Story #13794

Build Docker images without requiring Docker on client

Added by Peter Amstutz 5 months ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Assigned To:
-
Category:
-
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Story points:
-

Description

Web-only users do not have access to Docker on the client (in addition, some shell users don't have access to Docker for security reasons, for example visitors to cloud.curoverse.com). Ther should be a mechanism to submit a request to build a Docker image for use in Arvados.

Possible solutions:

Unprivileged build inside a normal container request

For building images, here is a blog post which outlines how to do it with nested unprivileged containers, which is described as an "epic yak shave".

This seems like it would require quite a lot of tooling development.

Special container request

Special format container request recognized by crunch-run which executes "docker build" (instead of docker run) and produces the image collection as output.

Dedicated docker builder service

New microservice with API to request "build image".

Use external build service

For example, quay.io, then pull the resulting image (#11724). Requires integrating with external service(s) so would be harder to fully automate compared to Arvados-based solutions.


Related issues

Related to Arvados - Story #11724: Pull Docker images without requiring Docker on clientNew

History

#1 Updated by Peter Amstutz 5 months ago

  • Status changed from New to In Progress

#2 Updated by Peter Amstutz 5 months ago

  • Description updated (diff)
  • Status changed from In Progress to New

#3 Updated by Peter Amstutz 5 months ago

  • Related to Story #11724: Pull Docker images without requiring Docker on client added

#4 Updated by Peter Amstutz 5 months ago

  • Tracker changed from Bug to Feature

#5 Updated by Peter Amstutz 5 months ago

  • Tracker changed from Feature to Story

Also available in: Atom PDF