Skip to content

Commit 95be393

Browse files
kpumukcodex
kpumuk
and
codex
committed
THRIFT-5000: Restore Docker Official Image packaging
Client: docker Co-Authored-By: OpenAI Codex (GPT-5.4) <codex@openai.com>
1 parent d47d1b9 commit 95be393

14 files changed

Lines changed: 789 additions & 0 deletions

‎.github/workflows/docker.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: Docker Official Image
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
paths:
7+
- 'docker/**'
8+
- '.github/workflows/docker.yml'
9+
- 'doc/ReleaseManagement.md'
10+
pull_request:
11+
paths:
12+
- 'docker/**'
13+
- '.github/workflows/docker.yml'
14+
- 'doc/ReleaseManagement.md'
15+
workflow_dispatch:
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.ref }}
19+
cancel-in-progress: true
20+
21+
permissions:
22+
contents: read
23+
24+
jobs:
25+
bashbrew:
26+
runs-on: ubuntu-22.04
27+
steps:
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
29+
30+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
31+
with:
32+
go-version: stable
33+
cache: false
34+
35+
- name: Install Bashbrew
36+
run: |
37+
set -eux
38+
GOBIN="$PWD/docker/tmp/bin" go install github.com/docker-library/bashbrew/cmd/bashbrew@v0.1.14
39+
echo "$PWD/docker/tmp/bin" >> "$GITHUB_PATH"
40+
41+
- name: Validate Bashbrew manifest
42+
run: |
43+
set -eux
44+
mkdir -p docker/tmp/bashbrew-library
45+
(cd docker && GIT_COMMIT="$(git rev-parse HEAD)" ./generate-stackbrew-library.sh) > docker/tmp/bashbrew-library/thrift
46+
BASHBREW_LIBRARY="$PWD/docker/tmp/bashbrew-library" bashbrew cat thrift >/dev/null
47+
BASHBREW_LIBRARY="$PWD/docker/tmp/bashbrew-library" bashbrew list --build-order --uniq thrift >/dev/null
48+
49+
docker:
50+
name: Docker (${{ matrix.platform }})
51+
runs-on: ${{ matrix.runner }}
52+
strategy:
53+
fail-fast: false
54+
matrix:
55+
include:
56+
- platform: linux/amd64
57+
runner: ubuntu-22.04
58+
- platform: linux/arm64
59+
runner: ubuntu-24.04-arm
60+
steps:
61+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
62+
63+
- name: Verify Docker Buildx
64+
run: docker buildx version
65+
66+
- name: Build and test Docker images
67+
timeout-minutes: 90
68+
run: docker/test.sh

‎doc/ReleaseManagement.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,20 @@ Voting on the development mailing list provides additional benefits (wisdom from
370370
371371
1. Update the web site content to include the new release. The repository is located at https://github.com/apache/thrift-website and there are plenty of instructions how to update both staging and live web site. With regard to the release, its actually quite simple: check out the main branch and edit two lines in _config.yml, then commit. The build bot will update staging. After checking everything is right, simply fast-forward "asf-site" to "asf-staging" and push, then production site will automatically get updated as well
372372
373+
1. Update the Docker Official Image packaging. Docker images are convenience artifacts built from the voted ASF source release; they are not ASF release artifacts and must not block the source release announcement if Docker Library review is delayed. Submit Docker updates only after the vote has passed, release artifacts have been promoted, and the web site/download page has been updated.
374+
375+
The Docker Official Image library tracks the two latest full Apache Thrift releases. Initial restored Docker image maintenance starts with the current release only; older releases are not backfilled. `latest` and unqualified OS aliases move according to the newest retained release and the explicit base metadata in `docker/versions.json`.
376+
377+
```bash
378+
thrift$ cd docker
379+
thrift/docker$ ./update.sh 1.0.0
380+
thrift/docker$ ./test.sh --all-platforms
381+
```
382+
383+
Commit and push the Docker packaging update to Apache Thrift before generating the Docker Library manifest. Then run `./generate-official-images-library.sh /path/to/official-images/library/thrift` from `thrift/docker`; Docker Library manifests are generated artifacts and are not checked into this repository.
384+
385+
See [`docker/README.md`](../docker/README.md) for the detailed Docker Official Images workflow. Include Docker image availability in the announcement only if the Docker tags have already landed; otherwise follow up after Docker Official Images publishes them.
386+
373387
1. Make an announcement on the dev@ and user@ mailing lists of the release. There's no template to follow, but you can point folks to the official web site at https://thrift.apache.org, and to the GitHub site at https://github.org/apache.thrift.
374388

375389
### Post-Release

‎docker/.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
tmp/

‎docker/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/tmp/

‎docker/0.22.0/Dockerfile‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
FROM debian:trixie AS builder
2+
3+
ARG THRIFT_VERSION=0.22.0
4+
ARG THRIFT_SOURCE_URL=https://archive.apache.org/dist/thrift/0.22.0/thrift-0.22.0.tar.gz
5+
ARG THRIFT_SOURCE_SHA256=794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5
6+
ARG THRIFT_SOURCE_SIGNER=8CD87F186F06E958EFCA963D76BD340FC4B75865
7+
8+
RUN set -eux; \
9+
apt-get update; \
10+
apt-get install -y --no-install-recommends \
11+
bison \
12+
ca-certificates \
13+
cmake \
14+
curl \
15+
flex \
16+
g++ \
17+
gnupg \
18+
make \
19+
; \
20+
rm -rf /var/lib/apt/lists/*
21+
22+
WORKDIR /usr/src
23+
24+
RUN set -eux; \
25+
curl -fL -o thrift.tar.gz "$THRIFT_SOURCE_URL"; \
26+
curl -fL -o thrift.tar.gz.asc "$THRIFT_SOURCE_URL.asc"; \
27+
curl -fL -o thrift-KEYS https://downloads.apache.org/thrift/KEYS; \
28+
echo "$THRIFT_SOURCE_SHA256 *thrift.tar.gz" | sha256sum -c -; \
29+
export GNUPGHOME="$(mktemp -d)"; \
30+
gpg --batch --import thrift-KEYS; \
31+
gpg --batch --status-fd 1 --verify thrift.tar.gz.asc thrift.tar.gz > gpg.status; \
32+
grep -F "[GNUPG:] VALIDSIG $THRIFT_SOURCE_SIGNER " gpg.status; \
33+
gpgconf --kill all; \
34+
rm -rf "$GNUPGHOME"; \
35+
mkdir thrift; \
36+
tar -xzf thrift.tar.gz -C thrift --strip-components=1; \
37+
rm thrift.tar.gz thrift.tar.gz.asc thrift-KEYS gpg.status
38+
39+
RUN set -eux; \
40+
cmake -S thrift -B build \
41+
-DCMAKE_BUILD_TYPE=Release \
42+
-DBUILD_COMPILER=ON \
43+
-DBUILD_LIBRARIES=OFF \
44+
-DBUILD_TESTING=OFF \
45+
-DBUILD_TUTORIALS=OFF; \
46+
cmake --build build --target thrift-compiler -j "$(nproc)"; \
47+
cmake --install build --prefix /opt/thrift
48+
49+
FROM debian:trixie-slim
50+
51+
ARG THRIFT_VERSION=0.22.0
52+
53+
LABEL org.opencontainers.image.title="Apache Thrift Compiler" \
54+
org.opencontainers.image.version="$THRIFT_VERSION" \
55+
org.opencontainers.image.source="https://github.com/apache/thrift" \
56+
org.opencontainers.image.url="https://thrift.apache.org/" \
57+
org.opencontainers.image.licenses="Apache-2.0"
58+
59+
RUN set -eux; \
60+
apt-get update; \
61+
apt-get install -y --no-install-recommends libstdc++6; \
62+
rm -rf /var/lib/apt/lists/*
63+
64+
COPY --from=builder /opt/thrift/bin/thrift /usr/local/bin/thrift
65+
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
66+
COPY tests/smoke.thrift /tmp/smoke.thrift
67+
68+
RUN set -eux; \
69+
thrift --version | grep -F "$THRIFT_VERSION"; \
70+
mkdir -p /tmp/smoke-out; \
71+
thrift --gen json -o /tmp/smoke-out /tmp/smoke.thrift; \
72+
find /tmp/smoke-out -type f | grep -q .; \
73+
rm -rf /tmp/smoke.thrift /tmp/smoke-out
74+
75+
WORKDIR /data
76+
77+
ENTRYPOINT ["docker-entrypoint.sh"]
78+
CMD ["thrift"]

‎docker/0.22.0/Dockerfile.alpine‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
FROM alpine:3.23 AS builder
2+
3+
ARG THRIFT_VERSION=0.22.0
4+
ARG THRIFT_SOURCE_URL=https://archive.apache.org/dist/thrift/0.22.0/thrift-0.22.0.tar.gz
5+
ARG THRIFT_SOURCE_SHA256=794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5
6+
ARG THRIFT_SOURCE_SIGNER=8CD87F186F06E958EFCA963D76BD340FC4B75865
7+
8+
RUN set -eux; \
9+
apk add --no-cache \
10+
bison \
11+
build-base \
12+
ca-certificates \
13+
cmake \
14+
curl \
15+
flex \
16+
gnupg \
17+
; \
18+
update-ca-certificates
19+
20+
WORKDIR /usr/src
21+
22+
RUN set -eux; \
23+
curl -fL -o thrift.tar.gz "$THRIFT_SOURCE_URL"; \
24+
curl -fL -o thrift.tar.gz.asc "$THRIFT_SOURCE_URL.asc"; \
25+
curl -fL -o thrift-KEYS https://downloads.apache.org/thrift/KEYS; \
26+
echo "$THRIFT_SOURCE_SHA256 *thrift.tar.gz" | sha256sum -c -; \
27+
export GNUPGHOME="$(mktemp -d)"; \
28+
gpg --batch --import thrift-KEYS; \
29+
gpg --batch --status-fd 1 --verify thrift.tar.gz.asc thrift.tar.gz > gpg.status; \
30+
grep -F "[GNUPG:] VALIDSIG $THRIFT_SOURCE_SIGNER " gpg.status; \
31+
gpgconf --kill all; \
32+
rm -rf "$GNUPGHOME"; \
33+
mkdir thrift; \
34+
tar -xzf thrift.tar.gz -C thrift --strip-components=1; \
35+
rm thrift.tar.gz thrift.tar.gz.asc thrift-KEYS gpg.status
36+
37+
RUN set -eux; \
38+
cmake -S thrift -B build \
39+
-DCMAKE_BUILD_TYPE=Release \
40+
-DBUILD_COMPILER=ON \
41+
-DBUILD_LIBRARIES=OFF \
42+
-DBUILD_TESTING=OFF \
43+
-DBUILD_TUTORIALS=OFF; \
44+
cmake --build build --target thrift-compiler -j "$(nproc)"; \
45+
cmake --install build --prefix /opt/thrift
46+
47+
FROM alpine:3.23
48+
49+
ARG THRIFT_VERSION=0.22.0
50+
51+
LABEL org.opencontainers.image.title="Apache Thrift Compiler" \
52+
org.opencontainers.image.version="$THRIFT_VERSION" \
53+
org.opencontainers.image.source="https://github.com/apache/thrift" \
54+
org.opencontainers.image.url="https://thrift.apache.org/" \
55+
org.opencontainers.image.licenses="Apache-2.0"
56+
57+
RUN set -eux; \
58+
apk add --no-cache libstdc++
59+
60+
COPY --from=builder /opt/thrift/bin/thrift /usr/local/bin/thrift
61+
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
62+
COPY tests/smoke.thrift /tmp/smoke.thrift
63+
64+
RUN set -eux; \
65+
thrift --version | grep -F "$THRIFT_VERSION"; \
66+
mkdir -p /tmp/smoke-out; \
67+
thrift --gen json -o /tmp/smoke-out /tmp/smoke.thrift; \
68+
find /tmp/smoke-out -type f | grep -q .; \
69+
rm -rf /tmp/smoke.thrift /tmp/smoke-out
70+
71+
WORKDIR /data
72+
73+
ENTRYPOINT ["docker-entrypoint.sh"]
74+
CMD ["thrift"]

‎docker/README.md‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Apache Thrift Docker Official Image Packaging
2+
3+
This directory contains the packaging for the Apache Thrift compiler Docker Official Image.
4+
5+
The image is compiler-only. It contains the `thrift` compiler/code generator and the runtime libraries needed by that binary. It does not include language-specific Thrift runtime libraries or the contributor build images from `build/docker/*`.
6+
7+
Do not push images from this repository. Public images are built and published by Docker Official Images after review in `docker-library/official-images`.
8+
9+
## Usage
10+
11+
Generate code from the current project directory:
12+
13+
```console
14+
docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/data" thrift --gen py -o /data /data/service.thrift
15+
```
16+
17+
The `-u` flag prevents generated files in the bind mount from being owned by root.
18+
19+
Run the compiler version check:
20+
21+
```console
22+
docker run --rm thrift --version
23+
```
24+
25+
Use Alpine explicitly when you need the Alpine/musl variant:
26+
27+
```console
28+
docker pull thrift:0.22-alpine
29+
```
30+
31+
## Files
32+
33+
- `versions.json` records release artifact URLs, checksums, signer fingerprints, release dates, base versions, and maintenance state.
34+
- `0.22.0/Dockerfile` builds the Debian-based image for Thrift 0.22.0.
35+
- `0.22.0/Dockerfile.alpine` builds the Alpine-based image for Thrift 0.22.0.
36+
- `docker-entrypoint.sh` provides the CLI-friendly container entrypoint.
37+
- `tests/smoke.thrift` is the shared smoke-test fixture.
38+
- `generate-stackbrew-library.sh` prints Docker Library metadata for Bashbrew.
39+
- `generate-official-images-library.sh` writes that metadata to `tmp/` or to a local `docker-library/official-images` checkout.
40+
41+
## Updating for a Release
42+
43+
After the ASF release vote passes, release artifacts are promoted, and the website/download page is updated:
44+
45+
```console
46+
cd docker
47+
./update.sh 0.23.0
48+
./test.sh --all-platforms
49+
```
50+
51+
`update.sh` verifies the source tarball checksum and PGP signature, records the signer fingerprint, updates Dockerfile `ARG` values, and applies the two-latest-full-releases retention policy.
52+
53+
Set base versions explicitly if needed:
54+
55+
```console
56+
DEBIAN_VERSION=trixie ALPINE_VERSION=3.23 RELEASED_DATE=2025-05-14 ./update.sh 0.22.0
57+
```
58+
59+
The script does not scrape the Thrift website. `RELEASED_DATE` is informational metadata.
60+
61+
## Testing
62+
63+
Run native-platform tests:
64+
65+
```console
66+
cd docker
67+
./test.sh
68+
```
69+
70+
Run the supported platform matrix:
71+
72+
```console
73+
cd docker
74+
./test.sh --all-platforms
75+
```
76+
77+
The full local matrix uses Buildx for `linux/amd64` and `linux/arm64`; arm64 tests require QEMU/binfmt support on non-arm64 hosts. Apache CI runs separate native `amd64` and `arm64` jobs.
78+
79+
The tests build Debian and Alpine variants, verify the compiler version, exercise entrypoint behavior, generate JSON and Python output from `tests/smoke.thrift`, and check bind-mount output ownership on the native platform.
80+
81+
## Docker Official Images
82+
83+
Docker Official Images does not run the maintenance scripts in this directory. Its tooling reads `docker-library/official-images/library/thrift`, fetches each `GitCommit`, and builds the referenced `Directory` and `File` entries.
84+
85+
After the Docker packaging commit is on Apache Thrift `master`, generate the submit-ready manifest into `tmp/`:
86+
87+
```console
88+
./generate-official-images-library.sh
89+
```
90+
91+
Or write directly into a local `docker-library/official-images` checkout:
92+
93+
```console
94+
./generate-official-images-library.sh /path/to/official-images/library/thrift
95+
```
96+
97+
Docker Library manifests are generated artifacts; they are not checked into this repository.
98+
99+
Docker Hub documentation is maintained through `docker-library/docs`.
100+
101+
## Release Rules
102+
103+
- Only voted ASF releases may be used.
104+
- Do not publish release candidates, pre-releases, branch builds, nightlies, or continuous builds.
105+
- The Docker Official Image is a convenience artifact built from voted ASF source releases; it is not itself the ASF release artifact.
106+
- The Docker Official Image library tracks the two latest full Apache Thrift releases after Docker image maintenance is restored. Initial restoration starts with 0.22.0 only; 0.21.0 is not backfilled.
107+
- Older tags can remain pullable on Docker Hub after they are removed from the library file, but they are no longer rebuilt or maintained.

‎docker/docker-entrypoint.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/sh
2+
set -e
3+
4+
if [ "$#" -eq 0 ]; then
5+
set -- thrift
6+
elif [ "${1#-}" != "$1" ]; then
7+
set -- thrift "$@"
8+
fi
9+
10+
exec "$@"

0 commit comments

Comments
 (0)