chore(docker): include grpcurl in provider image#405
Conversation
The inventory operator exposes a gRPC API; bundling grpcurl allows probing it from inside the container, e.g. a liveness probe that restarts the pod when allocated resources exceed capacity. Install a pinned, checksum-verified release for both amd64 and arm64, since grpcurl is not available via apt. refs: akash-network/support#317
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe Dockerfile gains an Changesgrpcurl installation in Docker image
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
32-33: ⚡ Quick winHarden the download step against transient network failures.
curl -fsSLcan fail builds on temporary GitHub/DNS/network hiccups. Add retry and timeout flags to make image builds more reliable.Suggested patch
- curl -fsSL -o /tmp/grpcurl.tar.gz \ + curl -fL --retry 5 --retry-delay 2 --retry-connrefused --connect-timeout 10 --max-time 120 -o /tmp/grpcurl.tar.gz \ "https://github.com/fullstorydev/grpcurl/releases/download/v${GRPCURL_VERSION}/grpcurl_${GRPCURL_VERSION}_linux_${arch}.tar.gz"; \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 32 - 33, The curl command used to download the grpcurl tarball in the Dockerfile lacks resilience against transient network failures. Add retry and timeout flags to the curl command that downloads grpcurl to make the build process more robust. Specifically, add the `--retry` flag to automatically retry failed downloads on transient failures, and add timeout-related flags such as `--connect-timeout` and `--max-time` to prevent indefinite hangs. These flags should be added to the curl command parameters alongside the existing `-fsSL` flags in the grpcurl download step.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@Dockerfile`:
- Around line 32-33: The curl command used to download the grpcurl tarball in
the Dockerfile lacks resilience against transient network failures. Add retry
and timeout flags to the curl command that downloads grpcurl to make the build
process more robust. Specifically, add the `--retry` flag to automatically retry
failed downloads on transient failures, and add timeout-related flags such as
`--connect-timeout` and `--max-time` to prevent indefinite hangs. These flags
should be added to the curl command parameters alongside the existing `-fsSL`
flags in the grpcurl download step.
|
|
||
| # grpcurl is used to probe the inventory operator's gRPC API (e.g. from a | ||
| # liveness probe). It is not packaged in apt, so install a pinned release. | ||
| ENV GRPCURL_VERSION=1.9.3 |
| # liveness probe). It is not packaged in apt, so install a pinned release. | ||
| ENV GRPCURL_VERSION=1.9.3 | ||
| RUN set -eux; \ | ||
| case "$(dpkg --print-architecture)" in \ |
There was a problem hiding this comment.
lets hardcode checksums into RUN, there is no need to split them as well, sha256sum supports checksums format from github releases
There was a problem hiding this comment.
switched GRPCURL_VERSION to ARG (build-time only). On the checksums - to make sure I match what you have in mind: do you mean fetching grpcurl's upstream checksums.txt and verifying the downloaded archive against it, or just hardcoding the two lines verbatim and letting sha256sum -c match by filename? Dockerfile RUN can't use a shell heredoc, so I'd do it via printf. Any option works for me-just let me know which one you prefer.
Per review: GRPCURL_VERSION is only needed at build time, so make it an ARG rather than baking it into the image environment with ENV.
3 participants
Summary
Resolves akash-network/support#317.
The inventory operator exposes a gRPC API (
akash.inventory.v1.ClusterRPC). Bundlinggrpcurlin the provider image makes it possible to probe that API from inside the container - for example, a liveness probe that restarts the pod when allocated resources exceed allocatable.Change
grpcurlis not available via apt, so the Dockerfile installs a pinned release:v1.9.3.dpkg --print-architecture.grpcurlbinary is installed; the tarball is removed afterwards.grpcurl -versionruns at the end so the build fails fast if anything is wrong.Testing
Built the image locally (amd64) and confirmed the install step downloads, passes the checksum check, extracts the binary, and
grpcurl -versionreportsv1.9.3. The arm64 asset uses the official published checksum.refs: akash-network/support#317