You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "KrishVora2912 (via GitHub)" <gi...@apache.org> on 2024/07/23 08:04:57 UTC
[PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
KrishVora2912 opened a new pull request, #16664:
URL: https://github.com/apache/kafka/pull/16664
This PR aims to add address the comments added via the docker hub folks regarding the JVM based Docker Official Image for Apache Kafka introduced in the following KIP - https://cwiki.apache.org/confluence/display/KAFKA/KIP-1028%3A+Docker+Official+Image+for+Apache+Kafka . The comments by the dockerhub folks can be found [here](https://github.com/docker-library/official-images/pull/16970#pullrequestreview-2151987928) .
This PR:
Addresses comments 1,3,4,5,6,7,8,9 mentioned in the above link.
NOTE: The changes have been made to both the JVM docker images introduced via [KIP-975](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=263428303) as well as the GraalVM docer images introduced via [KIP-974](https://cwiki.apache.org/confluence/display/KAFKA/KIP-974%3A+Docker+Image+for+GraalVM+based+Native+Kafka+Broker). This ensures that the docker hub suggested best practices will now be used for both the OSS sponsored images as well as the Docker Official Images.
Gist:
1. USER root is unnecessary - removed this
3. apk update is unnecessary with --no-cache - removed this
4. apk upgrade is not allowed - removed this
5. Specific, individual GPG keys should be referenced by ID. - new approach uses hardcoded GPG keys
6. All invocations of gpg should include --batch - this has been adhered to
7. The kafka tarball should be verified prior to being unpacked - change has been made
8. The DOI build system sets appropriate annotations, so we recommend not setting labels, which have been deprecated. - deprecated labels have been removed, and now annotations are used
9 Is apk cache clean necessary since you have previously specified --no-cache? - removed this
Post this PR:
1. Propogate these modifications to the 3.7.0 docker official images Dockerfile.
2. Modify [existing PR](https://github.com/docker-library/official-images/pull/16970) with PR template generation script for 3.7.0 under docker official images repo.
3. Update release process to update version_keys file for each new release.
**Committer Checklist (excluded from commit message)**
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora2912 (via GitHub)" <gi...@apache.org>.
KrishVora2912 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1694229575
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Hi @rzo1 ! Thanks for these suggestions!
A few small queries here:
> The guys from docker hub official won't like external download dependencies
By this you mean that they wont approve of something along the lines of
```
wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
gpg --import KEYS;
```
correct?
We did receive a comment from the Dockerhub folks regarding this (see Point 5 [here](https://github.com/docker-library/official-images/pull/16970#pullrequestreview-2151987928)).
So we went along and changed the above approach. Now we pass the GPG_KEY as an argument/environment variable, and then use something along the lines of [this](https://github.com/apache/kafka/pull/16664/files#diff-f2767afd27bb49c8cd265401dc953f9bd14eb7062418bb35fe089e928cf5b13dR37-L39).
I went through the approach followed by Storm, and that seems like a great way to approach this too. However, for Kafka, there are a lot of existing keys that are returned (see attached image), which might just inflate the length of the Dockerfile (hence we decided with the arg/env approach).
In your experience, do you think the modified approach ([here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R55), [here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R31-L38) and [here](https://github.com/apache/kafka/pull/16664/files#diff-27e55a184b4d105f3922dbbed2250b084746361c81dc562429bade5b7459b544) would be liked by the Dockerhub folks, or with the discussion you had for Storm, do you anticipate any issue in this approach too?
Thanks a lot again!
Krish.
<img width="322" alt="image" src="https://github.com/user-attachments/assets/513d4196-d98d-4c92-bcc0-52fba51b1164">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1693017471
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
The guys from docker hub official won't like external download dependencies - we had that discussion for Storm a few months ago. We workaround that for Apache Storm here: https://github.com/apache/storm-docker/blob/master/automation/create-key-section.sh and here https://github.com/apache/storm-docker/blob/master/2.6.3-jre17/Dockerfile#L40
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #16664: KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images
URL: https://github.com/apache/kafka/pull/16664
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #16664:
URL: https://github.com/apache/kafka/pull/16664#issuecomment-2572216786
This PR is being marked as stale since it has not had any activity in 90 days. If you
would like to keep this PR alive, please leave a comment asking for a review. If the PR has
merge conflicts, update it with the latest from the base branch.
<p>
If you are having difficulty finding a reviewer, please reach out on the
[mailing list](https://kafka.apache.org/contact).
<p>
If this PR is no longer valid or desired, please feel free to close it. If no activity
occurs in the next 30 days, it will be automatically closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora01 (via GitHub)" <gi...@apache.org>.
KrishVora01 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1698254427
##########
docker/version_keys.py:
##########
@@ -0,0 +1,5 @@
+version_keys = {
Review Comment:
This change has been made
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora01 (via GitHub)" <gi...@apache.org>.
KrishVora01 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1689669392
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
+ keyserver.ubuntu.com \
+ hkp://keyserver.ubuntu.com:80 \
+ pgp.mit.edu \
+ hkp://keys.openpgp.org) ; do \
+ gpg --batch --keyserver "$server" --recv-keys "$GPG_KEY" && break || : ; \
+ done && \
gpg --batch --verify kafka.tgz.asc kafka.tgz
-# Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
-RUN /etc/kafka/docker/jsa_launch
+RUN mkdir opt/kafka; \
+ tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
+ # Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
+ /etc/kafka/docker/jsa_launch
FROM eclipse-temurin:21-jre-alpine
# exposed ports
EXPOSE 9092
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
ARG build_date
+ARG GPG_KEY
-
-LABEL org.label-schema.name="kafka" \
- org.label-schema.description="Apache Kafka" \
- org.label-schema.build-date="${build_date}" \
- org.label-schema.vcs-url="https://github.com/apache/kafka" \
+LABEL org.opencontainers.image.title="kafka" \
+ org.opencontainers.image.description="Apache Kafka" \
+ org.opencontainers.image.created="${build_date}" \
+ org.opencontainers.image.source="https://github.com/apache/kafka" \
maintainer="Apache Kafka"
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
made this change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #16664:
URL: https://github.com/apache/kafka/pull/16664#issuecomment-2791469517
This PR is being marked as stale since it has not had any activity in 90 days. If you
would like to keep this PR alive, please leave a comment asking for a review. If the PR has
merge conflicts, update it with the latest from the base branch.
<p>
If you are having difficulty finding a reviewer, please reach out on the
[mailing list](https://kafka.apache.org/contact).
<p>
If this PR is no longer valid or desired, please feel free to close it. If no activity
occurs in the next 30 days, it will be automatically closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1711592833
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
I think they will just complain, if they don't like it :-) - for Storm, we had one iteration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "VedarthConfluent (via GitHub)" <gi...@apache.org>.
VedarthConfluent commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1697910777
##########
docker/version_keys.py:
##########
@@ -0,0 +1,5 @@
+version_keys = {
Review Comment:
I think we should use json if we are using a separate file. It's just a more standard way of maintaining data like this imo. Overhead would be minimal imo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora01 (via GitHub)" <gi...@apache.org>.
KrishVora01 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1698255016
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
+ keyserver.ubuntu.com \
+ hkp://keyserver.ubuntu.com:80 \
+ pgp.mit.edu \
+ hkp://keys.openpgp.org) ; do \
+ gpg --batch --keyserver "$server" --recv-keys "$GPG_KEY" && break || : ; \
+ done && \
gpg --batch --verify kafka.tgz.asc kafka.tgz
-# Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
-RUN /etc/kafka/docker/jsa_launch
+RUN mkdir opt/kafka; \
+ tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
+ # Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
+ /etc/kafka/docker/jsa_launch
FROM eclipse-temurin:21-jre-alpine
# exposed ports
EXPOSE 9092
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
ARG build_date
+ARG GPG_KEY
-
-LABEL org.label-schema.name="kafka" \
- org.label-schema.description="Apache Kafka" \
- org.label-schema.build-date="${build_date}" \
- org.label-schema.vcs-url="https://github.com/apache/kafka" \
+LABEL org.opencontainers.image.title="kafka" \
+ org.opencontainers.image.description="Apache Kafka" \
+ org.opencontainers.image.created="${build_date}" \
+ org.opencontainers.image.source="https://github.com/apache/kafka" \
maintainer="Apache Kafka"
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Sure, we will add this to the documentation as part of the release process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora01 (via GitHub)" <gi...@apache.org>.
KrishVora01 commented on PR #16664:
URL: https://github.com/apache/kafka/pull/16664#issuecomment-2579964011
This PR is to be kept open as Docker Official Image PR is waiting on review from Dockerhub folks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "omkreddy (via GitHub)" <gi...@apache.org>.
omkreddy commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1690895201
##########
docker/version_keys.py:
##########
@@ -0,0 +1,5 @@
+version_keys = {
Review Comment:
1. maybe rename to version_gpg_keys
2. missing license
3. Can we add comment to the file about the format of this file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora01 (via GitHub)" <gi...@apache.org>.
KrishVora01 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1689668810
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
made this change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "VedarthConfluent (via GitHub)" <gi...@apache.org>.
VedarthConfluent commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1697877661
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
+ keyserver.ubuntu.com \
+ hkp://keyserver.ubuntu.com:80 \
+ pgp.mit.edu \
+ hkp://keys.openpgp.org) ; do \
+ gpg --batch --keyserver "$server" --recv-keys "$GPG_KEY" && break || : ; \
+ done && \
gpg --batch --verify kafka.tgz.asc kafka.tgz
-# Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
-RUN /etc/kafka/docker/jsa_launch
+RUN mkdir opt/kafka; \
+ tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
+ # Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
+ /etc/kafka/docker/jsa_launch
FROM eclipse-temurin:21-jre-alpine
# exposed ports
EXPOSE 9092
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
ARG build_date
+ARG GPG_KEY
-
-LABEL org.label-schema.name="kafka" \
- org.label-schema.description="Apache Kafka" \
- org.label-schema.build-date="${build_date}" \
- org.label-schema.vcs-url="https://github.com/apache/kafka" \
+LABEL org.opencontainers.image.title="kafka" \
+ org.opencontainers.image.description="Apache Kafka" \
+ org.opencontainers.image.created="${build_date}" \
+ org.opencontainers.image.source="https://github.com/apache/kafka" \
maintainer="Apache Kafka"
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Can we confirm that the list of key servers is going to cover all the GPG keys created in future? If not can we have a mechanism for the RM to add their GPG key server, if it's not present in the list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora01 (via GitHub)" <gi...@apache.org>.
KrishVora01 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1689688606
##########
docker/version_keys.py:
##########
@@ -0,0 +1,5 @@
+version_keys = {
Review Comment:
I used a python file for 2 main reasons
1. Simple json file has the overhead of opening the JSON file and loading its contents into a Python object, and use it further (boils down to the same as using a python dict)
2. Secondly, if for unsupported versions, we might want to remove GPG_KEYS, working with python dicts would be much simpler for any automation script we add.
LMK if these sound valid justifications for using a python dict as a new python file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora2912 (via GitHub)" <gi...@apache.org>.
KrishVora2912 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1690928197
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
+ keyserver.ubuntu.com \
+ hkp://keyserver.ubuntu.com:80 \
+ pgp.mit.edu \
+ hkp://keys.openpgp.org) ; do \
+ gpg --batch --keyserver "$server" --recv-keys "$GPG_KEY" && break || : ; \
+ done && \
gpg --batch --verify kafka.tgz.asc kafka.tgz
-# Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
-RUN /etc/kafka/docker/jsa_launch
+RUN mkdir opt/kafka; \
+ tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
+ # Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
+ /etc/kafka/docker/jsa_launch
FROM eclipse-temurin:21-jre-alpine
# exposed ports
EXPOSE 9092
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
ARG build_date
+ARG GPG_KEY
-
-LABEL org.label-schema.name="kafka" \
- org.label-schema.description="Apache Kafka" \
- org.label-schema.build-date="${build_date}" \
- org.label-schema.vcs-url="https://github.com/apache/kafka" \
+LABEL org.opencontainers.image.title="kafka" \
+ org.opencontainers.image.description="Apache Kafka" \
+ org.opencontainers.image.created="${build_date}" \
+ org.opencontainers.image.source="https://github.com/apache/kafka" \
maintainer="Apache Kafka"
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
This change does not work for all versions, so reverting to the original server list approach.
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
This change does not work for all versions, so reverting to the original server list approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora2912 (via GitHub)" <gi...@apache.org>.
KrishVora2912 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1694229575
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Hi @rzo1 ! Thanks for these suggestions!
A few small queries here:
> The guys from docker hub official won't like external download dependencies
By this you mean that they wont approve of something along the lines of
```
wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
gpg --import KEYS;
```
correct?
We did receive a comment from the Dockerhub folks regarding this (see Point 5 [here](https://github.com/docker-library/official-images/pull/16970#pullrequestreview-2151987928)).
So we went along and changed the above approach. Now we pass the GPG_KEY as an argument/environment variable, and then use something along the lines of [this](https://github.com/apache/kafka/pull/16664/files#diff-f2767afd27bb49c8cd265401dc953f9bd14eb7062418bb35fe089e928cf5b13dR37-L39).
I went through the approach followed by Storm, and that seems like a great way to approach this too. However, for Kafka, there are a lot of existing keys that are returned (see attached image), which might just inflate the length of the Dockerfile (hence we decided with the arg/env approach).
In your experience, do you think the modified approach ([here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R55), [here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R31-L38) and [here]([docker/version_gpg_keys.py](https://github.com/apache/kafka/pull/16664/files#diff-27e55a184b4d105f3922dbbed2250b084746361c81dc562429bade5b7459b544))) would be liked by the Dockerhub folks, or with the discussion you had for Storm, do you anticipate any issue in this approach too?
Thanks a lot again!
Krish.
<img width="322" alt="image" src="https://github.com/user-attachments/assets/513d4196-d98d-4c92-bcc0-52fba51b1164">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "VedarthConfluent (via GitHub)" <gi...@apache.org>.
VedarthConfluent commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1689572080
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
+ keyserver.ubuntu.com \
+ hkp://keyserver.ubuntu.com:80 \
+ pgp.mit.edu \
+ hkp://keys.openpgp.org) ; do \
+ gpg --batch --keyserver "$server" --recv-keys "$GPG_KEY" && break || : ; \
+ done && \
gpg --batch --verify kafka.tgz.asc kafka.tgz
-# Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
-RUN /etc/kafka/docker/jsa_launch
+RUN mkdir opt/kafka; \
+ tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
+ # Generate jsa files using dynamic CDS for kafka server start command and kafka storage format command
+ /etc/kafka/docker/jsa_launch
FROM eclipse-temurin:21-jre-alpine
# exposed ports
EXPOSE 9092
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
ARG build_date
+ARG GPG_KEY
-
-LABEL org.label-schema.name="kafka" \
- org.label-schema.description="Apache Kafka" \
- org.label-schema.build-date="${build_date}" \
- org.label-schema.vcs-url="https://github.com/apache/kafka" \
+LABEL org.opencontainers.image.title="kafka" \
+ org.opencontainers.image.description="Apache Kafka" \
+ org.opencontainers.image.created="${build_date}" \
+ org.opencontainers.image.source="https://github.com/apache/kafka" \
maintainer="Apache Kafka"
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Can we try using https://downloads.apache.org/kafka/KEYS for verification
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1693017471
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
The guys from docker hub official won't like external download dependencies - we had that discussion for Storm a few months ago. We workaround that for Apache Storm here: https://github.com/apache/storm-docker/blob/master/automation/create-key-section.sh and here https://github.com/apache/storm-docker/blob/master/2.6.3-jre17/Dockerfile#L40 - might also an option for Kafka ;-)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora2912 (via GitHub)" <gi...@apache.org>.
KrishVora2912 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1694229575
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Hi @rzo1 ! Thanks for these suggestions!
A few small queries here:
> The guys from docker hub official won't like external download dependencies
By this you mean that they wont approve of something along the lines of
```
wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
gpg --import KEYS;
```
correct?
We did receive a comment from the Dockerhub folks regarding this (see Point 5 [here](https://github.com/docker-library/official-images/pull/16970#pullrequestreview-2151987928)).
So we went along and changed the above approach. Now we pass the GPG_KEY as an argument/environment variable, and then use something along the lines of [this](https://github.com/apache/kafka/pull/16664/files#diff-f2767afd27bb49c8cd265401dc953f9bd14eb7062418bb35fe089e928cf5b13dR37-L39).
I went through the approach followed by Storm, and that seems like a great way to approach this too. However, for Kafka, there are a lot of existing keys that are returned (see attached image), which might just inflate the length of the Dockerfile (hence we decided with the arg/env approach).
In your experience, do you think the modified approach ([here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R55), [here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R31-L38) and [here]([docker/version_gpg_keys.py](https://github.com/apache/kafka/pull/16664/files#diff-27e55a184b4d105f3922dbbed2250b084746361c81dc562429bade5b7459b544))) would be liked by the Dockerhub folks, or with the discussion you had for Storm, do you anticipate any issue in this approach too?
Thanks a lot again!
Krish.
<img width="322" alt="image" src="https://github.com/user-attachments/assets/513d4196-d98d-4c92-bcc0-52fba51b1164">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora2912 (via GitHub)" <gi...@apache.org>.
KrishVora2912 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1694229575
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Hi @rzo1 ! Thanks for these suggestions!
A few small queries here:
> The guys from docker hub official won't like external download dependencies
By this you mean that they wont approve of something along the lines of
```
wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
gpg --import KEYS;
```
correct?
We did receive a comment from the Dockerhub folks regarding this (see Point 5 [here](https://github.com/docker-library/official-images/pull/16970#pullrequestreview-2151987928)).
So we went along and changed the above approach. Now we pass the GPG_KEY as an argument/environment variable, and then use something along the lines of [this](https://github.com/apache/kafka/pull/16664/files#diff-f2767afd27bb49c8cd265401dc953f9bd14eb7062418bb35fe089e928cf5b13dR37-L39).
I went through the approach followed by Storm, and that seems like a great way to approach this too. However, for Kafka, there are a lot of existing keys that are returned (see attached image), which might just inflate the length of the Dockerfile (hence we decided with the arg/env approach).
In your experience, do you think the modified approach ([here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R55), [here](https://github.com/apache/kafka/pull/16664/files#diff-a7db7423c4ada0c09e7b71f05aeeba480b2b305b481004702cc63299259c0317R31-L38) and [here](https://github.com/apache/kafka/pull/16664/files#diff-27e55a184b4d105f3922dbbed2250b084746361c81dc562429bade5b7459b544)) would be liked by the Dockerhub folks, or with the discussion you had for Storm, do you anticipate any issue in this approach too?
Thanks a lot again!
Krish.
<img width="322" alt="image" src="https://github.com/user-attachments/assets/513d4196-d98d-4c92-bcc0-52fba51b1164">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #16664:
URL: https://github.com/apache/kafka/pull/16664#issuecomment-2868303911
This PR has been closed since it has not had any activity in 120 days. If you feel like this
was a mistake, or you would like to continue working on it, please feel free to re-open the
PR and ask for a review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "VedarthConfluent (via GitHub)" <gi...@apache.org>.
VedarthConfluent commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1689572992
##########
docker/jvm/Dockerfile:
##########
@@ -18,58 +18,63 @@
FROM eclipse-temurin:21-jre-alpine AS build-jsa
-USER root
-
# Get kafka from https://archive.apache.org/dist/kafka and pass the url through build arguments
ARG kafka_url
+ARG GPG_KEY
COPY jsa_launch /etc/kafka/docker/jsa_launch
RUN set -eux ; \
- apk update ; \
- apk upgrade ; \
apk add --no-cache wget gcompat gpg gpg-agent procps bash; \
- mkdir opt/kafka; \
wget -nv -O kafka.tgz "$kafka_url"; \
wget -nv -O kafka.tgz.asc "$kafka_url.asc"; \
- tar xfz kafka.tgz -C /opt/kafka --strip-components 1; \
- wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; \
- gpg --import KEYS; \
+ for server in ha.pool.sks-keyservers.net $(shuf -e \
+ hkp://p80.pool.sks-keyservers.net:80 \
Review Comment:
Can we try using https://downloads.apache.org/kafka/KEYS for verification
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "VedarthConfluent (via GitHub)" <gi...@apache.org>.
VedarthConfluent commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1689564278
##########
docker/version_keys.py:
##########
@@ -0,0 +1,5 @@
+version_keys = {
Review Comment:
Can we use json file instead. I don't think we should be creating a separate python file for this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16373: KIP-1028: Addressing Docker Official Images PR Comments for JVM, Native and Docker Official Images [kafka]
Posted by "KrishVora2912 (via GitHub)" <gi...@apache.org>.
KrishVora2912 commented on code in PR #16664:
URL: https://github.com/apache/kafka/pull/16664#discussion_r1690910548
##########
docker/version_keys.py:
##########
@@ -0,0 +1,5 @@
+version_keys = {
Review Comment:
Thanks for the review @omkreddy .
1. Renamed this to version_gpg_keys, the name now better reflects what the file stands for.
2, 3: Sorry, missed out on adding these! Added the same to the scripts.
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org