feat: Switch to wolfi-base image

.github/workflows/tests.yml

@@ -105,9 +105,9 @@ jobs:
           docker build -t test-image --platform=${{ matrix.docker_platform }} --build-arg=ARCH_ORG=${{ matrix.arch_org }} .
       - name: Test if git works inside container
         run: |
-          # test if the git binary is still working, which keep breaking due to wolfi-base updates being missed
-          # If you see this failing, it's time to upgrade the base image in Dockerfile...
-          docker run --platform=${{ matrix.docker_platform }} --rm -i --entrypoint=/bin/sh test-image -c "cd && git clone https://github.com/kluctl/kluctl.git"
+          # test if Jinja2 rendering is still working. It might break if the glic version from wolfi-base is not
+          # recent enough to support the embedded Python distribution.
+          docker run --platform=${{ matrix.docker_platform }} --rm -i --entrypoint=/bin/sh test-image -c "/usr/bin/template-controller -test-jinja2"
 
   tests:
     runs-on: ubuntu-22.04

.goreleaser.yaml

@@ -27,8 +27,6 @@ dockers:
     goarch: amd64
     build_flag_templates:
       - "--pull"
-      - "--build-arg=ARCH=linux-amd64"
-      - "--build-arg=ARCH_ORG=amd64"
       - "--label=org.opencontainers.image.created={{ .Date }}"
       - "--label=org.opencontainers.image.name={{ .ProjectName }}"
       - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
@@ -42,8 +40,6 @@ dockers:
     goarch: arm64
     build_flag_templates:
       - "--pull"
-      - "--build-arg=ARCH=linux-arm64"
-      - "--build-arg=ARCH_ORG=arm64v8"
       - "--label=org.opencontainers.image.created={{ .Date }}"
       - "--label=org.opencontainers.image.name={{ .ProjectName }}"
       - "--label=org.opencontainers.image.revision={{ .FullCommit }}"

Dockerfile

@@ -1,12 +1,17 @@
-ARG ARCH_ORG
+# We must use a glibc based distro due to embedded python not supporting musl libc for aarch64 (only amd64+musl is supported)
+# see https://github.com/indygreg/python-build-standalone/issues/87
+# use `docker buildx imagetools inspect cgr.dev/chainguard/wolfi-base:latest` to find latest sha256 of multiarch image
+ARG WOLFI_DIGEST=sha256:5cc4736f5a03e9ba618760e5b21c1f1bc0ce275fc6ba86589c8dd26374c2647b
+FROM --platform=$TARGETPLATFORM cgr.dev/chainguard/wolfi-base@$WOLFI_DIGEST
 
-# We must use a glibc based distro due to embedded python not supporting musl libc for aarch64
-FROM $ARCH_ORG/debian:bullseye-slim
+# See https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
+ARG TARGETPLATFORM
 
-# We meed git for kustomize to support overlays from git
-RUN apt update && apt install git -y && rm -rf /var/lib/apt/lists/*
+RUN apk update && apk add tzdata
+
+ENV KLUCTL_CACHE_DIR=/tmp/kluctl-cache
 
 COPY bin/template-controller /usr/bin/
 USER 65532:65532
 
-ENTRYPOINT ["/manager"]
+ENTRYPOINT ["/usr/bin/template-controller"]

go.mod

@@ -7,10 +7,10 @@ require (
 	github.com/gobwas/glob v0.2.3
 	github.com/google/go-github/v47 v47.1.0
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/kluctl/go-jinja2 v0.0.0-20240619083358-c137395943eb
-	github.com/kluctl/kluctl/lib v0.0.0-20240708111940-7d9465ba9662
+	github.com/kluctl/go-jinja2 v0.0.0-20240708212116-03ee7eefba4f
+	github.com/kluctl/kluctl/lib v0.0.0-20240708210331-4b60c060bd56
 	github.com/ohler55/ojg v1.22.1
-	github.com/onsi/ginkgo v1.16.5
+	github.com/onsi/ginkgo/v2 v2.19.0
 	github.com/onsi/gomega v1.33.1
 	github.com/xanzy/go-gitlab v0.106.0
 	golang.org/x/oauth2 v0.21.0
@@ -50,13 +50,15 @@ require (
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.22.0 // indirect
+	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -76,8 +78,6 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nxadm/tail v1.4.11 // indirect
-	github.com/onsi/ginkgo/v2 v2.19.0 // indirect
 	github.com/otiai10/copy v1.14.0 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -102,10 +102,10 @@ require (
 	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect