docker-compose.yml

networks:
  chalk:
  gcp:
  imds:
    ipam:
      driver: default
      config:
        - subnet: 169.254.169.0/24

services:
  # --------------------------------------------------------------------------
  # CHALK

  chalk:
    build:
      context: .
      target: deps
      additional_contexts:
        nimutils: ../nimutils
      args:
        BASE: ${BASE:-alpine}
    # platform: linux/arm64
    command: nimble ${CHALK_BUILD:-release}
    init: true
    working_dir: $PWD
    volumes:
      - $PWD:$PWD
      - $PWD/../nimutils:$PWD/../nimutils
      - $PWD/../con4m:$PWD/../con4m
    environment:
      DEBUG: ${DEBUG:-}
      CHALK_PASSWORD: ${CHALK_PASSWORD:-}
      CHALK_BUILD: ${CHALK_BUILD:-release}

  # --------------------------------------------------------------------------
  # TESTS

  server:
    build:
      context: ./tests/functional
    entrypoint: uvicorn
    command: functional.server.chalk:app --host=0.0.0.0 --port=8585 --reload
    networks:
      chalk:
        aliases:
          - chalk.local
    ports:
      - 8585:8585
    working_dir: /tests
    volumes:
      - ./tests:/tests
    environment:
      REDIRECT: https://tls.chalk.local:5858
      DATABASE_URL: sqlite:///functional/server/chalkdb.sqlite
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "curl -f http://localhost:8585/health"
      start_period: 30s
      interval: 1s

  server-tls:
    build:
      context: ./tests/functional
    entrypoint:
      - /bin/sh
      - -c
    command:
      - |
        python -m functional.server.certs
        exec uvicorn functional.server.chalk:app \
        --host=0.0.0.0 \
        --port=5858 \
        --ssl-certfile=functional/server/cert.pem \
        --ssl-keyfile=functional/server/cert.key \
        --reload
    environment:
      DOMAIN: tls.chalk.local
      CERT: functional/server/cert.pem
      KEY: functional/server/cert.key
      DATABASE_URL: sqlite:///functional/server/chalkdb.sqlite
    working_dir: /tests
    volumes:
      - ./tests:/tests
    ports:
      - 5858:5858
    networks:
      chalk:
        aliases:
          - tls.chalk.local
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "curl -f https://localhost:5858/health --insecure"
      start_period: 30s
      interval: 1s
    depends_on:
      server:
        # avoid concurrent start which attempts to migrate same sqlite db file
        condition: service_healthy

  # there is no official imds test container so we have very simple wrapper
  imds:
    build:
      context: ./tests/functional
    entrypoint: uvicorn
    command: functional.server.imds:app --host=0.0.0.0 --port=80 --reload
    working_dir: /tests
    volumes:
      - ./tests:/tests
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "curl -f http://localhost/health"
      start_period: 10s
      interval: 1s
    networks:
      imds:
        ipv4_address: 169.254.169.254
      gcp:
        # XXX for simplicity's sake, use a single imds app server for all
        # of AWS, Azure, GCP
        aliases:
          - metadata.google.internal

  # UDP DNS server for DNS sink functional tests
  dns:
    build:
      context: ./tests/functional
    entrypoint: python
    command: -m functional.server.dns_server
    networks:
      chalk:
        aliases:
          - dns.chalk.local
    ports:
      - "5354:5354/udp"
      - "8054:8054"
    working_dir: /tests
    volumes:
      - ./tests:/tests
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "curl -f http://localhost:8054/health"
      start_period: 10s
      interval: 1s

  # simple server for serving static files
  static:
    build:
      context: ./tests/functional
    entrypoint: python
    command: -m http.server 8000
    working_dir: /chalk/tests/functional
    volumes:
      - .:/chalk
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "curl -f http://localhost:8000/conftest.py"
      start_period: 10s
      interval: 1s
    networks:
      chalk:

  tests:
    build:
      context: ./tests/functional
      args:
        BASE: ${BASE:-ubuntu}
    entrypoint: $PWD/tests/functional/entrypoint.sh
    cap_add:
      - SYS_PTRACE # for gdb
    security_opt:
      - seccomp=unconfined # for gdb
    volumes:
      - $PWD:$PWD
      - $HOME/.pdbrc.py:/root/.pdbrc.py
      - $HOME/.docker/config.json:/root/.docker/config.json.host
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/docker/certs.d:/etc/docker/certs.d
      - /etc/buildkit:/etc/buildkit
      - /etc/docker:/etc/docker
      - /tmp:/tmp
    working_dir: $PWD/tests/functional
    networks:
      - chalk
      - imds
      - gcp
    depends_on:
      registry:
        condition: service_healthy
      registry-tls:
        condition: service_healthy
      registry-tls-insecure:
        condition: service_healthy
      registry-proxy:
        condition: service_healthy
      registry-auth:
        condition: service_healthy
      server:
        condition: service_healthy
      server-tls:
        condition: service_healthy
      imds:
        condition: service_healthy
      dns:
        condition: service_healthy
    environment:
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_ACCOUNT_ID: ${AWS_ACCOUNT_ID:-}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
      AWS_PROFILE: ${AWS_PROFILE:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      DOCKER_GIT_CONTEXT_SSH_REPO: ${DOCKER_GIT_CONTEXT_SSH_REPO:-}
      DOCKER_GIT_CONTEXT_TOKEN_REPO: ${DOCKER_GIT_CONTEXT_TOKEN_REPO:-}
      GITHUB_ACTIONS: ${GITHUB_ACTIONS:-}
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
      DOCKER_HUB_TOKEN: ${DOCKER_HUB_TOKEN:-}
      IP: ${IP:-} # host IP for docker registry tests
      SSH_KEY: ${SSH_KEY:-}
      STRACE: ${STRACE:-}
      CI: ${CI:-}

  # --------------------------------------------------------------------------
  # MISC DEPS

  registry:
    image: registry:3
    ports:
      - "5044:5044"
    environment:
      - REGISTRY_HTTP_ADDR=0.0.0.0:5044
    networks:
      - chalk
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "echo 'GET / HTTP/1.1' | nc -v localhost 5044"
      start_period: 30s
      interval: 1s

  registry-tls:
    image: registry:3
    ports:
      - "5045:5045"
    volumes:
      - /etc/docker/certs.d:/etc/docker/certs.d
      - /etc/docker/keys:/etc/docker/keys
    environment:
      REGISTRY_HTTP_ADDR: 0.0.0.0:5045
      REGISTRY_HTTP_TLS_CERTIFICATE: /etc/docker/certs.d/${IP:-127.0.0.1}:5045/ca.crt
      REGISTRY_HTTP_TLS_KEY: /etc/docker/keys/${IP:-127.0.0.1}:5045/ca.key
    networks:
      - chalk
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "echo 'GET / HTTP/1.1' | nc -v localhost 5045"
      start_period: 30s
      interval: 1s

  registry-tls-insecure:
    image: registry:3
    ports:
      - "5046:5046"
    volumes:
      - /etc/docker/certs.d:/etc/docker/certs.d
      - /etc/docker/keys:/etc/docker/keys
    environment:
      REGISTRY_HTTP_ADDR: 0.0.0.0:5046
      REGISTRY_HTTP_TLS_CERTIFICATE: /etc/docker/certs.d/${IP:-127.0.0.1}:5044/ca.crt
      REGISTRY_HTTP_TLS_KEY: /etc/docker/keys/${IP:-127.0.0.1}:5044/ca.key
    networks:
      - chalk
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "echo 'GET / HTTP/1.1' | nc -v localhost 5046"
      start_period: 30s
      interval: 1s

  registry-proxy:
    image: registry:3
    ports:
      - "5047:5047"
    environment:
      - REGISTRY_LOG_LEVEL=debug
      - REGISTRY_HTTP_ADDR=0.0.0.0:5047
      - REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io
      - REGISTRY_PROXY_USERNAME=${REGISTRY_PROXY_USERNAME:-}
      - REGISTRY_PROXY_PASSWORD=${REGISTRY_PROXY_PASSWORD:-}
    networks:
      - chalk
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "echo 'GET / HTTP/1.1' | nc -v localhost 5047"
      start_period: 30s
      interval: 1s

  registry-auth:
    image: registry:3
    ports:
      - "5048:5048"
    entrypoint:
      - /bin/sh
      - -c
    command:
      - |
        apk add --no-cache apache2-utils
        mkdir -p /auth
        htpasswd -Bbn ${REGISTRY_AUTH_USERNAME:-user} ${REGISTRY_AUTH_PASSWORD:-password} > /auth/htpasswd
        exec /entrypoint.sh /etc/distribution/config.yml
    environment:
      REGISTRY_HTTP_ADDR: 0.0.0.0:5048
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
    networks:
      - chalk
    healthcheck:
      test:
        - CMD-SHELL
        - sh -c "echo 'GET / HTTP/1.1' | nc -v localhost 5048"
      start_period: 30s
      interval: 1s