Skip to content

Commit de930c2

Browse files
anthony-nhsanthony-nhs
committed
use image
1 parent 514f63b commit de930c2

8 files changed

Lines changed: 104 additions & 115 deletions

File tree

‎.devcontainer/Dockerfile‎

Lines changed: 12 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,14 @@
1-
FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
2-
ARG TARGETARCH
3-
ENV TARGETARCH=${TARGETARCH}
4-
5-
# Install essential packages first
6-
RUN apt-get update && apt-get install -y \
7-
curl \
8-
wget \
9-
git \
10-
sudo \
11-
unzip \
12-
&& apt-get clean \
13-
&& rm -rf /var/lib/apt/lists/*
14-
15-
# Copy ASDF version file
16-
ARG ASDF_VERSION
17-
COPY .tool-versions.asdf /tmp/.tool-versions.asdf
18-
19-
# Add amd64 architecture if on arm64
20-
RUN if [ "$TARGETARCH" == "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then dpkg --add-architecture amd64; fi
21-
22-
RUN apt-get update \
23-
&& export DEBIAN_FRONTEND=noninteractive \
24-
&& apt-get -y dist-upgrade \
25-
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
26-
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
27-
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
28-
jq apt-transport-https ca-certificates gnupg-agent \
29-
software-properties-common bash-completion python3-pip make libbz2-dev \
30-
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
31-
xz-utils tk-dev liblzma-dev netcat-traditional libyaml-dev uuid-runtime xxd unzip
32-
33-
# install aws stuff
34-
# Download correct AWS CLI for arch
35-
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
36-
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; \
37-
else \
38-
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; \
39-
fi && \
40-
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
41-
/tmp/aws-cli/aws/install && \
42-
rm /tmp/awscliv2.zip && rm -rf /tmp/aws-cli
43-
44-
# Install ASDF
45-
RUN ASDF_VERSION=$(awk '!/^#/ && NF {print $1; exit}' /tmp/.tool-versions.asdf) && \
46-
if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
47-
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-arm64.tar.gz"; \
1+
ARG IMAGE_NAME=node_24_python_3_14
2+
ARG IMAGE_VERSION=latest
3+
FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}
4+
5+
USER root
6+
# specify DOCKER_GID to force container docker group id to match host
7+
RUN if [ -n "${DOCKER_GID}" ]; then \
8+
if ! getent group docker; then \
9+
groupadd -g ${DOCKER_GID} docker; \
4810
else \
49-
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-amd64.tar.gz"; \
11+
groupmod -g ${DOCKER_GID} docker; \
5012
fi && \
51-
tar -xzf /tmp/asdf.tar.gz -C /tmp && \
52-
mkdir -p /usr/bin && \
53-
mv /tmp/asdf /usr/bin/asdf && \
54-
chmod +x /usr/bin/asdf && \
55-
rm -rf /tmp/asdf.tar.gz
56-
57-
# install gitsecrets
58-
RUN git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets && \
59-
cd /tmp/git-secrets && \
60-
make install && \
61-
cd && \
62-
rm -rf /tmp/git-secrets && \
63-
mkdir -p /usr/share/secrets-scanner && \
64-
chmod 755 /usr/share/secrets-scanner && \
65-
curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o /usr/share/secrets-scanner/nhsd-rules-deny.txt
66-
67-
USER vscode
68-
69-
ENV PATH="/home/vscode/.asdf/shims/:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"
70-
RUN \
71-
echo 'PATH="/home/vscode/.asdf/shims/:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"' >> ~/.bashrc; \
72-
echo '. <(asdf completion bash)' >> ~/.bashrc; \
73-
echo '# Install Ruby Gems to ~/gems' >> ~/.bashrc; \
74-
echo 'export GEM_HOME="$HOME/gems"' >> ~/.bashrc; \
75-
echo 'export PATH="$HOME/gems/bin:$PATH"' >> ~/.bashrc;
76-
77-
# Install ASDF plugins
78-
RUN asdf plugin add python; \
79-
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git; \
80-
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git; \
81-
asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
82-
asdf plugin add direnv; \
83-
asdf plugin add actionlint; \
84-
asdf plugin add ruby https://github.com/asdf-vm/asdf-ruby.git; \
85-
asdf plugin add trivy https://github.com/zufardhiyaulhaq/asdf-trivy.git; \
86-
asdf plugin add yq https://github.com/sudermanjr/asdf-yq.git
87-
88-
89-
WORKDIR /workspaces/eps-devcontainers
90-
COPY .tool-versions /workspaces/eps-devcontainers/.tool-versions
91-
COPY .tool-versions /home/vscode/.tool-versions
92-
93-
# install python before poetry to ensure correct python version is used
94-
RUN asdf install python; \
95-
asdf install
96-
97-
RUN git-secrets --register-aws --global && \
98-
git-secrets --add-provider --global -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt
13+
usermod -aG docker vscode; \
14+
fi

‎.devcontainer/devcontainer.json‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,19 @@
33
{
44
"name": "eps-devcontainers",
55
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6-
"build": {
7-
"dockerfile": "Dockerfile",
8-
"context": "..",
9-
"args": {}
6+
"build": {
7+
"dockerfile": "Dockerfile",
8+
"context": "..",
9+
"args": {
10+
"DOCKER_GID": "${env:DOCKER_GID:}",
11+
"IMAGE_NAME": "node_24_python_3_14",
12+
"IMAGE_VERSION": "v1.0.4",
13+
"USER_UID": "${localEnv:USER_ID:}",
14+
"USER_GID": "${localEnv:GROUP_ID:}"
1015
},
16+
"updateRemoteUserUID": false
17+
},
18+
"postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
1119
"mounts": [
1220
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
1321
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
@@ -18,14 +26,7 @@
1826
"--network=host"
1927
],
2028
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
21-
"postAttachCommand": "docker build -f https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/tags/v4.0.4/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && poetry run pre-commit install --install-hooks -f",
2229
"features": {
23-
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
24-
"version": "latest",
25-
"moby": "true",
26-
"installDockerBuildx": "true"
27-
},
28-
"ghcr.io/devcontainers/features/github-cli:1": {}
2930
},
3031
"customizations": {
3132
"vscode": {

‎.github/workflows/build_all_images.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ name: build_all_images
1111
NO_CACHE:
1212
required: true
1313
type: boolean
14+
runtime_docker_image:
15+
type: string
16+
required: true
1417
env:
1518
BRANCH_NAME: '${{ github.event.pull_request.head.ref }}'
1619
jobs:
@@ -41,6 +44,7 @@ jobs:
4144
container_name: base
4245
base_folder: "."
4346
NO_CACHE: ${{ inputs.NO_CACHE }}
47+
runtime_docker_image: ${{ inputs.runtime_docker_image }}
4448
package_base_node_images:
4549
needs:
4650
- package_base_docker_image
@@ -56,6 +60,7 @@ jobs:
5660
container_name: ${{ matrix.container_name }}
5761
base_folder: "base_node"
5862
NO_CACHE: ${{ inputs.NO_CACHE }}
63+
runtime_docker_image: ${{ inputs.runtime_docker_image }}
5964
package_node_24_language_docker_images:
6065
needs:
6166
- package_base_docker_image
@@ -73,6 +78,7 @@ jobs:
7378
base_folder: "languages"
7479
NO_CACHE: ${{ inputs.NO_CACHE }}
7580
EXTRA_COMMON: "common_node_24"
81+
runtime_docker_image: ${{ inputs.runtime_docker_image }}
7682
package_project_docker_images:
7783
needs:
7884
- package_node_24_language_docker_images
@@ -88,3 +94,4 @@ jobs:
8894
container_name: ${{ matrix.container_name }}
8995
base_folder: "projects"
9096
NO_CACHE: ${{ inputs.NO_CACHE }}
97+
runtime_docker_image: ${{ inputs.runtime_docker_image }}

‎.github/workflows/build_multi_arch_image.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ name: Build and push docker image
2020
EXTRA_COMMON:
2121
required: false
2222
type: string
23+
runtime_docker_image:
24+
type: string
25+
required: true
2326

2427
jobs:
2528
build_and_push_image:
@@ -30,6 +33,13 @@ jobs:
3033
attestations: write
3134
id-token: write
3235
runs-on: '${{ matrix.runner }}'
36+
container:
37+
image: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.runtime_docker_image }}
38+
options: --user 1001:1001 --group-add 128
39+
defaults:
40+
run:
41+
shell: bash
42+
3343
strategy:
3444
fail-fast: false
3545
matrix:
@@ -39,6 +49,9 @@ jobs:
3949
- arch: arm64
4050
runner: ubuntu-22.04-arm
4151
steps:
52+
- name: copy .tool-versions
53+
run: |
54+
cp /home/vscode/.tool-versions "$HOME/.tool-versions"
4255
- name: Free Disk Space for Docker
4356
uses: endersonmenezes/free-disk-space@e6ed9b02e683a3b55ed0252f1ee469ce3b39a885
4457
with:

‎.github/workflows/ci.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,21 @@ on:
44
branches: [main]
55

66
jobs:
7+
get_config_values:
8+
runs-on: ubuntu-22.04
9+
outputs:
10+
devcontainer_image_name: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_NAME }}
11+
devcontainer_image_version: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_VERSION }}
12+
steps:
13+
- name: Checkout code
14+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
15+
- name: Load config value
16+
id: load-config
17+
run: |
18+
DEVCONTAINER_IMAGE_NAME=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
19+
DEVCONTAINER_IMAGE_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
20+
echo "DEVCONTAINER_IMAGE_NAME=$DEVCONTAINER_IMAGE_NAME" >> "$GITHUB_OUTPUT"
21+
echo "DEVCONTAINER_IMAGE_VERSION=$DEVCONTAINER_IMAGE_VERSION" >> "$GITHUB_OUTPUT"
722
get_asdf_version:
823
runs-on: ubuntu-22.04
924
outputs:
@@ -40,9 +55,12 @@ jobs:
4055
tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
4156
secrets: inherit
4257
build_all_images:
43-
needs: tag_release
58+
needs:
59+
- tag_release
60+
- get_config_values
4461
uses: ./.github/workflows/build_all_images.yml
4562
with:
4663
docker_tag: 'ci-${{ needs.tag_release.outputs.version_tag }}'
4764
tag_latest: false
4865
NO_CACHE: false
66+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image_name }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_image_version }}"

‎.github/workflows/pull_request.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,21 @@ name: pull_request
66
env:
77
BRANCH_NAME: '${{ github.event.pull_request.head.ref }}'
88
jobs:
9+
get_config_values:
10+
runs-on: ubuntu-22.04
11+
outputs:
12+
devcontainer_image_name: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_NAME }}
13+
devcontainer_image_version: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_VERSION }}
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
17+
- name: Load config value
18+
id: load-config
19+
run: |
20+
DEVCONTAINER_IMAGE_NAME=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
21+
DEVCONTAINER_IMAGE_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
22+
echo "DEVCONTAINER_IMAGE_NAME=$DEVCONTAINER_IMAGE_NAME" >> "$GITHUB_OUTPUT"
23+
echo "DEVCONTAINER_IMAGE_VERSION=$DEVCONTAINER_IMAGE_VERSION" >> "$GITHUB_OUTPUT"
924
dependabot-auto-approve-and-merge:
1025
needs: quality_checks
1126
uses: >-
@@ -88,8 +103,10 @@ jobs:
88103
needs:
89104
- get_issue_number
90105
- get_commit_id
106+
- get_config_values
91107
uses: ./.github/workflows/build_all_images.yml
92108
with:
93109
docker_tag: 'pr-${{ needs.get_issue_number.outputs.issue_number }}-${{ needs.get_commit_id.outputs.sha_short }}'
94110
tag_latest: false
95111
NO_CACHE: false
112+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image_name }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_image_version }}"

‎.github/workflows/release.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,21 @@ on:
55
- cron: "0 18 * * 4"
66

77
jobs:
8+
get_config_values:
9+
runs-on: ubuntu-22.04
10+
outputs:
11+
devcontainer_image_name: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_NAME }}
12+
devcontainer_image_version: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_VERSION }}
13+
steps:
14+
- name: Checkout code
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
16+
- name: Load config value
17+
id: load-config
18+
run: |
19+
DEVCONTAINER_IMAGE_NAME=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
20+
DEVCONTAINER_IMAGE_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
21+
echo "DEVCONTAINER_IMAGE_NAME=$DEVCONTAINER_IMAGE_NAME" >> "$GITHUB_OUTPUT"
22+
echo "DEVCONTAINER_IMAGE_VERSION=$DEVCONTAINER_IMAGE_VERSION" >> "$GITHUB_OUTPUT"
823
get_asdf_version:
924
runs-on: ubuntu-22.04
1025
outputs:
@@ -41,9 +56,12 @@ jobs:
4156
tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
4257
secrets: inherit
4358
build_all_images:
44-
needs: tag_release
59+
needs:
60+
- tag_release
61+
- get_config_values
4562
uses: ./.github/workflows/build_all_images.yml
4663
with:
4764
docker_tag: '${{ needs.tag_release.outputs.version_tag }}'
4865
tag_latest: true
4966
NO_CACHE: true
67+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image_name }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_image_version }}"

‎README.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,11 @@ It is important that
130130
- there is `options: --user 1001:1001 --group-add 128` below image to ensure it uses the correct user id and is added to the docker group
131131
- the default shell is set to be bash
132132
- the first step copies .tool-versions from /home/vscode to $HOME/.tool-versions
133+
## Using local or pull request images in visual studio code
134+
You can use local or pull request images by changing IMAGE_VERSION in devcontainer.json.
135+
For an image built locally following instructions below, you should put the IMAGE_VERSION=local-build.
136+
For an image built from a pull request, you should put the IMAGE_VERSION=<tag of image as show in pull request job>.
137+
You can only use images built from a pull request for testing changes in github actions.
133138

134139
# Project structure
135140
We have 5 types of dev container. These are defined under src
@@ -271,12 +276,6 @@ CONTAINER_NAME=base \
271276
make shell-image
272277
```
273278

274-
## Using local or pull request images in visual studio code
275-
You can use local or pull request images by changing IMAGE_VERSION in devcontainer.json.
276-
For an image built locally, you should put the IMAGE_VERSION=local-build.
277-
For an image built from a pull request, you should put the IMAGE_VERSION=<tag of image as show in pull request job>.
278-
You can only use images built from a pull request for testing changes in github actions.
279-
280279
## Generating a .trivyignore file
281280
You can generate a .trivyignore file for known vulnerabilities by either downloading the json scan output generated by the build, or by generating it locally using the scanning images commands above with a make target of scan-image-json
282281

0 commit comments

Comments
 (0)