Gitlab CI CD and docker

projet test/example de l’utilisation de Gitlab CI/CD pour faire des images docker

Ressources Forgemia

Info configuration

• https://forgemia.inra.fr/help/instance_configuration

Doc/tutos

• https://forgemia.inra.fr/adminforgemia/doc-public/-/wikis/Gitlab-ci
• https://forgemia.inra.fr/adminforgemia/doc-public/-/wikis/gitlab-pages
• https://forgemia.inra.fr/adminforgemia/doc-public/-/wikis/Gitlab-Container-Registry

Ressources externes utiles

Gitlab-CI:

• Introduction: https://about.gitlab.com/stages-devops-lifecycle/continuous-integration/
  
• Versioned pipelines:
  • https://docs.gitlab.com/ee/ci/yaml/
    
  • https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/doc/ci/examples/README.md
    
  • https://yaml-online-parser.appspot.com/
    
  • https://blog.jbriault.fr/quelques-astuces-avec-gitlab-ci/
    
• Pipeline stages:
  • https://docs.gitlab.com/ee/ci/yaml/#stages
  • https://about.gitlab.com/blog/2021/08/24/stageless-pipelines/
• Job artefacts: https://docs.gitlab.com/ee/ci/pipelines/job_artifacts.html
  
• Job cache:
  • https://docs.gitlab.com/ee/ci/caching/
  • https://docs.gitlab.com/ee/development/caching.html
    
  • https://docs.gitlab.com/ee/ci/yaml/index.html#cache
• Build docker images https://docs.gitlab.com/ee/ci/docker/using_docker_build.html
  
• Docker build cache (with BUILDKIT):
  • https://testdriven.io/blog/faster-ci-builds-with-docker-cache/
    
  • https://blog.meadsteve.dev/docker/2022/09/29/docker-build-caching/
    
• Container Registry:
  • https://docs.gitlab.com/ee/user/packages/container_registry/index.html
    
  • https://forgemia.inra.fr/help/user/packages/container_registry/index#authenticating-to-the-gitlab-container-registry
    
  • https://forgemia.inra.fr/help/user/profile/personal_access_tokens.md
    
• Dependency Proxy: https://forgemia.inra.fr/help/user/packages/dependency_proxy/index
  
• Podman & Buildah
  • https://medium.com/prgcont/using-buildah-in-gitlab-ci-9b529af19e42
    
  • https://docs.openshift.com/container-platform/4.1/builds/custom-builds-buildah.html
    
• Job templates/examples
  • https://gitlab.com/lydra/gitlab-ci-templates
    
  • https://r2devops.io/
    
  • https://to-be-continuous.gitlab.io/doc/ - https://gitlab.com/to-be-continuous
    
• Environments and deployments
  • https://forgemia.inra.fr/help/ci/environments/index.md
    
  • https://docs.gitlab.com/ee/ci/review_apps/
    
  • https://gitlab.com/yoandevco/myblog/-/blob/1-ci-add-publish-on-gitlab-pages/.gitlab-ci.yml
• Validate and local run of Gitlab CI
  • https://blog.stephane-robert.info/post/gitlab-valider-ci-yml/
• Glab - cli officielle de gitlab
  • https://glab.readthedocs.io/
  • https://blog.stephane-robert.info/post/gitlab-cli/
• Optimize GitLab for large repositories:
  • https://docs.gitlab.com/ee/ci/large_repositories/
  • https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/

Docker:

• Dockerfile best practices
  • https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
    
  • https://www.docker.com/blog/intro-guide-to-dockerfile-best-practices/
    
  • https://www.docker.com/blog/speed-up-your-development-flow-with-these-dockerfile-best-practices/
    
  • https://www.ssi.gouv.fr/uploads/2020/12/docker_fiche_technique.pdf
    
  • https://github.com/hexops/dockerfile
    
  • https://github.com/Swordfish-Security/docker_cicd
    
  • https://blog.octo.com/panorama-des-outils-de-securite-autour-des-conteneurs/
    
• Dockerfile linter:
  • https://github.com/hadolint/hadolint
    
  • https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#gitlab-ci
    
• HEALTHCHECK: https://docs.docker.com/engine/reference/builder/#healthcheck
  
• Multi-stages build: https://docs.docker.com/develop/develop-images/multistage-build/
  
• Do Not Run Applications as ROOT User:
  • https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user
    
  • https://nickjanetakis.com/blog/running-docker-containers-as-a-non-root-user-with-a-custom-uid-and-gid
• Podman: https://podman.io/
  
• Buildah: https://github.com/containers/buildah
  
• Image analyzer: https://github.com/wagoodman/dive
  
• gitleaks https://github.com/zricethezav/gitleaks
  
• dockerfilegraph https://github.com/patrickhoefler/dockerfilegraph
  
• Open Container Initiative:
  • https://opencontainers.org/
    
  • https://github.com/opencontainers/image-spec/blob/main/annotations.md
    
• heredocs BUILDKIT support: https://jedevc.com/blog/dockerfile-heredocs-intro/
• Software Bill Of Materials (SBOM):
  • https://github.com/anchore/syft
  • https://docs.docker.com/engine/sbom/
  • https://github.com/docker/sbom-cli-plugin
  • https://www.docker.com/blog/announcing-docker-sbom-a-step-towards-more-visibility-into-docker-images/
  • https://www.thorsten-hans.com/docker-sbom-dive-into-shift-left-security/
  • https://thenewstack.io/how-to-create-a-software-bill-of-materials/