Today I was thinking about the fresh dependency hell we created for ourselves with the base image requiring rebuilds in some cases.
How about we change from the unstable/stable thing to an independently versioned scheme?
Having a static version of the base image would solve the problem of base images not up to date on people's machines.
We could push merged versions to Docker Hub and PR versions to GHCR, so easy to switch to a preview for fast testing.
We should pin down the Payara version for the images independent from the main app, allowing us to do security updates much faster. We should have a build time script with an acceptance list for app vs image server version, so we detect early when forgetting to update the property.
A scheduled CI script might either only update the latest version with OS updates or we can create a matrix with commit ids to update (monorepo means we need to go to a certain place in commit history to update older versions).
What do y'all think?
I think I'm struggling a bit without examples. Ultimately we're talking about tags, right? What would some example tags look like?
Thx for putting it on the agenda!
Sure. The recording is here: https://harvard.zoom.us/rec/share/-e5CHUCBg7STDie4RF7dFx-YHB74pYQewg6hzKUAuNFBTrD_S7UvH0WrlvZ95erw.eVB72Eyc16Y_kcHE
See also #containers > tagging images with versions
With the upgrade to 6.2024.4 should we go for tags on the base image?
How about we use the Payara version included plus a suffix?
Like 6.2024.4-base1
Then we can increment on changes to the base image where no payara update is done
Should we talk about it tomorrow?
Let me try it out and see how it goes so we have something concrete to talk about
So now I have a workflow with the different versions going... Now I discovered I had some flaws in the image we currently tag as alpha. And the temurin 17-jre tag is probably moving to a new Ubuntu version, but our Dockerfiles are not compatible (yet). Maybe we need a way to override some stuff even for tagged releases when brewing the base image...
Yes, good point. Thanks for the investigation and for writing it up in that issue!
@Oliver Bertuch just a reminder to please link to the Bitnami example you found
"What if you depend on a specific revision of an image? For these scenarios, Bitnami also attaches a static (immutable) tag to each revision. In this example, the 6.4.3-debian-12-r10 tag refers to WordPress 6.4.3 revision 10, and using this tag ensures that users always get the same image every time."
Interesting. Thanks!
It seems to work for them, so why not inherit their good practice? :smiling_face:
Progress! I have files patching in place and already create better tags for the base images for v6.1, 6.2 and 6.3
Curious people can take a look at the patch files, or see some action output and see new tags on Docker Hub
BTW here's my plan how this could actually work:
So for now, I encoded quite a bit of things into the tags... Each tag has a version at the beginning, enabling expressing which feature set is usable. On the other hand, the scripts etc might not need changing when we update Payara or Java version... So I added that as a component in the tag, too.
In addition I added the OS flavor. So we can make OS upgrades without changing the other stuff. Or add more flavors, e.g. using Redhat UBI or whatever.
And last but not least there is the "rX" suffix (r = revision). These images will never be touched again after they have been created.
The revision will be increased every time we rebuild, obviously... When we update the version, it will start at r0 again
Version number change = functionality changes. Scripts are changed, software added/removed, etc etc
Revision changes = no functionality changes, only updates as minimal as possible
I'm no sure yet what I want as a base image tag for the application image. Maybe for local development it should be the base tag without a revision. In CI we probably should reference the exact revision for the sake of reproducible builds.
Do we need shorter tags, too? Like gdcc/base:0.9.1, pointing to a sensible default? Or do we want people to pin down versions?
Thinking about what happens when we merge a Payara update to develop. If we keep the version number for the base image unchanges, all of a sudden the Payara version changes. Which is back to square one, where unstable all of a sudden changes...
If we really want those shorter things, IMHO we'd need some automation to seriously fail CI jobs when we forget to increase the base image version if Payara, Java version or OS change.
@Philip Durbin this is probably something we could discuss Thursday
Some sanity check in a CI job that helps avoiding drift between base image version used in the application image and shipped by the actual base module is necessary anyway
The tags look jammy! Thanks, @Oliver Bertuch! :heart:
And, yes, let's discuss on Thursday (#containers > weekly meeting where all are welcome!).
I think I'm ok with "unstable" changing when we upgrade Payara. Of course, I might be missing something important.
To me we're really trying to support people who don't want to be on "unstable", who want to be on a tag like "6.4" or whatever.
Sure! But the base image is very different from the app image. I was thinking about using the app version for the base image back and forth, but it's probably not a good idea
There might be intermediate changes in the base image when we merge to develop. So people should not all of a sudden have a changed image. But I also don't like the idea of extraspecific references to a revision image when being in a development context
IMHO the combined tag of app version + base image revision number does not fully express a functionality change in the base image.
I'm fine with different tags for the base image vs. the app image.
Do you think we should have short rolling tags, too?
Example: 0.9.1-jammy-pyr6.2024.6-tmrn17 -> 0.9.1-jammy or even just 0.9.1
Well, at a high level, I'm ok with getting some kind of tagging going and then iterating over time.
That said, it would be nice to get it "right" or close to right, the first time.
Short tags are definitely easier on the eyes. :eyes:
I would be pretty simple to cut them off...
And technically we are talking rolling tags - they are expected to change
Alright. Let's pin these images down. Let's make rolling tags <version>-<flavor> and let only the stable tags contain payara and temurin version plus the revision number
So... 0.9.1-jammy?
Aye
Leaves the option make images that have different OSes
Maybe at some point we want Dataverse app images based on Redhat UBI as well as Ubuntu
Right now we're on Ubuntu because that's what Temurin is based on, right?
Yes and no
Temurin has more images available
They offer variants with Redhat UBI, Alpine, different Ubuntu versions and Windows
I see!
The Redhat bit might become important for MassOC :wink:
To run on OpenShift? Yeah, maybe.
Dang... While writing docs I came across another pitfall: if a release and develop does not have changes or just a Payara update, both branches will fight for authority over the shorter tags...
I :heart: Documentation Driven Development :grinning:
Now I'm thinkin we maybe should add the dataverse version to the tag :unamused:
For the base image too?
Thinking about adding the DV version to the image labels. Don't update the image if these don't match
So avoid fighting over it
You know best!
Ha! You wish!
Well, we're all gaining a lot of good experience, at least :sweat_smile:
Truer words have seldomly been spoken. :see_no_evil:
We discussed this during our working group meeting yesterday and came to a better understanding of what we want. https://docs.google.com/document/d/1X49oElqgORdTCMECRfb5BuKUI1_yw86G3qnu8TXK76k/edit
Looks like this is working now as discussed
https://hub.docker.com/r/gdcc/base/tags
Very nice - the scheduled update ran (https://github.com/gdcc/wip-dataverse-base-image/actions/runs/10650721620/job/29522439082), but didn't do anything as neither a new Java image nor package updates were available
So. This basically works. Now what. Should I rope versioning application images into this same PR? @Philip Durbin WDYT?
You know, I listened to the recordings but I'm still a bit lost, I'm afraid. Does the PR have docs?
There isn't a PR yet, but I can make one quickly
Do you want me to?
(Then you have preview docs)
Well, no rush. If you link to the branch I can look at the rst files.
Here you go:
Base Image
Making Releases
Oh wow, you can even enable a "rich diff" that will the changes rendered!
image.png
s/Bitname/Bitnami/
Good catch, but I expect more :see_no_evil:
Ha. Overall, looks great. Confusing though. Maybe I'll try to write my own version and you can tell me if it's accurate. :sweat_smile:
There's no PR yet that I can make a ```suggestion against, right?
I thought I created one... Maybe I just dreamt that?
Don't let me rush you! :stuck_out_tongue_wink:
Actually, I could make a PR into your branch.
https://github.com/IQSS/dataverse/pull/10827
Thanks. The branch is https://github.com/gdcc/wip-dataverse-base-image/tree/10478-version-base-img but there's a branch with the same name in origin/upstream. Can we delete it? This: https://github.com/IQSS/dataverse/tree/10478-version-base-img
Sure thing. I started working on that one first but then realised I need a fork with that branch as default to test more stuff
Deleted. Thanks.
Ah git remote update origin --prune is my friend.
I don't love this: "there is no review or QA necessary, as it is a predefined necessity."
Feel free to rephrase
Do I need to elaborate?
Well, help me understand. Does it need to be the first PR merged after a release?
I changed it to just "Now create a pull request and merge it."
Yes and no. If it isn't the first, someone might use some old base image with it. That may or may not work, depending on what's going on.
It probably should be the first. It's a very simple thing to do. As it is part of the release process, it kind of should always be the first one. We don't merge other things before the release process is done, aye? :wink:
Right. It's a clean slate.
Ok, I'm not done but please see https://github.com/gdcc/wip-dataverse-base-image/pull/1
I'm going to use the same PR to look at other docs.
Will do. But not today. Weekend's started :wink: :cocktail:
Enjoy! For Monday, I went ahead and pushed another commit. That PR is ready for you.
@Oliver Bertuch when you have a moment, I'm curious what you think of https://github.com/gdcc/wip-dataverse-base-image/pull/1
Thanks for going over my docs PR in the meeting just now.
TODO: send an email to the google group with a link to the recording and ask what they think about the plan for tags.
Sent! https://groups.google.com/g/dataverse-community/c/c_AbRdiBo_c/m/ALVmh0qLAQAJ
I like the proposed change for container tags. However, I believe outside of the developer community the base image is not actively used and even their the usage is limit to a sub group. Hence, use whatever tag system works for you. Nevertheless, it would be nice if the suggested changes for the base image could be also applied to the application image. Here the suggested change would work great...
Of course it's planned to dona similar thing for the application images! But it's a different issue :wink:
Did you watch the recording?
parts of it
We were particularly unsure about the Flexi Stack tags. They are mostly relevant for getting images down to backend devs if there are breaking changes like Payara or Java version.
Would that be helpful? Or are devs OK with just getting told to pull again after such large breaking changes are merged?
Also happy to jump on a call for this. Can fire up a Zoom room quick
IMHO those tags are great, I can change them as I need as a developer and they offer a great environment for matrix builds to test various java and application server combinations
I hear you!
However, most of the time I don't care about the java version or application server version. Hence, I just use whatever is configured in maven.
That's what I said :laughing:
The tag string will just be glued together by Maven for you.
You probably won't even recognize in day to day work
Phil said Frontend devs are using unstable now for the SPA work. Should we add a rolling tag 6.x-flavor which looks the same as the production rolling tag, but is for the next unreleased version?
Once the release is cut, it would roll over to be a production tag, also accompanied by the immutable tags
(Obviously I would try to copy most of these ideas and policies to the app image)
Oliver Bertuch said:
Phil said Frontend devs are using unstable now for the SPA work. Should we add a rolling tag 6.x-flavor which looks the same as the production rolling tag, but is for the next unreleased version?
Yep, that would be awesome. Two rolling ones latest for the main branch and development for the development one would be awesome.
Oh wait so you're in favor of latest pointing to the latest production tag?
I'm not sure this is a good idea... it violates the Bitnami pattern and the well known definition of latest tag as an unstable thing.
Oh wait actually that's wrong. They just say latest points to the most current revision
Would that latest tag pointing to the latest release be helpful for you?
Maybe I'm wrong but my intuition says latest refers the latest release. Whenever I use docker images I want to use the latest stable version. It's rather seldom that I want some development or test version, unless I'm involved in the development testing.
I hear you!
As I said above, it would actually be more in line with the Bitnami policy. I had that wrong in my head.
Most of the image users are (will) not be part of the development circle but rather users or sys admins. Hence, the tags should suit their needs.
Ok so maybe we can just keep the unstable tag as before for a rolling tag of develop
Now I'm glad I already have the code to detect being on the latest release :laughing:
Maybe we could even adopt https://semver.org/ ;)
We kind of have. There are patch releases for DV every now and then
but thats a discussion independent of containers...
Do you think we should prolong the tags carrying the 0 for the patch version?
I'd find that odd because I'm accustomed to the shorter tags in DV releases
Most people also reference a DV version using these shorter variants. Probably because a patch release happens so rarely
Once application tags are used. We'll need some method to distinguish between the base and the hotfix container version.
Do we? We have revisions... Is there harm in adding the patches?
People should always use the immutable tags for production l, so no one will be surprised
If I use 6.3 in production and want/need to update the the hotfix version do I upgrade the image version to 6.3.1 or to some SHA revision number?
No, you'd upgrade from -r1 to -r2
(Numbers only being placeholders here)
So on your K8s deployment you're always referencing the immutable tags.
If you want to update, you can just change the Revision number and properly test deploys, but also roll back easily.
Much easier than a SHA sum :innocent:
The same would be true for any other backported changes we might provide for security purposes. So I'm not sure why it wouldn't be good to do the same with backporting application patches
I see. I wasn't aware of the revision part of the tag. With a bit of rearranging (dropping r) it would be compliment to a semantic version...
Hmm yeah I'd like to stick to the Bitnami pattern with the -r suffix.
Also because these are on scheduled maintenance. If the content needs to change because of updates, the revision will be incremented
That's not the same as an actual patch release of Dataverse
I'm offering that Zoom room again :innocent:
As said I'm fine with all of that:)
Ok great!
To summarize as TLDR:
Hmm, during the call I was on board with having "latest" be equivalent to "unstable" but I hear you that "latest" should be stable, which is "master" (the latest release).
We do endeavor to keep the "develop" branch (which maps to "unstable") release-ready but sometimes a bug creeps in that we fix before we release. So yeah, "master" should be a bit more stable.
And like we're saying, developers are already used to using "unstable" so there would be no change for them.
Thanks for the feedback, @Johannes D! :heart:
Do we want to try to get this in for 6.4? I'm asking because this is the last sprint before we release. The sprint ends next Wednesday, Sep. 25.
No pressure! I'm just trying to raise awareness of when 6.4 might come out.
Working on it. Would be good to have it in.
Awesome. Is there anything I can do to help?
Not sure. I'm changing the docs again to fit what we discussed during the last CT meeting
What are we gonna do about review and QA?
Once I change all stuff to be suitable for upstream merge, it's not possible to run and test this anymore
I'd probably just merge it, honestly.
There's always git blame :see_no_evil:
If we get something wrong, we can try again, right?
Yes of course!
I merged your PR @Philip Durbin π and tweaked the docs some more. Here's the preview: https://dataverse-guide--10827.org.readthedocs.build/en/10827/container/base-image.html#supported-image-tags
Right, right, latest can be used for production now. Makes sense.
Flexibile stack has a stray trailng comma (sorry): "n>-j<java.version>:"
Also, we should keep the NOTE indented with flexible stack if we can.
Well the same thing is true for the other "upcoming" tag
Which is why I extracted it.
Oh! Never mind, then!
Maybe we could add, "in these tags for development use, the current tag will..."
Sure :smile:
Done!
Should we call it <dv-minor-next> instead of <dv-minor>? This might reduce confusion.
Oh good idea!
I already made it 6.4 in prod and 6.5 in dev
So that's well aligned then
Added and pushed
Awesome. I just mentioned at standup that ideally we'd like to get this into 6.4. I didn't hear any objections.
I've added details to the description in https://github.com/IQSS/dataverse/pull/10827 to better communicate the state of this and what I see is still a TODO to get the job done. Feel free to take a look and think about what y'all might be able to contribute. (E.g. the feature to generate a proper README would be sth someone else can look into)
:point_up: @Philip Durbin π :wink:
I'm off now to get some construction work done...
Wow, I appreciate all the hard work on this! Thanks, @Oliver Bertuch! ![]()
I have to admit I'm having trouble parsing this:
"Move Docker Hub image description README update for gdcc/base to maintenance workflow, also listing the supported tags"
You want the README to be updated programmatically?
It has always been like this
But for now, the tags are hardcoded to "unstable" and "alpha"
Now I want to have a list of the tags that are really supported
Just like you can see them with other projects
Otherwise people will click on "tags" and see a bunch of old tags lying around that we don't actually support?
Exactly
Could we just state our policy?
We could, but that's kind of hard to parse when you're on Docker Hub
It's not very convenient
I'd rather properly list what's happening
might be a good way to trim the tail
Trim which tail?
Screenshot-2024-09-18-at-11.39.58AM.png
via https://blog.crisp.se/2012/10/25/henrikkniberg/agile-product-ownership-in-a-nutshell
Ha!
Sure, we could skip that for now. But it's not very far away now...
I've just moved on from using a Github Action matrix to a build script that does the matrix itself.
Whoops, I cut it off but the x axis is time.
Github Action matrixes are just no good for advanced usage
huh, interesting
Also, I think the shell script is a lot more readable than the chatty thing you need to GH actions
And we can run it locally to test it...
nice
It's up already, if you want to take a look
.github/workflows/scripts/maintenance-job.sh I assume
Aye
IMHO it's way more readable...
You remind me of Hamilton. :musical_notes: "Why do you write like you're running out of time? :musical_notes: --Non-Stop
The log looks like this now: https://github.com/gdcc/wip-dataverse-base-image/actions/runs/10925611937/job/30327491858
Looks good!
Now on https://hub.docker.com/r/gdcc/base:
image.png
Nicer than Bitnami even! :smiling_imp:
Hrhr
Just fixing that the revision tags are included in the list, too.
Not that it's a competition. Everybody settle down.
Alright we're getting close here!
Only the release note is missing @Philip Durbin π !!!
I applied the finishing touches, so no more running the jobs in the fork now...
Oh wait I forgot the input param thing. Now I'm glad I did that list of TODOs. But everything else is done!
I'm off now. More later or tomorrow.
I'm back :see_no_evil:
I didn't write the release note. Sorry. I'm still working on 6.4 release notes. :sweat_smile:
I DID warn people at standup that we might want to get this PR in 6.4.
I've been working really hard to get there :smiling:
Go go go!
Lots of blood, sweat and tears in those 140 commits
Ha. Should we go ahead and put the PR into "in review"? :thinking:
Let me get that one thing fixed with the empty tag, then we can do the release note and put it into ready for review while writing the note
And put a size on it? Maybe a 3 since I'll probably just merge it. :smiling_imp:
Oh, sorry, yes, I meant "ready for review".
IIRC I already gave it a size
Ah, yes, a 3. Perfect.
OK I think I have a fix. But I can't test it because of the upstream adaption...
Should we just merge it and cross fingers?
I'll draft a release note now
I'm fine with crossing fingers.
Done! Let me know what you think: https://github.com/IQSS/dataverse/pull/10827/commits/52e6408a5a0d33629139c2098253e6ca8f08588a
I'll put it in "RfR"
143 commits. :firecracker: :exploding_head: (And I am quite thorough with my commits, I try to avoid single typo commits...)
Looks perfect. We can always tweak it as we add it to #10866 (the 6.4 release notes).
Splendid!
I put my name on it and took you off. Thanks!
Looks like you're still reviewing...
Any chance you'll merge today @Philip Durbin π ? Then I'd stay a while longer and see if I need to hotfix stuff that breaks...
Oh, uh, lemme ask in #dv-tech!
Ok, I asked. :fingers_crossed:
Haha you're fine with crossing fingers that someone else gives a green light, not with hitting the merge button :innocent: :laughing: :hug:
I cannot act unilaterally. :grinning: We need a multilateral agreement. :crazy:
I left a tiny review for you
Well it's already bilateral :flag_germany: :flag_us_outlying_islands:
Alright seems like we won't get a quorum today. I'm gonna call it a night, it's late here. More hubbub tomorrow.
Merged: Releasing versioned (base) images #10827
And no jobs failed! Smooth!
German engineering :muscle: :flag_germany:
Looks like the scheduled maintenance came through as well. And the tags list on the Hub now also has latest in it.
Oliver Bertuch has marked this topic as resolved.
Last updated: Oct 30 2025 at 05:14 UTC