https://pantsbuild.org/ logo
Join Slack
Powered by
A stupid question, can one push a docker registry ...
# general
a
A stupid question, can one push a docker registry that's marked skip_push? There are images that engineers should not be able to push, but it would be nice to have them in the same repo, packaged in the same way.
h
I’ll let others speak to Pants capability, but would recommend consider handling this at the registry with permissions controls. We do that with our artifact storage system so that only the proper people can store things; not just folks who happen to know the right commands.
a
I have permissions set on the repo, but I'd like the build not to fail to publish if I do 
pants publish ::
from local.
I could just push that image manually from CI, but wondered if there were a neater way
c
if the config is in 
pants.toml
you could override it in 
pants.ci.toml
for instance if you want to enable pushing from CI. If it’s in a BUILD file, you can leverage 
env()
something like 
docker_image(skip_push=bool(int(env("MY_FLAG", "1"))))
a
That's fair. I could overwrite the registry config in pants.ci.toml
Good shout!
👍 1
c
actually, I think ther’s env support for values in the 
pants.toml
as well…
a
There is, but I found it a bit funky. The straight replacement is neater I think, Easier to grok when I break it again
c
fair enough 🙂
h
should not be able to push
I was going off this. Even with the solution above, the person who should not be able to push can easily inspect the build file and figure out how to push.
👍 1
a
It was good advice!
I think I can't have two docker registries with the same address? That makes this hard again. https://github.com/bobthemighty/pants-docker-registry-collision shows the problem. I'd like for the image "should-push" to push, but the other image to not. If i change the address of the other registry, it works as expected, so I'm guessing the address is used to work out what to do with the images. I might go take a look at the docker backend to see if it's easily fixable.
Copy code
7:16:30.90 [INFO] Completed: Building docker image <http://12345679123.dkr.ecr.us-east-1.amazonaws.com/no-push:latest|12345679123.dkr.ecr.us-east-1.amazonaws.com/no-push:latest>
17:16:30.90 [INFO] Packaged no-push.docker-info.json
17:16:30.91 [INFO] Completed: Building docker image <http://12345679123.dkr.ecr.us-east-1.amazonaws.com/should-push-dev:latest|12345679123.dkr.ecr.us-east-1.amazonaws.com/should-push-dev:latest>
17:16:30.91 [INFO] Packaged should-push.docker-info.json

- <http://12345679123.dkr.ecr.us-east-1.amazonaws.com/no-push:latest|12345679123.dkr.ecr.us-east-1.amazonaws.com/no-push:latest> skipped (by `skip_push` on registry @prod).
- <http://12345679123.dkr.ecr.us-east-1.amazonaws.com/should-push-dev:latest|12345679123.dkr.ecr.us-east-1.amazonaws.com/should-push-dev:latest> skipped (by `skip_push` on registry @prod).
Plausibly, I should use a target filter here instead.
Yep, that works - add a tag to the target, disable In pants.toml, re-enable in pants.ci.toml, use a single registry for both.
c
oh, there’s likely some assumption that the registry address is unique… don’t mind if there’s an issue filed for that.
a
Filed, but I think my use-case is better handled with a tag, because I don't actually want to build an image that i'm not going to use.
👍 1
2 Views
Open in Slack
PreviousNext
Powered by