[RFC] DistGit Container Image namespacing for Layered Image Build Service

[Adam Miller]

On Fri, Nov 13, 2015 at 5:14 PM, Brian C. Lane <bcl at redhat.com> wrote:
> On Tue, Nov 10, 2015 at 12:08:25PM -0600, Adam Miller wrote:
>> Hello all,
>>     In the Fedora 24 timeframe the Fedora Release Engineering group is
>> aiming to deliver the Layered Image Build Service[0] to allow Fedora
>> contributors to build containers images. In the first iteration of
>> this we're targeting Docker layered image support. Part of this will
>> be to allow Fedora contributors to maintain Dockerfiles much like we
>> maintain rpm spec files via DistGit.
>
> So you're talking about one docker file per package, right? Or are these
> going to pull from multiple packages and have the docker container be a
> different level of object? Or both?

Both, it's mostly at the discretion of the person attempting to
deliver something in a container. Some may be simple "I added httpd on
top of the base Fedora Docker image" and others might be "I put all of
ownCloud into a container so you can just run the whole thing with
this one command"

That being said, I'm not married to the concept. It was just the idea
going into it. If the general consensus among the community is "one
Dockerfile to one package" we could go that route.

>
> If you're talking about a 1:1 package:docker mapping then the only thing
> that makes sense to me is to have them live in the current system next
> to the .spec files. Anything else will easily introduce divergence from
> the rpm packages.

Absolutely, so far there has been the expectation that there will be
divergence because of the more "dynamic" nature of what containers
bring to the table.

>
> I also see that 'container packager' and 'rpm packager' are used in the
> build service page. I don't think these should be separate roles,
> everyone should be a packager. If you have one role working on container
> building for a package and another who only does rpm packaging we're
> going to, again, end up with things diverging.

I believe they will diverge naturally as time goes on. Also, I don' t
think everyone who has rpm packaging expertise is well versed in the
ways of Docker and vice versa.

>
> Some things I'd suggest (given I don't know the answers to the above
> questions):
>
> 1. All bits have to come from koji built rpms. No rebuilding of bits
> for docker, it just installs existing bits.

That is the plan, but configuration can take place inside the context
of the container image build process to allow for single-command
execution.

>
> 2. docker files for packages live in dist-git next to the package spec
> file.

We can, pending the agreement that's all we as a community/project use
Dockerfiles for. The original idea going in to this though is that we
could extend this to provide a more full featured solution for
services that would need more than one package. Even simple things
like httpd modules (mod_wsgi, mod_php, etc) would technically ship
more rpms than they produce in the docker image.

Also in the distant future (out of scope for the original offering),
we'd like to look at delivering multi-container apps via Nulecule[0]
specifications.

>
> 3. Any meta-containers collecting using packages are also an rpm
> package, following whatever naming convention gets decided on.
> fedora-docker-foo would make sense to me.

I'm not sure I follow what you mean here, why would something that
only comes as a Dockerfile also be a rpm?

>
> 4. package level docker files are maintained by the same people who maintain
> the package.
>

This certainly makes sense if we end up going the package:container 1:1 route.

-AdamM

[0] - https://github.com/projectatomic/nulecule

> --
> Brian C. Lane | Anaconda Team | IRC: bcl #anaconda | Port Orchard, WA (PST8PDT)
> --
> devel mailing list
> devel at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/devel
> Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct