Build the container image with ko instead of Docker #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "ci/ko-image"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The image job failed with
Unable to locate executable file: docker: therunner's job container has no Docker daemon and not even a docker CLI, so
buildx cannot run there under any configuration.
Switches the image build to ko, which assembles an OCI
image straight from Go source — no daemon, no privileges, no QEMU, and
cross-compilation instead of emulation.
linux/amd64only, as agreed.Verified locally before pushing: the image runs, carries the version and commit
ldflags, uses the nonroot user, keeps the binary on
PATHand defaults to therunsubcommand exactly like the Dockerfile image. Verified in CI on thisbranch:
testandimageare both green.Two consequences, both handled:
make ko-buildreproduces whatCI does, so the two cannot drift apart unnoticed.
HEALTHCHECKfield, so the compose files and the READMEsnippet declare the check themselves. The binary is on
PATHin both images,so the same command works either way.
Also changes when the image job runs: every branch builds, only main and tags
publish. Restricting the whole job to main is how the previous breakage got
through — it could not be seen until after the merge.
Still open, and the reason nothing is published yet: the repository secrets
REGISTRY_USERandREGISTRY_TOKEN(a token withwrite:package). Withoutthem the job builds and skips the push, so the pipeline stays green.
The image job died on 'Unable to locate executable file: docker' — the runner's job container has no Docker daemon and not even a docker CLI, so buildx cannot run there under any configuration. ko assembles an OCI image straight from Go source: no daemon, no privileges, no QEMU. Verified locally end to end — the image runs, carries the version and commit ldflags, uses the nonroot user and defaults to the run subcommand just like the Dockerfile one. Two consequences, both handled: * The Dockerfile stays as the local build path. 'make ko-build' reproduces what CI does, so the two cannot drift silently. * OCI images have no HEALTHCHECK field, so the compose files declare the check themselves. The binary is on PATH in both images, so the same command works either way. Architecture is amd64 only, as agreed.