AWS: Building multi-arch Alpine images

devops/aws/pipeline/override-stages.yml

@@ -30,27 +30,21 @@ aws-containerize:
   stage: containerize
   needs: ['compile-and-unit-test']
   script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+    - $(aws ecr get-login --no-include-email --region $AWS_ECR_REGION)
+    - docker buildx create --driver docker-container --use
+    - docker buildx inspect --bootstrap
     - |
       if [ -z $AWS_BUILDER_DOCKERFILE_PATH ] && [ -z $AWS_RUNTIME_DOCKERFILE_PATH ]; then
         echo Building BUILD_DIR/Dockerfile container
-        docker build  -f $BUILD_DIR/Dockerfile -t $LOCAL_IMAGE_TAG .;
+        docker buildx build --platform linux/arm64/v8,linux/amd64 --pull --push -f $BUILD_DIR/Dockerfile -t $LOCAL_IMAGE_TAG -t $AWS_IMAGE_TAG_BASE:$CI_COMMIT_SHA -t $AWS_IMAGE_TAG_BASE:latest .;
       else
         echo Building BUILDER->RUNTIME containers;
-        docker build -t builder:latest --file $AWS_BUILDER_DOCKERFILE_PATH .;
-        docker build -t $LOCAL_IMAGE_TAG --file $AWS_RUNTIME_DOCKERFILE_PATH --build-arg docker_builder_image=builder .;
+        docker buildx build --platform linux/arm64/v8,linux/amd64 --pull --push -t $LOCAL_IMAGE_TAG -t $AWS_IMAGE_TAG_BASE:$CI_COMMIT_SHA -t $AWS_IMAGE_TAG_BASE:latest --file $AWS_RUNTIME_DOCKERFILE_PATH --build-arg docker_builder_image=builder .;
       fi
 
-    # Push to the local container registry
     - export PUSH_ENDPOINT_ECR_TAG=`echo push_endpoint.${CI_COMMIT_SHA} | cut -c 1-120`
     - export PUSH_ENDPOINT_IMAGE=${AWS_IMAGE_TAG_BASE}:${PUSH_ENDPOINT_ECR_TAG}
-    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
-    - docker push $LOCAL_IMAGE_TAG
-    # Push to Amazon's container registry
-    - $(aws ecr get-login --no-include-email --region $AWS_ECR_REGION)
-    - docker tag $LOCAL_IMAGE_TAG $AWS_IMAGE_TAG_BASE:$CI_COMMIT_SHA
-    - docker tag $LOCAL_IMAGE_TAG $AWS_IMAGE_TAG_BASE:latest
-    - docker push $AWS_IMAGE_TAG_BASE:$CI_COMMIT_SHA
-    - docker push $AWS_IMAGE_TAG_BASE:latest
     - export INTEGRATION_TEST_SOURCE_DIR_AWS=$(pwd)/testing/notification-test-aws
     - $INTEGRATION_TEST_SOURCE_DIR_AWS/build-aws/build_push_endpoint_image.sh
   only:

provider/notification-aws/build-aws/Dockerfile

@@ -13,16 +13,21 @@
 # limitations under the License.
 
 # https://docs.spring.io/spring-boot/docs/current/reference/html/deployment.html
-FROM amazoncorretto:17
+FROM registry.repo.osdu.aws/amazoncorretto:17-alpine
+
+RUN apk update && \
+    apk add --no-cache \
+    bash \
+    curl \
+    shadow \
+    && \
+    /usr/sbin/groupadd -g 10001 -r appgroup && \
+    /usr/sbin/useradd -M -g 10001 -r -u 10001 appuser
 
 ARG JAR_FILE=provider/notification-aws/target/*spring-boot.jar
 # Harcoding this value since Notification-core requires this variable. AWS does not use it. Might change in future
 ENV ENVIRONMENT=DEV
 
-RUN yum update -y && yum install -y shadow-utils \
-    && groupadd -g 10001 -r appgroup \
-    && useradd -M -g 10001 -r -u 10001 appuser
-
 WORKDIR /
 COPY ${JAR_FILE} app.jar
 COPY /provider/notification-aws/build-aws/entrypoint.sh /entrypoint.sh

provider/notification-aws/build-aws/buildspec.yaml

@@ -81,12 +81,10 @@ phases:
       - echo "--Copying Helm Charts to ${OUTPUT_DIR:-dist}--"
       - rsync -r devops/aws/* "${OUTPUT_DIR:-dist}"
 
-      - echo "Building docker image..."
-      - docker build -f provider/notification-aws/build-aws/Dockerfile -t ${ECR_IMAGE} .
-      - docker tag  ${ECR_IMAGE} ${ECR_IMAGE_BRANCH_LATEST}
-      - echo "Pushing docker image..."
-      - docker push ${ECR_IMAGE}
-      - docker push ${ECR_IMAGE_BRANCH_LATEST}
+      - echo "Build and push docker image..."
+      - docker buildx create --driver docker-container --use
+      - docker buildx inspect --bootstrap
+      - docker buildx build --platform linux/arm64/v8,linux/amd64 --pull --push -f provider/notification-aws/build-aws/Dockerfile -t ${ECR_IMAGE} -t ${ECR_IMAGE_BRANCH_LATEST} .
 
       - echo "Generate build-info.json"
       - |

testing/notification-test-aws/build-aws/build_push_endpoint_image.sh

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-(cd $INTEGRATION_TEST_SOURCE_DIR_AWS/build-aws/push-endpoint && docker build -t $PUSH_ENDPOINT_IMAGE -f Dockerfile --no-cache . && docker push $PUSH_ENDPOINT_IMAGE)
+(cd $INTEGRATION_TEST_SOURCE_DIR_AWS/build-aws/push-endpoint && docker buildx build --platform linux/arm64/v8,linux/amd64 --push -t $PUSH_ENDPOINT_IMAGE -f Dockerfile --no-cache .)