Implement mozilla-services/dockerflow

[jwhitlock]

https://github.com/mozilla-services/dockerflow is a specification for automated building, testing and publishing of docker web application images that comply to a common set of behaviors.

Tracked in Jira:OSS-278

Things we do already (fix if I'm wrong):

• Trigger builds through pull requests and merge to the main branch.
• Accept configuration through environment variables.
• Send text logs to stdout or stderr.
• Serve its own static content.
• Dockerfile has both ENTRYPOINT and CMD instructions to start the service.
• Following most of the Guidelines for Building a Container, with maybe bonus points for multi-stage builds.

Changes to make:

• [x] - Listen at environment variable $PORT (8000 recommended) rather than hard-coded port 80
• [x] - Create a JSON version object at /app/version.json
• [x] - Respond to /__version__ with the contents of /app/version.json.
• [x] - Respond to /__heartbeat__ with a HTTP 200 or 5xx on error. This should check backing services like a database for connectivity and may respond with the status of backing services and application components as a JSON payload.
• [x] - Respond to /__lbheartbeat__ with an HTTP 200. This is for load balancer checks and should not check backing services (close to existing /health endpoint)
• [x] - In Dockerfile, create app group and user, GID 10001 and UID 10001, set as user (currently root)

Optional changes:

• [x] Output to stdout in mozlog JSON schema. There are ways to use this in production but a friendlier human format in development.

Maybe changes to make, need to ask @duallain or @sciurus :

• [ ] Dockerflow says containers should be published to Docker Hub. We publish to Amazon ECR. Do we need to change docker repositories?
• [ ] Dockerflow says CircleCI or Taskcluster are supported for building and testing. We use Github Actions. Do we need to change CI?

[jwhitlock]

Tracking the allows tools questions with PRs, as suggested by CONTRIBUTE.md:

• https://github.com/mozilla-services/Dockerflow/pull/62 - Allow Amazon ECR as Docker repository
• https://github.com/mozilla-services/Dockerflow/pull/63 - Support Github Actions as builder

[jwhitlock]

The new endpoints are working in stage:

• /__version__ returns data written at build time. Pretty-printed version:

  {
   "commit": "a0756d59a5d2bf06739725f16cd5bbb66ae96b14",
   "version": "refs/heads/main",
   "image_tag": "stg-a0756d5",
   "source": "https://github.com/mozilla-it/ctms-api",
   "build": "https://github.com/mozilla-it/ctms-api/actions/runs/655191335"
  }

• /__heartbeat__ returns if the backing services are available. Pretty-printed version:

  {
    "database": {
      "up": true,
      "time_ms": 3
    }
  }

• /__lbheartbeat__ returns whenever the service is up. Pretty-printed version:

  {
    "status": "OK"
  }

[jwhitlock]

I'm tracking mozlog in issue #106, and we'll handle production logging next sprint. I'll keep an eye on the suggestions for Dockerflow, in case we need to change our build CI or Docker repository.