Base Docker image

[avivace]

• [x] Look into conversation on Discord with Werner about using the RedHat UBI image
• [x] See existing docker-invenio
• [POSTPONED] How to include XRootD distribution in the image
  • Out of scope (because of complexity); we'll use local files instead (common R/W volume on OpenShift)
  • Look into S3-based file API?

Decision: use AlmaLinux as base image.

Findings

Today (20 Oct 2022), apps end of life:

• Python
  • 3.10 in ~4 years
  • 3.9 in ~3 years
  • 3.8 in 2 years
  • 3.7 in 8 months
• NodeJs
  • v18: upcoming
  • v16: ended, only security updates for 10 months
• Almalinux
  • v9: in 4.5 years

Tasks

• [x] Review exiting Docker image with AlmaLinux and Python 3.9
  • for example, why did we pin setuptools?
  • run as normal user, not root? WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager
  • check if any vulnerabilities: https://registry.cern.ch/harbor/projects/1825/
• [x] Decide the naming/tagging convention, for example inveniosoftware/almalinux9:python3.9-node18 vs inveniosoftware/almalinux9-python3.9-node18 vs .... Ask the community.
  • Decided to go for incremental versions instead: inveniosoftware/almalinux:v1.0.0
• [x] Can we host such images in registry.cern.ch, to avoid DockerHub limitations? Is there any other alternative?
• [x] Setup automatic builds

[avivace]

As mentioned by Werner some dependencies (like xmlsec1-devel) are not available without a RHEL subscription. E.g. xmlsec1 is shipped but not the devel one

It does indeed seem that the "CodeReady builder" UBI image does not give access to the full repository. See some replies by RH employees.

[avivace]

I got some more input by Lars and I pinged Alex Lossent about this. There's this doc page that may be relevant but it looks like only some packages are shipped there (e.g. Oracle) so I still don't see how we could use this image (a part from manually installing the RPM and handling the dependencies)

[avivace]

AlmaLinux should be a nice alternative for now. The next steps now are to move the current images in https://github.com/inveniosoftware/docker-invenio to use Alma as base instead of centos. There's already a 3.9 one merged there. One thing to check is also how are npm/node and python installed (nvm? distribution packaged python?)

[mfenner]

+1 regarding AlmaLinux. Do we also provide an image with AlmaLinux8 (for me only AlmaLInux9 is fine).

I would use Python from the distribution packaged Python, which is Python 3.9 in AlmaLinux 9. Node.js LTS is moving faster and probably has to be installed from source or NVM. Do we want to aim for Node@14 (supported until April 2023) or Node@16 (supported until September 2023)? I favor the latter as we would have to release a new image in a few months. @gressho do prefer to use nvm?

[wgresshoff]

In the Alma image I made there is the distribution packaged Python (3.9) included. Node.js is installed by nvm. The first reason I included an older version of Node.js is rather simple: I followed the documentation. The second reason is: with the newest version I can't build InvenioRDM, there is a webpack (?) problem I can't work arround. As the installation of nvm in an image is rather tricky (they just add shell commands) I'd surely prefered a distribution based installation. Yet I've seen comments in discord of InvenioRDM developers they run a local InvenioRDM instance perfectly with Node.js 16 and npm 8.

[mfenner]

I hope the issue running Node 16 can be resolved soon, see https://github.com/inveniosoftware/react-invenio-forms/pull/167. Why nvm and not installing a particular node version?

[wgresshoff]

I was following the recommendation from the docs. And it's really simple to change to a different Node.js version if there are problems with the one in use. And as I don't have any expertise regarding Node.js I stick to the ways I know...