From 5aa2bd33f353c0cb61a37b4b18fd0b466fef8f69 Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Mon, 6 Apr 2026 13:32:15 +0700 Subject: [PATCH] Switch Scribe to CentOS 7 and add publish workflow CentOS 7 eliminates the automake 1.14+ patch needed on Ubuntu. Add GitHub Actions workflow to publish to GHCR and Docker Hub. --- .github/workflows/publish-scribe-2.2.yml | 63 +++++++++++++++++++ scribe/Dockerfile | 79 ++++++++++-------------- 2 files changed, 94 insertions(+), 48 deletions(-) create mode 100644 .github/workflows/publish-scribe-2.2.yml diff --git a/.github/workflows/publish-scribe-2.2.yml b/.github/workflows/publish-scribe-2.2.yml new file mode 100644 index 0000000..b68e7da --- /dev/null +++ b/.github/workflows/publish-scribe-2.2.yml @@ -0,0 +1,63 @@ +name: Publish Docker image + +on: + push: + branches: + - 'main' + paths: + - 'scribe/**' + - '.github/workflows/publish-scribe-2.2.yml' + workflow_dispatch: + +jobs: + push_to_registries: + name: Push Docker image to multiple registries + runs-on: ubuntu-latest + permissions: + packages: write + contents: read + attestations: write + id-token: write + steps: + - name: Check out the repo + uses: actions/checkout@v5 + + - name: Log in to Docker Hub + uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a + with: + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKER_PASSWORD }} + + - name: Log in to the Container registry + uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 + with: + images: | + ghcr.io/${{ github.actor }}/scribe + ${{ secrets.DOCKER_USERNAME }}/scribe + tags: | + type=raw,value=latest + type=raw,value=2.2 + + - name: Build and push Docker images + id: push + uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 + with: + context: scribe + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + - name: Generate artifact attestation + uses: actions/attest-build-provenance@v3 + with: + subject-name: ghcr.io/${{ github.actor }}/scribe + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true diff --git a/scribe/Dockerfile b/scribe/Dockerfile index 277b3eb..6dda559 100644 --- a/scribe/Dockerfile +++ b/scribe/Dockerfile @@ -1,41 +1,28 @@ # ───────────────────────────────────────────────────────────── # Stage 1: builder -# Compiles Apache Thrift 0.9.1 (last version compatible with -# the Scribe Thrift IDL) and then Scribe itself from source. +# CentOS 7 chosen because automake 1.13 predates the 1.14+ +# "global options already processed" bug, and OpenSSL 1.0.2 +# has BN_init (required by Thrift 0.9.1). # ───────────────────────────────────────────────────────────── -FROM ubuntu:16.04 AS builder - -# Avoid interactive prompts during package installation -ARG DEBIAN_FRONTEND=noninteractive +FROM centos:7 AS builder # Versions pinned for reproducibility ENV THRIFT_VERSION=0.9.1 -ENV SCRIBE_GIT_REF=master + +# ── Point yum to vault (CentOS 7 is EOL) ──────────────────── +RUN sed -i 's|^mirrorlist=|#mirrorlist=|g; s|^#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' \ + /etc/yum.repos.d/CentOS-Base.repo # ── Build-time dependencies ────────────────────────────────── -RUN apt-get update && apt-get install -y --no-install-recommends \ - build-essential \ - autoconf \ - automake \ - libtool \ - pkg-config \ - git \ - wget \ - ca-certificates \ - # Thrift code-generation tools - flex \ - bison \ - # Boost (filesystem, system, thread required by Scribe) - libboost-dev \ - libboost-filesystem-dev \ - libboost-system-dev \ - libboost-thread-dev \ - # libevent (async I/O used by Thrift non-blocking server) - libevent-dev \ - # OpenSSL (Thrift TLS transport) - libssl-dev \ - zlib1g-dev \ - && rm -rf /var/lib/apt/lists/* +RUN yum install -y \ + gcc gcc-c++ make autoconf automake libtool \ + git wget \ + flex bison \ + boost-devel \ + libevent-devel \ + openssl-devel \ + zlib-devel \ + && yum clean all # ── Build Apache Thrift ────────────────────────────────────── # Scribe uses the old Facebook Thrift IDL and C++ runtime, which @@ -74,18 +61,12 @@ RUN set -eux; \ # ── Build Scribe ───────────────────────────────────────────── # Facebook archived Scribe at https://github.com/facebookarchive/scribe -# Scribe's FB_INITIALIZE macro conflicts with AM_INIT_AUTOMAKE, causing -# automake to crash with "global options already processed". We patch -# automake to downgrade that fatal error to a warning. -RUN sed -i '/prog_error.*global options already processed/{N;d}' \ - /usr/share/automake-*/Automake/Options.pm - RUN set -eux; \ git clone --depth 1 \ https://github.com/facebookarchive/scribe.git /tmp/scribe; \ cd /tmp/scribe; \ autoreconf --force --install; \ - sed -i 's|BOOSTLIBDIR=`echo $BOOST_LDFLAGS.*|BOOSTLIBDIR=/usr/lib/x86_64-linux-gnu|g' configure; \ + sed -i 's|BOOSTLIBDIR=`echo $BOOST_LDFLAGS.*|BOOSTLIBDIR=/usr/lib64|g' configure; \ ./configure LIBS="-lboost_system -lboost_filesystem"; \ make -j"$(nproc)" -C src; \ make -C src install; \ @@ -97,28 +78,30 @@ RUN set -eux; \ # Minimal image containing only the runtime libraries and the # compiled scribed binary. # ───────────────────────────────────────────────────────────── -FROM ubuntu:16.04 +FROM centos:7 LABEL maintainer="Tien Nguyen Minh " LABEL description="Facebook Legacy Scribe – real-time log aggregation daemon" LABEL version="2.2" -ARG DEBIAN_FRONTEND=noninteractive +# ── Point yum to vault (CentOS 7 is EOL) ──────────────────── +RUN sed -i 's|^mirrorlist=|#mirrorlist=|g; s|^#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' \ + /etc/yum.repos.d/CentOS-Base.repo # ── Runtime-only shared libraries ──────────────────────────── -RUN apt-get update && apt-get install -y --no-install-recommends \ - libboost-filesystem1.58.0 \ - libboost-system1.58.0 \ - libboost-thread1.58.0 \ - libevent-2.0-5 \ - libssl1.0.0 \ - libstdc++6 \ - && rm -rf /var/lib/apt/lists/* +RUN yum install -y \ + boost-filesystem \ + boost-system \ + boost-thread \ + libevent \ + openssl \ + && yum clean all # Copy only what is needed from the builder stage COPY --from=builder /usr/local/bin/scribed /usr/local/bin/scribed COPY --from=builder /usr/local/lib/libthrift*.so* /usr/local/lib/ -RUN ldconfig +COPY --from=builder /usr/local/lib/libfb303*.so* /usr/local/lib/ +RUN echo "/usr/local/lib" > /etc/ld.so.conf.d/scribe.conf && ldconfig # ── Least-privilege user ───────────────────────────────────── RUN groupadd -r scribe \