Updates.

What I have in production and GitLab CI/CD.

.gitlab-ci.yml

+---
+image: adarnimrod/ci-images:docker
+
+stages:
+  - test
+  - build
+  - run
+
+pre-commit:
+  stage: test
+  image: adarnimrod/ci-images:pre-commit
+  variables:
+    XDG_CACHE_HOME: "$CI_PROJECT_DIR/.cache"
+    # Disabled until https://github.com/pre-commit/pre-commit/issues/1387 is
+    # resolved.
+    SKIP: "hadolint,docker-compose"
+  script:
+    - pre-commit run --all-files
+  cache:
+    paths:
+      - .cache/
+
+build:
+  stage: build
+  tags: ["host01.shore.co.il"]
+  variables:
+    COMPOSE_DOCKER_CLI_BUILD: "1"
+    DOCKER_BUILDKIT: "1"
+  script:
+    - docker-compose build --no-cache --pull
+    - docker-compose pull --quiet
+
+run:
+  stage: run
+  tags: ["host01.shore.co.il"]
+  when: manual
+  script:
+    - docker-compose up --detach --remove-orphans
+    # yamllint disable rule:line-length
+    - |
+        for i in $(seq 12)
+        do
+            docker container inspect --format '{{ .State.Health.Status }}' $(docker-compose ps -q) | grep -v '^healthy$' || break
+            sleep 10
+        done
+        ! docker container inspect --format '{{ .State.Health.Status }}' $(docker-compose ps -q) | grep -v '^healthy$'

.pre-commit-config.yaml

@@ -2,14 +2,15 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v2.4.0
+    rev: v2.3.0
     hooks:
       - id: check-added-large-files
       - id: check-merge-conflict
+      - id: detect-private-key
       - id: trailing-whitespace
         exclude: \.diff$
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.19.0
+    rev: v1.17.0
     hooks:
       - id: yamllint
   - repo: https://github.com/amperser/proselint/
@@ -17,9 +18,14 @@ repos:
     hooks:
       - id: proselint
         types: [plain-text]
-        exclude: LICENSE|requirements
-  - repo: https://www.shore.co.il/git/docker-pre-commit
+        exclude: LICENSE
+  - repo: https://git.shore.co.il/nimrod/docker-pre-commit.git/
     rev: v0.3.0
     hooks:
       - id: hadolint
       - id: docker-compose
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v0.13.0
+    hooks:
+      - id: detect-secrets
+        exclude: \.diff$

Dockerfile

@@ -10,6 +10,7 @@ RUN apt-get update && \
         python3-docutils \
         python3-markdown \
         python3-pygments \
+        wget \
     && \
     setcap CAP_NET_BIND_SERVICE=+ep /usr/sbin/apache2 && \
     a2enmod cgid && \
@@ -31,9 +32,9 @@ ENV APACHE_RUN_DIR=/run/apache2 \
     APACHE_PID_FILE=/run/apache2/apache2.pid
 RUN patch --strip 0 --verbose --directory /etc/apache2 --input /root/patch.diff && \
     apache2 -t
-EXPOSE 8080
+EXPOSE 80
 CMD [ "apache2", "-DFOREGROUND" ]
 VOLUME ["/srv/git"]
 USER "www-data"
 WORKDIR /var/www
-HEALTHCHECK CMD wget --spider --quiet http://localhost:8080/cgit/ --user-agent 'Healthcheck' || exit 1
+HEALTHCHECK CMD wget --spider --quiet http://localhost:80/cgit/ --user-agent 'Healthcheck' || exit 1

docker-compose.yml

@@ -4,19 +4,14 @@ version: '3.5'
 services:
   cgit:
     build:
+      # cache_from:
+      #   - adarnimrod/cgit
       context: .
-      cache_from:
-        - adarnimrod/cgit
-    image: adarnimrod/cgit
-    ports:
-      - 80:80
+    # image: adarnimrod/cgit
+    restart: always
     volumes:
-      - git:/srv/git:ro
-
-volumes:
-  git:
-    labels:
-      snapshot: 'true'
+      - /var/lib/git:/srv/git:ro
+      - /etc/passwd:/etc/passwd:ro
 
 networks:
   default: