swissquote / carnotzet

Modular and Re-usable Docker Environments using Maven
https://swissquote.github.io/carnotzet/
Apache License 2.0
49 stars 16 forks source link

SWEP-415: make network docker-compose unique #170

Closed sonthanh closed 1 year ago

sonthanh commented 1 year ago

We make network docker-compose unique by using sha256 of docker-compose file path when generating network name. The reason is to avoid 2 jenkins builds of the same project (e.g. 2 PRs) can have network collision.

Avoid network name is too long with full sha256 --> take only 48-bit hash prefix (first 12 characters) of sha256 digest https://www.bluebill.net/hash_collisions.html https://developers.google.com/safe-browsing/v4/urls-hashing

mryan43 commented 1 year ago

I think there is a better solution to fix potential collision issues in jenkins builds that can share docker hosts.

1) Jenkins builds can already use the BUILD_ID environment variable and use it inside the instanceId of the carnotzet, which prevents all collisions between the 2 builds sandboxes. This could be made automatic by changing how the default instanceId is computed (look at the env variables to resolve the default value if the user did not explicitly set the instanceId).

2) Using a hash of the resource folder seems more arbitrary makes it harder to debug using docker directly. Before this change, a "docker network ls" showed the network names as {instance_id}_carnotzet which allows users to identify which networks were created by a carnotzet and link it to the instanceId.

sonthanh commented 1 year ago

@mryan43 thanks for feedback.

TLTR; this small improvement is a safe guard feature for Jenskin build collision while still keeping the docker debug user friendly. More details as below:

  1. This is a good point. I do not think about this yet. I will look into it.
  2. This point is not fully correct. I still kept the original prefix Old network name: {instance_id}_carnotzet New network name: {instance_id}_carnotzet_12characterSHA

The reason we use resource folder since it will be different from each build on Jenkins but it will be the same on your local.

mryan43 commented 1 year ago

I forgot to mention... if the instance ID is a long string, you can exceed the max length for the docker network name, it could be truncated before the start of the hash part and you'd have collisions again.

https://stackoverflow.com/questions/53449304/what-can-be-the-max-length-of-a-docker-compose-network-name