Create fat docker image

[hugobuddel]

It is useful for speed reasons to create a docker image that has all relevant conda packages already fetched so they can be installed quickly.

Packages can be downloaded without being installed with the --download-only flag: https://stackoverflow.com/questions/32956583/how-do-i-download-anaconda-packages-without-installing-them

[hugobuddel]

Some success, see https://github.com/hugobuddel/docker-conda-builder/tree/fatbuilder

About secrets:

• Fetching packages from the OmegaCEN conda repository requires the CONDA_DOWNLOAD_KEY to be used. This poses two problems:
  • The key should not be stored in the Dockerfile.
  • The key should not be stored in the image.
• Secrets in the Dockerfile is something experemintal, and requires
  • The use of buildkit.
  • This line at the start of the docker file: # syntax=docker/dockerfile:experimental.
  • A file with the secret, see the readme.
  • Some intricate commands to expose the secret to the Docker builder using --mount.
  • Edit: see https://stackoverflow.com/questions/45405212/safe-way-to-use-build-time-argument-in-docker/51921954#51921954
• To prevent the secret in the image requires
  • To never add the channel to the conda channels, but instead specify it when used.
  • It has not been verified whether this is indeed enough, or whether conda keeps the channel information around anyway.

More notes:

• The Dockerfile currently simply installs all the packages instead of just downloading them because
  • It still takes quite a while to install everything even if the packages are already downloaded.
  • Just downloading them would require adding the channel to conda at some point, because conda cannot find the downloaded packages if it doesn't have access to the channel.
• It currently installs astropy instead of pyfits.