Refine dockerfile to use buildx multi-arch image for thin plugin (#1070)

.github/workflows/image-build.yml

@@ -1,8 +1,8 @@
 name: Image build
 on: [pull_request]
 jobs:
-  build-amd64:
+  build-thin:
-    name: Image build/amd64 thin plugin
+    name: Image build thin plugin
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
@@ -11,13 +11,29 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
+      # note: disable sbom/provenance for now (gchr.io does not managed well yet)
       - name: Build container image
         uses: docker/build-push-action@v3
         with:
           context: .
           push: false
-          tags: ghcr.io/${{ github.repository }}:latest-amd64
+          tags: ghcr.io/${{ github.repository }}:latest
           file: images/Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
+          sbom: false
+          provenance: false
+
+      # note: disable sbom/provenance for now (gchr.io does not managed well yet)
+      - name: Build container debug image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: false
+          tags: ghcr.io/${{ github.repository }}:latest
+          file: images/Dockerfile.debug
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
+          sbom: false
+          provenance: false
 
   build-amd64-thick:
     name: Image build/amd64 thick plugin
@@ -37,78 +53,6 @@ jobs:
           tags: ghcr.io/${{ github.repository }}:latest-amd64-thick
           file: images/Dockerfile.thick
 
-  build-arm64:
-    name: Image build/arm64
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build container image
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: false
-          tags: ghcr.io/${{ github.repository }}:latest-arm64
-          file: images/Dockerfile.arm64
-
-  build-arm32:
-    name: Image build/arm32
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build container image
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: false
-          tags: ghcr.io/${{ github.repository }}:latest-arm32
-          file: images/Dockerfile.arm32
-
-  build-ppc64le:
-    name: Image build/ppc64le
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build container image
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: false
-          tags: ghcr.io/${{ github.repository }}:latest-ppc64le
-          file: images/Dockerfile.ppc64le
-
-  build-s390:
-    name: Image build/s390x
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build container image
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: false
-          tags: ghcr.io/${{ github.repository }}:latest-s390x
-          file: images/Dockerfile.s390x
-
   build-origin:
     name: Image build/origin
     runs-on: ubuntu-latest

.github/workflows/image-push-master.yml

@@ -3,9 +3,11 @@ on:
   push:
     branches:
       - master
+env:
+  image-push-owner: 'k8snetworkplumbingwg'
 jobs:
-  push-amd64:
+  push-thick-amd64:
-    name: Image push/amd64
+    name: Image push thick image/amd64
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
@@ -15,37 +17,27 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Push container image
+      - name: Push container image for thick plugin
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
         uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:latest-amd64
+            ghcr.io/${{ github.repository }}:latest-thick
-            ghcr.io/${{ github.repository }}:snapshot-amd64
+            ghcr.io/${{ github.repository }}:snapshot-thick
-          file: images/Dockerfile
-
-      - name: Push container image for daemon based deployment
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:latest-thick-amd64
-            ghcr.io/${{ github.repository }}:snapshot-thick-amd64
           file: images/Dockerfile.thick
+          platforms: linux/amd64
 
-  push-arm64:
+  push-thin:
-    name: Image push/arm64
+    name: Image push thin image
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
@@ -55,110 +47,40 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Push container image
+      - name: Push thin container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
         uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:latest-arm64
+            ghcr.io/${{ github.repository }}:latest
-            ghcr.io/${{ github.repository }}:snapshot-arm64
+            ghcr.io/${{ github.repository }}:snapshot
-          file: images/Dockerfile.arm64
+          file: images/Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
+          sbom: false
+          provenance: false
 
-  push-arm32:
+      - name: Push thin container debug image
-    name: Image push/arm32
+        if: github.repository_owner == ${{ env.image-push-owner }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
         uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:latest-arm32
+            ghcr.io/${{ github.repository }}:latest-debug
-            ghcr.io/${{ github.repository }}:snapshot-arm32
+            ghcr.io/${{ github.repository }}:snapshot-debug
-          file: images/Dockerfile.arm32
+          file: images/Dockerfile.debug
-
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
-  push-ppc64le:
+          sbom: false
-    name: Image push/ppc64le
+          provenance: false
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:latest-ppc64le
-            ghcr.io/${{ github.repository }}:snapshot-ppc64le
-          file: images/Dockerfile.ppc64le
-
-  push-s390x:
-    name: Image push/s390x
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:latest-s390x
-            ghcr.io/${{ github.repository }}:snapshot-s390x
-          file: images/Dockerfile.s390x
 
 # TODO: need to fix this action
 #  push-origin:
@@ -190,67 +112,3 @@ jobs:
 #            ghcr.io/${{ github.repository }}:snapshot-origin
 #          file: images/Dockerfile.openshift
 
-  push-manifest:
-    needs: [push-amd64, push-arm64, push-ppc64le, push-s390x]
-    runs-on: ubuntu-latest
-    env:
-      REPOSITORY: ghcr.io/${{ github.repository }}
-    steps:
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create manifest for multi-arch images
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        run: |
-          # snapshot-thick
-          # get artifacts from previous steps
-          docker pull ${{ env.REPOSITORY }}:snapshot-thick-amd64
-          docker manifest create ${{ env.REPOSITORY }}:snapshot-thick ${{ env.REPOSITORY }}:snapshot-thick-amd64
-          docker manifest annotate ${{ env.REPOSITORY }}:snapshot-thick ${{ env.REPOSITORY }}:snapshot-thick-amd64 --arch amd64
-          docker manifest push ${{ env.REPOSITORY }}:snapshot-thick
-
-          # latest-thick
-          # get artifacts from previous steps
-          docker pull ${{ env.REPOSITORY }}:latest-thick-amd64
-          docker manifest create ${{ env.REPOSITORY }}:latest-thick ${{ env.REPOSITORY }}:latest-thick-amd64
-          docker manifest annotate ${{ env.REPOSITORY }}:latest-thick ${{ env.REPOSITORY }}:latest-thick-amd64 --arch amd64
-          docker manifest push ${{ env.REPOSITORY }}:latest-thick
-
-          # snapshot
-          # get artifacts from previous steps
-          docker pull ${{ env.REPOSITORY }}:snapshot-amd64
-          docker pull ${{ env.REPOSITORY }}:snapshot-arm64
-          docker pull ${{ env.REPOSITORY }}:snapshot-arm32
-          docker pull ${{ env.REPOSITORY }}:snapshot-ppc64le
-          docker pull ${{ env.REPOSITORY }}:snapshot-s390x
-          docker manifest create ${{ env.REPOSITORY }}:snapshot ${{ env.REPOSITORY }}:snapshot-amd64 ${{ env.REPOSITORY }}:snapshot-arm64 ${{ env.REPOSITORY }}:snapshot-arm32 ${{ env.REPOSITORY }}:snapshot-ppc64le ${{ env.REPOSITORY }}:snapshot-s390x
-          docker manifest annotate ${{ env.REPOSITORY }}:snapshot ${{ env.REPOSITORY }}:snapshot-amd64 --arch amd64
-          docker manifest annotate ${{ env.REPOSITORY }}:snapshot ${{ env.REPOSITORY }}:snapshot-arm64 --arch arm64
-          docker manifest annotate ${{ env.REPOSITORY }}:snapshot ${{ env.REPOSITORY }}:snapshot-arm32 --arch arm
-          docker manifest annotate ${{ env.REPOSITORY }}:snapshot ${{ env.REPOSITORY }}:snapshot-ppc64le --arch ppc64le
-          docker manifest annotate ${{ env.REPOSITORY }}:snapshot ${{ env.REPOSITORY }}:snapshot-s390x --arch s390x
-          docker manifest push ${{ env.REPOSITORY }}:snapshot
-
-          # latest
-          # get artifacts from previous steps
-          docker pull ${{ env.REPOSITORY }}:latest-amd64
-          docker pull ${{ env.REPOSITORY }}:latest-arm64
-          docker pull ${{ env.REPOSITORY }}:latest-arm32
-          docker pull ${{ env.REPOSITORY }}:latest-ppc64le
-          docker pull ${{ env.REPOSITORY }}:latest-s390x
-
-          docker manifest create ${{ env.REPOSITORY }}:latest ${{ env.REPOSITORY }}:latest-amd64 ${{ env.REPOSITORY }}:latest-arm64 ${{ env.REPOSITORY }}:latest-arm32 ${{ env.REPOSITORY }}:latest-ppc64le ${{ env.REPOSITORY }}:latest-s390x
-          docker manifest annotate ${{ env.REPOSITORY }}:latest ${{ env.REPOSITORY }}:latest-amd64 --arch amd64
-          docker manifest annotate ${{ env.REPOSITORY }}:latest ${{ env.REPOSITORY }}:latest-arm64 --arch arm64
-          docker manifest annotate ${{ env.REPOSITORY }}:latest ${{ env.REPOSITORY }}:latest-arm32 --arch arm
-          docker manifest annotate ${{ env.REPOSITORY }}:latest ${{ env.REPOSITORY }}:latest-ppc64le --arch ppc64le
-          docker manifest annotate ${{ env.REPOSITORY }}:latest ${{ env.REPOSITORY }}:latest-s390x --arch s390x
-          docker manifest push ${{ env.REPOSITORY }}:latest

.github/workflows/image-push-release.yml

@@ -3,20 +3,22 @@ on:
   push:
     tags:
       - v*
+env:
+  image-push-owner: 'k8snetworkplumbingwg'
 jobs:
-  push-amd64:
+  push-thick-amd64:
-    name: Image push/amd64
+    name: Image push thick image/amd64
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -24,46 +26,37 @@ jobs:
 
       - name: Docker meta
         id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
+        uses: docker/metadata-action@v4
         with:
           images: ghcr.io/${{ github.repository }}
-          tag-latest: false
+          flavor: |
+            latest=false
 
-      - name: Push container image
+      - name: Push container image for thick plugin
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:stable-amd64
+            ghcr.io/${{ github.repository }}:stable-thick
-            ${{ steps.docker_meta.outputs.tags }}-amd64
+            ${{ steps.docker_meta.outputs.tags }}-thick
-          file: images/Dockerfile
-
-      - name: Push container image for daemon based deployment
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:stable-thick-amd64
-            ${{ steps.docker_meta.outputs.tags }}-thick-amd64
           file: images/Dockerfile.thick
+          platforms: linux/amd64
 
-  push-arm64:
+  push-thin:
-    name: Image push/arm64
+    name: Image push thin image/amd64
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -71,129 +64,39 @@ jobs:
 
       - name: Docker meta
         id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
+        uses: docker/metadata-action@v4
         with:
           images: ghcr.io/${{ github.repository }}
-          tag-latest: false
+          flavor: |
+            latest=false
 
-      - name: Push container image
+      - name: Push thin container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
+        if: github.repository_owner == ${{ env.image-push-owner }}
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:stable-arm64
+            ghcr.io/${{ github.repository }}:stable
-            ${{ steps.docker_meta.outputs.tags }}-arm64
+            ${{ steps.docker_meta.outputs.tags }}
-          file: images/Dockerfile.arm64
+          file: images/Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
+          sbom: false
+          provenance: false
 
-  push-arm32:
+      - name: Push thin container debug image
-    name: Image push/arm32
+        if: github.repository_owner == ${{ env.image-push-owner }}
-    runs-on: ubuntu-latest
+        uses: docker/build-push-action@v3
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker meta
-        id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tag-latest: false
-
-      - name: Push container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v2
         with:
           context: .
           push: true
           tags: |
-            ghcr.io/${{ github.repository }}:stable-arm32
+            ghcr.io/${{ github.repository }}:stable-debug
-            ${{ steps.docker_meta.outputs.tags }}-arm32
+            ${{ steps.docker_meta.outputs.tags }}-debug
-          file: images/Dockerfile.arm32
+          file: images/Dockerfile.debug
-
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le,linux/s390x
-  push-ppc64le:
+          sbom: false
-    name: Image push/ppc64le
+          provenance: false
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker meta
-        id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tag-latest: false
-
-      - name: Push container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:stable-ppc64le
-            ${{ steps.docker_meta.outputs.tags }}-ppc64le
-          file: images/Dockerfile.ppc64le
-
-  push-s390x:
-    name: Image push/s390x
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker meta
-        id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tag-latest: false
-
-      - name: Push container image
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository }}:stable-s390x
-            ${{ steps.docker_meta.outputs.tags }}-s390x
-          file: images/Dockerfile.s390x
 
 # TODO: need to fix this action
 #  push-origin:
@@ -231,74 +134,3 @@ jobs:
 #            ghcr.io/${{ github.repository }}:stable-origin
 #            ${{ steps.docker_meta.outputs.tags }}-origin
 #          file: images/Dockerfile.openshift
-
-  push-manifest:
-    needs: [push-amd64, push-arm64, push-ppc64le, push-s390x]
-    runs-on: ubuntu-latest
-    env:
-      REPOSITORY: ghcr.io/${{ github.repository }}
-    steps:
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-
-      - name: Docker meta
-        id: docker_meta
-        uses: crazy-max/ghaction-docker-meta@v1
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tag-latest: false
-
-      - name: Login to GitHub Container Registry
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create manifest for multi-arch images
-        if: github.repository_owner == 'k8snetworkplumbingwg'
-        run: |
-          # <tag>-thick
-          # get artifacts from previous steps
-          docker pull ${{ steps.docker_meta.outputs.tags }}-thick-amd64
-          docker manifest create ${{ steps.docker_meta.outputs.tags }}-thick ${{ steps.docker_meta.outputs.tags }}-thick-amd64
-          docker manifest annotate ${{ steps.docker_meta.outputs.tags }}-thick ${{ steps.docker_meta.outputs.tags }}-thick-amd64 --arch amd64
-          docker manifest push ${{ steps.docker_meta.outputs.tags }}-thick
-
-          # stable-thick
-          # get artifacts from previous steps
-          docker pull ${{ env.REPOSITORY }}:stable-thick-amd64
-          docker manifest create ${{ env.REPOSITORY }}:stable-thick ${{ env.REPOSITORY }}:stable-thick-amd64
-          docker manifest annotate ${{ env.REPOSITORY }}:stable-thick ${{ env.REPOSITORY }}:stable-thick-amd64 --arch amd64
-          docker manifest push ${{ env.REPOSITORY }}:stable-thick
-
-          # <tag>
-          # get artifacts from previous steps
-          docker pull ${{ steps.docker_meta.outputs.tags }}-amd64
-          docker pull ${{ steps.docker_meta.outputs.tags }}-arm64
-          docker pull ${{ steps.docker_meta.outputs.tags }}-arm32
-          docker pull ${{ steps.docker_meta.outputs.tags }}-ppc64le
-          docker pull ${{ steps.docker_meta.outputs.tags }}-s390x
-          docker manifest create ${{ steps.docker_meta.outputs.tags }} ${{ steps.docker_meta.outputs.tags }}-amd64 ${{ steps.docker_meta.outputs.tags }}-arm64 ${{ steps.docker_meta.outputs.tags }}-arm32 ${{ steps.docker_meta.outputs.tags }}-ppc64le ${{ steps.docker_meta.outputs.tags }}-s390x
-          docker manifest annotate ${{ steps.docker_meta.outputs.tags }} ${{ steps.docker_meta.outputs.tags }}-amd64 --arch amd64
-          docker manifest annotate ${{ steps.docker_meta.outputs.tags }} ${{ steps.docker_meta.outputs.tags }}-arm64 --arch arm64
-          docker manifest annotate ${{ steps.docker_meta.outputs.tags }} ${{ steps.docker_meta.outputs.tags }}-arm32 --arch arm
-          docker manifest annotate ${{ steps.docker_meta.outputs.tags }} ${{ steps.docker_meta.outputs.tags }}-ppc64le --arch ppc64le
-          docker manifest annotate ${{ steps.docker_meta.outputs.tags }} ${{ steps.docker_meta.outputs.tags }}-s390x --arch s390x
-          docker manifest push ${{ steps.docker_meta.outputs.tags }}
-
-          # stable
-          # get artifacts from previous steps
-          docker pull ${{ env.REPOSITORY }}:stable-amd64
-          docker pull ${{ env.REPOSITORY }}:stable-arm64
-          docker pull ${{ env.REPOSITORY }}:stable-arm32
-          docker pull ${{ env.REPOSITORY }}:stable-ppc64le
-          docker pull ${{ env.REPOSITORY }}:stable-s390x
-          docker manifest create ${{ env.REPOSITORY }}:stable ${{ env.REPOSITORY }}:stable-amd64 ${{ env.REPOSITORY }}:stable-arm64 ${{ env.REPOSITORY }}:stable-arm32 ${{ env.REPOSITORY }}:stable-ppc64le ${{ env.REPOSITORY }}:stable-s390x
-          docker manifest annotate ${{ env.REPOSITORY }}:stable ${{ env.REPOSITORY }}:stable-amd64 --arch amd64
-          docker manifest annotate ${{ env.REPOSITORY }}:stable ${{ env.REPOSITORY }}:stable-arm64 --arch arm64
-          docker manifest annotate ${{ env.REPOSITORY }}:stable ${{ env.REPOSITORY }}:stable-arm32 --arch arm
-          docker manifest annotate ${{ env.REPOSITORY }}:stable ${{ env.REPOSITORY }}:stable-ppc64le --arch ppc64le
-          docker manifest annotate ${{ env.REPOSITORY }}:stable ${{ env.REPOSITORY }}:stable-s390x --arch s390x
-          docker manifest push ${{ env.REPOSITORY }}:stable

.github/workflows/kind-e2e.yml

@@ -33,8 +33,11 @@ jobs:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v3
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
       - name: Setup python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: 3.x
 
@@ -47,8 +50,15 @@ jobs:
         run: docker run -d --restart=always -p "5000:5000" --name "kind-registry" registry:2
 
       - name: Build latest-amd64
-        run: docker build -t localhost:5000/multus:e2e -f ${{ matrix.docker-file }} .
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          load: true
+          tags: localhost:5000/multus:e2e
+          file: ${{ matrix.docker-file }}
+          platforms: linux/amd64
 
+      # docker buildx push is failed due to https://github.com/docker/buildx/issues/94
       - name: Push to local registry
         run: docker push localhost:5000/multus:e2e
 

docs/development.md

@@ -5,6 +5,11 @@
 Currently multus team supports Kubernetes that Kubernetes community maintains.
 See [Version Skew Policy](https://kubernetes.io/releases/version-skew-policy/) for the details.
 
+## How to debug multus-cni thin image?
+
+Latest multus uses [distroless](https://github.com/GoogleContainerTools/distroless) container image for its base,
+hence there is no shell command. If you want to execute shell in multus pod, please use `-debug` image (e.g. ghcr.io/k8snetworkplumbingwg/multus-cni:snapshot-debug), which has shell.
+
 ## How to utilize multus-cni code as library?
 
 Multus now uses [gopkg.in](http://gopkg.in/) to expose its code as library.

hack/build-go.sh

@@ -7,6 +7,19 @@ if [ ! -d ${DEST_DIR} ]; then
 	mkdir ${DEST_DIR}
 fi
 
+# Specify correspondingGOARCH from TARGETPLATFORM
+if [ "$TARGETPLATFORM" = "linux/amd64" ]; then
+	export GOARCH=amd64
+elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then
+	export GOARCH=arm64
+elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then
+	export GOARCH=arm
+elif [ "$TARGETPLATFORM" = "linux/ppc64le" ]; then
+	export GOARCH=ppc64le
+elif [ "$TARGETPLATFORM" = "linux/s390x" ]; then
+	export GOARCH=s390x
+fi
+
 # version information
 hasGit=true
 git version > /dev/null 2>&1 || hasGit=false

images/Dockerfile

@@ -1,13 +1,14 @@
 # This Dockerfile is used to build the image available on DockerHub
-FROM golang:1.19 as build
+FROM --platform=$BUILDPLATFORM golang:1.19 as build
 
 # Add everything
 ADD . /usr/src/multus-cni
 
+ARG TARGETPLATFORM
 RUN  cd /usr/src/multus-cni && \
      ./hack/build-go.sh
 
-FROM gcr.io/distroless/base-debian11
+FROM gcr.io/distroless/base-debian11:latest
 LABEL org.opencontainers.image.source https://github.com/k8snetworkplumbingwg/multus-cni
 COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
 COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE

images/Dockerfile.arm64

@@ -1,22 +0,0 @@
-# This Dockerfile is used to build the image available on DockerHub
-FROM golang:1.19 as build
-
-# Add everything
-ADD . /usr/src/multus-cni
-
-ENV GOARCH "arm64"
-ENV GOOS "linux"
-
-RUN  cd /usr/src/multus-cni && \
-     ./hack/build-go.sh
-
-# build arm64 container
-FROM gcr.io/distroless/base-debian11:latest-arm64
-LABEL org.opencontainers.image.source https://github.com/k8snetworkplumbingwg/multus-cni
-COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
-COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
-
-WORKDIR /
-COPY --from=build /usr/src/multus-cni/bin/install_multus /
-COPY --from=build /usr/src/multus-cni/bin/thin_entrypoint /
-ENTRYPOINT ["/thin_entrypoint"]

images/Dockerfile.debug

@@ -1,22 +1,19 @@
 # This Dockerfile is used to build the image available on DockerHub
-FROM golang:1.19 as build
+FROM --platform=$BUILDPLATFORM golang:1.19 as build
 
 # Add everything
 ADD . /usr/src/multus-cni
 
-ENV GOARCH "arm"
+ARG TARGETPLATFORM
-ENV GOOS "linux"
-
 RUN  cd /usr/src/multus-cni && \
      ./hack/build-go.sh
 
-# build arm container
+FROM gcr.io/distroless/base-debian11:debug
-FROM gcr.io/distroless/base-debian11:latest-arm
 LABEL org.opencontainers.image.source https://github.com/k8snetworkplumbingwg/multus-cni
 COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
 COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
-
 WORKDIR /
+
 COPY --from=build /usr/src/multus-cni/bin/install_multus /
 COPY --from=build /usr/src/multus-cni/bin/thin_entrypoint /
 ENTRYPOINT ["/thin_entrypoint"]

images/Dockerfile.ppc64le

@@ -1,22 +0,0 @@
-# This Dockerfile is used to build the image available on DockerHub
-FROM golang:1.19 as build
-
-# Add everything
-ADD . /usr/src/multus-cni
-
-ENV GOARCH "ppc64le"
-ENV GOOS "linux"
-
-RUN  cd /usr/src/multus-cni && \
-     ./hack/build-go.sh
-
-# build ppc container
-FROM gcr.io/distroless/base-debian11:latest-ppc64le
-LABEL org.opencontainers.image.source https://github.com/k8snetworkplumbingwg/multus-cni
-COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
-COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
-
-WORKDIR /
-COPY --from=build /usr/src/multus-cni/bin/install_multus /
-COPY --from=build /usr/src/multus-cni/bin/thin_entrypoint /
-ENTRYPOINT ["/thin_entrypoint"]

images/Dockerfile.s390x

@@ -1,22 +0,0 @@
-# This Dockerfile is used to build the image available on DockerHub
-FROM golang:1.19 as build
-
-# Add everything
-ADD . /usr/src/multus-cni
-
-ENV GOARCH "s390x"
-ENV GOOS "linux"
-
-RUN  cd /usr/src/multus-cni && \
-     ./hack/build-go.sh
-
-# build s390x container
-FROM gcr.io/distroless/base-debian11:latest-s390x
-LABEL org.opencontainers.image.source https://github.com/k8snetworkplumbingwg/multus-cni
-COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
-COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
-
-WORKDIR /
-COPY --from=build /usr/src/multus-cni/bin/install_multus /
-COPY --from=build /usr/src/multus-cni/bin/thin_entrypoint /
-ENTRYPOINT ["/thin_entrypoint"]