LukeTillman / dse-docker

DataStax Enterprise running in a Docker Container
Apache License 2.0
47 stars 17 forks source link

Integrate download into Dockerfile #8

Closed LukeTillman closed 7 years ago

LukeTillman commented 7 years ago

Right now, downloading DSE is something that happens outside of the Dockerfile since downloading requires credentials and we don't want to bake creds into the final image (i.e. we don't want them available to docker history). This sucks because we then have to use an ADD instruction in the Dockerfile to add the downloaded tarball from the build context, and then later have to chown the unpacked tarball files resulting in an extra layer that effectively doubles the size of the overall image.

In order to remove that extra layer, we want to be able to download, unpack, and chown in a single RUN instruction. And to do that, we need some way to download without baking credentials into the image. My (admittedly hacky) proposed solution is to:

  1. Expose the .netrc credentials file we use to download via a local HTTP server during the docker build. (For Travis builds, this file is already encrypted and used when downloading before kicking off the actual build).
  2. Use curl to download those credentials to a temp directory, then use those credentials to download DSE to that same temp directory.
  3. In the same RUN instruction where we're downloading, unpack, chown, and then delete the temp directory so that we don't end up with credentials or other downloaded artifacts in the finished image.
LukeTillman commented 7 years ago

After getting this working, it resulted in a Docker image that's 800+ MB smaller. The next release (likely 5.0.6 when it comes from DataStax) should have these changes. I have no plans to backport this to the 4.x branch.