Commit 0f0be976 authored by Clement Bois's avatar Clement Bois Committed by Pierre Smeyers
Browse files

docs: support externally built image

parent 33c6d6e7

README.md

+16 −1
Original line number Diff line number Diff line
@@ -54,13 +54,15 @@ select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable (see be 


:warning: If you choose to use 'Docker-in-Docker' option considering the associated security risks, make sure your runner has required privileges to run Docker-in-Docker ([see GitLab doc](https://docs.gitlab.com/ci/docker/using_docker_build/#use-docker-in-docker-workflow-with-docker-executor)).



You can also disable the building of the Docker image to only run security checks and publishing ([see below](#using-an-external-docker-registry)).



### Global variables



The Docker template uses some global configuration used throughout all jobs.



| Input / Variable                         | Description                                                                                                                                    | Default value                                                                       |

| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |

| `build-tool` / `DOCKER_BUILD_TOOL`       | The build tool to use for building container image, possible values are `kaniko`, `buildah` or `dind`                                          | `kaniko`                                                                            |

| `build-tool` / `DOCKER_BUILD_TOOL`       | The build tool to use for building container image, possible values are `kaniko`, `buildah`, `dind` or `external`                              | `kaniko`                                                                            |

| `kaniko-image` / `DOCKER_KANIKO_IMAGE`   | The image used to run `kaniko` - _for kaniko build only_                                                                                       | `gcr.io/kaniko-project/executor:debug` (use `debug` images for GitLab)<br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_KANIKO_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_KANIKO_IMAGE)|

| `buildah-image` / `DOCKER_BUILDAH_IMAGE` | The image used to run `buildah` - _for buildah build only_                                                                                     | `quay.io/containers/aio:latest`<br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_BUILDAH_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_BUILDAH_IMAGE)|

| `image` / `DOCKER_IMAGE`                 | The Docker image used to run the docker client (see [full list](https://hub.docker.com/r/library/docker/)) - _for Docker-in-Docker build only_ | `registry.hub.docker.com/library/docker:latest`<br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_IMAGE) |
@@ -593,6 +595,19 @@ include: 
        DOCKER_RELEASE_IMAGE: "$CI_REGISTRY_IMAGE/back:$CI_COMMIT_REF_NAME"

```



### Using an externally built Docker image



If you want to use the template with an externally built Docker image (scan for vulnerabilities, extract SBOM, test, promote...), you can skip build jobs by setting the `DOCKER_BUILD_TOOL` variable to `external`:



```yaml

include:

  - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@6.1.7

    inputs:

      build-tool: "external"

      snapshot-image: "registry.acme.host/image:tag" # externally built image

      hadolint-disabled: true # if Dockerfile is not available, disable Hadolint job

```



## Variants



The Docker template can be used in conjunction with template variants to cover specific cases.

kicker.json

+1 −1
Original line number Diff line number Diff line
@@ -9,7 +9,7 @@ 
    {

      "name": "DOCKER_BUILD_TOOL",

      "type": "enum",

      "values": ["kaniko", "buildah", "dind"],

      "values": ["kaniko", "buildah", "dind", "external"],

      "description": "The build tool to use for building container image",

      "default": "kaniko"

    },

templates/gitlab-ci-docker.yml

+1 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ spec: 
      - kaniko

      - buildah

      - dind

      - external

      default: kaniko

    kaniko-image:

      description: |-