Build and publish ARA API server container images

[dmsimard]

What component is this about ?

ARA API Server

What is the idea ?

The ARA API server is a good candidate for living in a container since the state is kept in a database.
I've successfully tested a simple container image built with buildah and podman, the script can be found here: https://review.opendev.org/#/c/687905/3/contrib/containers/ara-api-container-fedora.sh

It would be useful and convenient to users if we'd build and publish supported images.
Publishing images is also a dependency if we eventually want to provide tooling to deploy the API server on top Kubernetes or OpenShift.

[dmsimard]

After a few iterations, I've landed a first shot at this: https://ara.readthedocs.io/en/latest/container-images.html

This takes care of how images are built -- I've published a first set of images manually to https://hub.docker.com/repository/docker/recordsansible/ara-api and we can start publishing images automatically after every merge soon.

[zbindenren]

The images do not work with docker:

docker pull recordsansible/ara-api:latest
Error response from daemon: mediaType in manifest should be 'application/vnd.docker.distribution.manifest.v2+json' not ''

I was wondering why ybovard/ara-api had more downolads, now I know why. Docker pull works.

[dmsimard]

Hi @zbindenren and thanks for reporting the issue.

The official project images started being published by the project literally just 8 days ago and haven't been broadly advertised yet so I wouldn't place much importance on the number of downloads.

We currently build the images with buildah and run them with podman as specified in the documentation: https://ara.readthedocs.io/en/latest/container-images.html

I was hoping that docker would just work as podman is a substitute but it doesn't seem to be the case. I'll investigate to see if we can fix the error.

[zbindenren]

@dmsimard thanks for the quick response. I think if it is not working with docker, people are not going to use it and it is probably not working in k8s.

[dmsimard]

@dmsimard thanks for the quick response. I think if it is not working with docker, people are not going to use it and it is probably not working in k8s.

I appreciate the concern but the project publishes images for convenience and we encourage users to build their own images for production use, even if just for security and auditing best practices.

I was curious about your issue but it doesn't look like I am able to reproduce it in my environment:

[root@dev-instance ~]# docker run --name api-server --detach --tty --volume ~/.ara/server:/opt/ara:z -p 8000:8000 docker.io/recordsansible/ara-api:latest
Unable to find image 'recordsansible/ara-api:latest' locally
latest: Pulling from recordsansible/ara-api
3088721d7dbf: Pull complete 
468b41f3487f: Pull complete 
Digest: sha256:09a27726a7cd7906a3470df25176b0db6730ea6d3cf09aefed6c25607039ccd3
Status: Downloaded newer image for recordsansible/ara-api:latest
5268e50c8cdca2f76945c5b31841ad6d2f1aaebff4f28b6c7283d1d2a74c9eb8

[root@dev-instance ~]# docker ps
CONTAINER ID        IMAGE                           COMMAND                  CREATED             STATUS              PORTS                    NAMES
5268e50c8cdc        recordsansible/ara-api:latest   "bash -c '/usr/local…"   6 seconds ago       Up 3 seconds        0.0.0.0:8000->8000/tcp   api-server

[root@dev-instance ~]# curl 127.0.0.1:8000/api/v1/ |python3 -m json.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   379  100   379    0     0   2429      0 --:--:-- --:--:-- --:--:--  2429
{
    "labels": "http://127.0.0.1:8000/api/v1/labels",
    "playbooks": "http://127.0.0.1:8000/api/v1/playbooks",
    "plays": "http://127.0.0.1:8000/api/v1/plays",
    "tasks": "http://127.0.0.1:8000/api/v1/tasks",
    "hosts": "http://127.0.0.1:8000/api/v1/hosts",
    "results": "http://127.0.0.1:8000/api/v1/results",
    "files": "http://127.0.0.1:8000/api/v1/files",
    "records": "http://127.0.0.1:8000/api/v1/records"
}

[root@dev-instance ~]# docker logs -f api-server
[ara] Using settings file: /opt/ara/settings.yaml
Operations to perform:
  Apply all migrations: admin, api, auth, contenttypes, db, sessions
Running migrations:
  Applying contenttypes.0001_initial... OK
  Applying auth.0001_initial... OK
  Applying admin.0001_initial... OK
  Applying admin.0002_logentry_remove_auto_add... OK
  Applying admin.0003_logentry_add_action_flag_choices... OK
  Applying api.0001_initial... OK
  Applying api.0002_remove_host_alias... OK
  Applying api.0003_add_missing_result_properties... OK
  Applying api.0004_duration_in_database... OK
  Applying api.0005_unique_label_names... OK
  Applying contenttypes.0002_remove_content_type_name... OK
  Applying auth.0002_alter_permission_name_max_length... OK
  Applying auth.0003_alter_user_email_max_length... OK
  Applying auth.0004_alter_user_username_opts... OK
  Applying auth.0005_alter_user_last_login_null... OK
  Applying auth.0006_require_contenttypes_0002... OK
  Applying auth.0007_alter_validators_add_error_messages... OK
  Applying auth.0008_alter_user_username_max_length... OK
  Applying auth.0009_alter_user_last_name_max_length... OK
  Applying auth.0010_alter_group_name_max_length... OK
  Applying auth.0011_update_proxy_permissions... OK
  Applying db.0001_initial... OK
  Applying sessions.0001_initial... OK
[2020-05-09 18:15:02 +0000] [1] [INFO] Starting gunicorn 20.0.4
[2020-05-09 18:15:02 +0000] [1] [INFO] Listening at: http://0.0.0.0:8000 (1)
[2020-05-09 18:15:02 +0000] [1] [INFO] Using worker: sync
[2020-05-09 18:15:02 +0000] [9] [INFO] Booting worker with pid: 9
[2020-05-09 18:15:02 +0000] [10] [INFO] Booting worker with pid: 10
[2020-05-09 18:15:02 +0000] [11] [INFO] Booting worker with pid: 11
[2020-05-09 18:15:02 +0000] [12] [INFO] Booting worker with pid: 12
172.17.0.1 - - [09/May/2020:18:15:31 +0000] "GET /api/v1/ HTTP/1.1" 200 379 "-" "curl/7.66.0"

[root@dev-instance ~]# rpm -qa |grep docker
docker-ce-cli-19.03.8-3.fc31.x86_64
docker-ce-19.03.8-3.fc31.x86_64

From googling a bit, it looks like Docker took a while to add support for OCI-standard container images (see this issue for example) so I suspect that if you don't have a recent enough version of Docker, you might run into issues.

I'm going to close this issue because the goal of it has been accomplished, please open a new issue about Docker if you are able to reproduce it.