but unfortunately some github actions are pulling docker images in their prepare phase - so while my application would build, I cannot deploy it because the CI/CD depends on dockerhub and you cannot change where these images are pulled from (so they cannot go through a pull-through cache)…

roryirvine 1y ago
My advice: document the issue, and use it to help justify spending time on removing those vestigial dependencies on Docker asap. It's not just about reducing your exposure to third parties who you (presumably) don't have a contract with, it's also good mitigation against potential supply chain attacks - especially if you go as far as building the base images from scratch.
- tom1337 1y ago
  Yea we have thought about that - I also want to remove most dependencies on externally imported actions on GitHub CI and probably just go back to simple bash scripts. Our actions are not that complicated and there is little benefit in using some external action to run ESLint than just run the command inside the action directly. Saves time and reduces dependencies - just need to get time to do that…
enigmo 1y ago
mirrors can be configured in dockerd or buildkit. if you can update the config (might need a self-hosted runner?) it’s a quick fix - see https://cloud.google.com/artifact-registry/docs/pull-cached-dockerhub-images https://cloud.google.com/artifact-registry/docs/pull-cached-... for an example. aws and azure are similar.
- tom1337 1y ago
  Hmm yea with a self hosted runner this could work. Gotta need to set the dockerd config into the VM before the runner starts I assume - unfortunately GitHub itself does not allow to change anything for the prepare stage - and it's a known issue for 2 years at least... https://github.com/actions/runner-images/issues/1445#issuecomment-713861495 https://github.com/actions/runner-images/issues/1445#issueco... https://github.com/orgs/community/discussions/76636 https://github.com/orgs/community/discussions/76636

roryirvine 1y ago

My advice: document the issue, and use it to help justify spending time on removing those vestigial dependencies on Docker asap. It's not just about reducing your exposure to third parties who you (presumably) don't have a contract with, it's also good mitigation against potential supply chain attacks - especially if you go as far as building the base images from scratch.

tom1337 1y ago
Yea we have thought about that - I also want to remove most dependencies on externally imported actions on GitHub CI and probably just go back to simple bash scripts. Our actions are not that complicated and there is little benefit in using some external action to run ESLint than just run the command inside the action directly. Saves time and reduces dependencies - just need to get time to do that…

enigmo 1y ago

mirrors can be configured in dockerd or buildkit. if you can update the config (might need a self-hosted runner?) it’s a quick fix - see https://cloud.google.com/artifact-registry/docs/pull-cached-dockerhub-images https://cloud.google.com/artifact-registry/docs/pull-cached-... for an example. aws and azure are similar.

tom1337 1y ago
Hmm yea with a self hosted runner this could work. Gotta need to set the dockerd config into the VM before the runner starts I assume - unfortunately GitHub itself does not allow to change anything for the prepare stage - and it's a known issue for 2 years at least... https://github.com/actions/runner-images/issues/1445#issuecomment-713861495 https://github.com/actions/runner-images/issues/1445#issueco... https://github.com/orgs/community/discussions/76636 https://github.com/orgs/community/discussions/76636