Publish a Docker image

[emersion]

Currently, Docker users need to add the following line to their Dockerfile:

ADD https://github.com/kyubisation/angular-server-side-configuration/releases/download/v22.0.2/ngssc_64bit /usr/sbin/ngssc

This has downsides:

• Dependabot cannot discover that this binary needs to be updated. The binary tends to become stale because no-one notices it's badly outdated.
• The architecture needs to be hardcoded. The above line doesn't work on ARM64, for instance.

Publishing a Docker image would allow users to copy the binary from there instead.

Alternatively, publishing an NPM package with the CLI would be possible as well.

[kyubisation]

Hello there

If you use ng update angular-server-side-configuration it will automatically look for Dockerfile usages and update them to the version installed with ng update.
As for the CPU architecture, you can use ARG TARGETARCH (see https://docs.docker.com/reference/dockerfile/#automatic-platform-args-in-the-global-scope) and then use ADD https://github.com/kyubisation/angular-server-side-configuration/releases/download/v22.0.2/ngssc_$TARGETARCH /usr/sbin/ngssc.

Maintaining a container image is a larger maintenance burden, for which I am hesitant to commit to.
Publishing the CLI via npm would increase the bundle size by about 20MB, which feels like bloat (as every platform would most likely need the linux binaries for container builds, but also the local binaries for testing locally). I am not fully opposed to this, but I question the added value.
Alternatively I could extract the CLI to its own repository/package, so it does not update as "often" as angular-server-side-configuration does, as the API of the CLI very seldomly changes.
Does the update and arch configuration work for you or would you still like an alternative?

[emersion]

If you use ng update angular-server-side-configuration it will automatically look for Dockerfile usages and update them to the version installed with ng update.

That only works when the developer remembers to run ng update instead of npm update for this dependency. Moreover, Dependabot doesn't use ng update.

As for the CPU architecture, you can use ARG TARGETARCH

Unfortunately angular-server-side-configuration uses the 64bit prefix instead of amd64, so this approach would require more fiddling with variables.

Maintaining a container image is a larger maintenance burden, for which I am hesitant to commit to.

I understand. FWIW, it should be fairly low maintenance if it's integrated in CI and uses GitHub's container registry.

I could extract the CLI to its own repository/package

That would be helpful. One could then COPY the CLI tool from the build container to the production one.

[kyubisation]

https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v22.0.2
The available binaries include the suggested pattern.

Knowing the current process at my company in dealing with CVE and affected libraries/images, I would need to create weekly releases/updates, which I am not willing to invest at the moment.
Although my initial thoughts were about providing an nginx image with the binary included, but it would also be possible to just create an empty image with only the binary included.
Was that your suggested solution or would that work for you?

[emersion]

The available binaries include the suggested pattern.

Ah, nice! I missed this somehow.

Knowing the current process at my company in dealing with CVE and affected libraries/images, I would need to create weekly releases/updates, which I am not willing to invest at the moment.

Hm, why would weekly updates be required for an image/package, but not for binaries attached to a GitHub release?

I completely understand and agree that weekly releases/updates would be too much of a burden.

Although my initial thoughts were about providing an nginx image with the binary included, but it would also be possible to just create an empty image with only the binary included.

An empty image with just the binary included was exactly what I had in mind.

[kyubisation]

I fully misunderstood your request.
My mind automatically went towards providing an nginx base image with the binary included.
Extending an nginx image, which updates weekly, would also require me to update that base image weekly.

To publish a container image with just the binary should be no significant effort and I will see what I can do.
It might take me a while to implement this, but you should be able to expect an update during September.

[emersion]

Sweet! Would you be interested in a patch which implements this?

[kyubisation]

Sure. Feel free to take a shot. 👍