best practices for using rhel based images (UBI) and integration in CI/CD with ddev

[delphisinformatica]

Hi!

we are being asked to integrate an application whose developers are using ddev on their workstations in an existing environment which is fully rhel based and has an existing CI/CD based on gitlab. the application is laravel based with a little bit of nodejs sprinkled around.

the existing environment has strict security requirements, non root UID/GID in containers, selinux enabled on the hosts, custom base images that are scanned for known CVE, yadda yadda yadda, it will all be deployed both to kubernetes/openshift and single servers with podman container runtimes.

we are doing the devops part and have never used ddev ourselves, we're going through the documentation right now, already built some basic projects to understand what it does and how it does it and we are wondering if anyone has gone through something similar and if there's known footguns and/or best practices, we're open to suggestions and input from the community.

We're aware that ddev is mainly focused on local development but obvioulsy this has an impact when you have an existing CI/CD and the above deployment requirements so that everything goes smoothly.

basically we are looking at overwriting the BASE_IMAGE and/or leveraging multistage build to start from rhel UBI images while mantaining the various goodies ddev comes with for the local development experience and minimize disruptions when building for the targe deployment env in the CI/CD.

https://docs.ddev.com/en/stable/users/extend/customizing-images/

[stasadev]

Hi @delphisinformatica,

we are wondering if anyone has gone through something similar and if there's known footguns and/or best practices

No, we don't have any known cases.

start from rhel UBI images while mantaining the various goodies ddev comes with

This would likely be hard to do because we depend on the deb.sury.org repo for all PHP versions, and DDEV uses many apt-get calls across its bash scripts and Go codebase.

We have the webimage config, that is meant for this, but DDEV will fail when the image is not Debian-based.

CI/CD based on gitlab

https://github.com/ddev/ddev-gitlab-ci

podman container runtimes
selinux enabled on the hosts

Interesting that we're going to support both of these (#7702, #7939) in the next DDEV release.

[delphisinformatica]

This would likely be hard to do because we depend on the deb.sury.org repo for all PHP versions, and DDEV uses many apt-get calls across its bash scripts and Go codebase.

I had a look at the dockerfile/repo for ddev-webserver and was worried about that, you are confirming to me it would be an uphill battle, we are now considering bringing the debian based images to the target prod deployment environments (podman and k8s).

we will try to leverage the docker image customization tools to make sure there's no UID/GID<1000 and other adjacent settings (you already have hardened_images: true, which should help with this).
also considering the following:

Interesting that we're going to support both of these (#7702, #7939) in the next DDEV release.

we're going to look forward to this to integrate with our environment more easily

CI/CD based on gitlab
https://github.com/ddev/ddev-gitlab-ci

I'll have a look and see how to leverage it for our needs. thanks

[rfay]

We strongly discourage you from trying to recreate the ddev-webserver image with another base. DDEV is not built for this case, and you end up maintaining everything yourself. And we will break your implementation every time DDEV itself does something new or different with the image

Instead of that, DDEV provides an easy way to add layers to the existing webserver. Please see https://docs.ddev.com/en/stable/users/extend/customizing-images/