HelpFIT
Go to navigation

Building Images

Using GitLab CI, it is possible to automatically build container (OCI) images and upload them to the local GitLab Container Registry.

For building images, we recommend using buildah with the image ict/images/buildah, see Recommended Approach.

We have prepared the image ict/images/buildah, which includes the buildah tool and performs some steps for you automatically. It is also continuously updated, and the ICT department maintains fixes for potential issues between updates.

Example usage in .gitlab-ci.yml:

build:
  image: $CI_REGISTRY/ict/images/buildah:latest  1
  variables:
    IMAGE_TAG: my-image:latest  2
  script:
    - buildah build --tag $IMAGE_TAG -f Containerfile  3
    - buildah push $IMAGE_TAG $CI_REGISTRY_IMAGE/$IMAGE_TAG  4
  1. Alpine Linux with a preconfigured buildah tool that sets up the environment[1] and logs you into $CI_REGISTRY.
  2. The name of your new image.
  3. Command that builds your image according to the definition in the Containerfile. If you use a Dockerfile, this argument can be omitted.
  4. Command that pushes the image to the current project’s Container Registry.

Example Containerfile:

# Create from Docker Hub image alpine:v3.23.
# This gets overridden when using the 'buildah --from' argument
FROM alpine:3.23

# Install ca-certificates & curl
RUN apk update && apk add ca-certificates curl

# Set TimeZone variable to Europe/Prague
ENV TZ='Europe/Prague'

# Set EU/Prague as localtime
RUN ln -sf /usr/share/zoneinfo/Europe/Prague /etc/localtime

General Approach

The general approach (without using the buildah image above) is as follows:

  1. Install the buildah, fuse-overlayfs, and netavark packages (Alpine does not install network and filesystem drivers by default to minimize size).
  2. Set the environment variable BUILDAH_ISOLATION=chroot.[2]
  3. Log in to the GitLab registry: buildah login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY.
    1. If the image is built using an image from Docker Hub and the project belongs to a group, also log in to the GitLab Dependency Proxy:
      buildah login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_DEPENDENCY_PROXY_SERVER.
  4. Build the image, for example: buildah build --tag pkg:stable; when using the Dependency Proxy, you can add the --from argument.
  5. Upload the image to the Registry: buildah push pkg:stable $CI_REGISTRY_IMAGE/pkg:stable.

Tips

Running a Command Inside an Image

If you need to "run" an image within a pipeline (i.e., create a container from it and execute a command inside), for example to verify functionality, do the following:

ctr=$(buildah from $IMAGE_TAG)
buildah run $ctr -- command arg1 arg2 argn
  1. export BUILDAH_ISOLATION="chroot" ↩
  2. Applies to Alpine Linux. Debian/Ubuntu do not require this step. ↩