chore(docker): include grpcurl in provider image#405
Conversation
WalkthroughThe release configuration now supplies a pinned grpcurl version and architecture-specific checksums to provider image builds. The Dockerfile selects the matching artifact, verifies its checksum, installs grpcurl into Changesgrpcurl installation in provider image
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseConfig
participant Dockerfile
participant GitHubReleases
ReleaseConfig->>Dockerfile: Pass version and architecture checksums
Dockerfile->>GitHubReleases: Download matching grpcurl archive
GitHubReleases-->>Dockerfile: Return release tarball
Dockerfile->>Dockerfile: Verify checksum and install grpcurl
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)DockerfileTraceback (most recent call last): .goreleaser-docker.yamlTraceback (most recent call last): .goreleaser.yamlTraceback (most recent call last): Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
32-33: ⚡ Quick winHarden the download step against transient network failures.
curl -fsSLcan fail builds on temporary GitHub/DNS/network hiccups. Add retry and timeout flags to make image builds more reliable.Suggested patch
- curl -fsSL -o /tmp/grpcurl.tar.gz \ + curl -fL --retry 5 --retry-delay 2 --retry-connrefused --connect-timeout 10 --max-time 120 -o /tmp/grpcurl.tar.gz \ "https://github.com/fullstorydev/grpcurl/releases/download/v${GRPCURL_VERSION}/grpcurl_${GRPCURL_VERSION}_linux_${arch}.tar.gz"; \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 32 - 33, The curl command used to download the grpcurl tarball in the Dockerfile lacks resilience against transient network failures. Add retry and timeout flags to the curl command that downloads grpcurl to make the build process more robust. Specifically, add the `--retry` flag to automatically retry failed downloads on transient failures, and add timeout-related flags such as `--connect-timeout` and `--max-time` to prevent indefinite hangs. These flags should be added to the curl command parameters alongside the existing `-fsSL` flags in the grpcurl download step.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@Dockerfile`:
- Around line 32-33: The curl command used to download the grpcurl tarball in
the Dockerfile lacks resilience against transient network failures. Add retry
and timeout flags to the curl command that downloads grpcurl to make the build
process more robust. Specifically, add the `--retry` flag to automatically retry
failed downloads on transient failures, and add timeout-related flags such as
`--connect-timeout` and `--max-time` to prevent indefinite hangs. These flags
should be added to the curl command parameters alongside the existing `-fsSL`
flags in the grpcurl download step.
ddf8b5d to
c091b63
Compare
Bundle grpcurl into the provider image so the inventory operator's gRPC API can be probed from inside the container (e.g. a liveness probe). grpcurl is not packaged in apt, so a pinned release is downloaded and sha256-verified for both amd64 and arm64. The version and per-arch checksums live in .env and are threaded through the goreleaser build as --build-arg values, so bumping the release only touches .env, not the Dockerfile. The download is hardened with curl retry/timeout flags. Resolves akash-network/support#317 Co-authored-by: neyy <neyy91@mail.ru>
c091b63 to
d121483
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.env:
- Around line 5-10: Reorder the GRPCURL_VERSION, GRPCURL_SHA256_AMD64, and
GRPCURL_SHA256_ARM64 entries in .env to match dotenv-linter’s expected ordering
relative to KINDEST_VERSION, without changing their values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 928a5510-37db-4078-9897-4023443676d1
📒 Files selected for processing (5)
.env.goreleaser-docker.yaml.goreleaser.yamlDockerfilemake/releasing.mk
4 participants
Summary
Resolves akash-network/support#317.
The inventory operator exposes a gRPC API (
akash.inventory.v1.ClusterRPC). Bundlinggrpcurlin the provider image makes it possible to probe that API from inside the container - for example, a liveness probe that restarts the pod when allocated resources exceed allocatable.Change
grpcurlis not available via apt, so the Dockerfile installs a pinned release:v1.9.3.dpkg --print-architecture.grpcurlbinary is installed; the tarball is removed afterwards.grpcurl -versionruns at the end so the build fails fast if anything is wrong.Testing
Built the image locally (amd64) and confirmed the install step downloads, passes the checksum check, extracts the binary, and
grpcurl -versionreportsv1.9.3. The arm64 asset uses the official published checksum.refs: akash-network/support#317