🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

📦 धडा 07 — image build आणि push करा: फोटोकॉपी मशीन

📍 तुम्ही इथे आहात: 12 पैकी धडा 07 · मागे: lesson-06-secrets-oidc · पुढे: lesson-08-environments-gates

📦 या ब्रँचमध्ये काय आहे

धडे 01–06, आणि फोटोकॉपी डेस्क: तपासलेला गृहपाठ डबा बनतो, त्याला commit चा ठसा मिळतो, आणि तो लॉकरमध्ये ठेवला जातो. खऱ्या files:

.github/workflows/ship.yml — build job (build, smoke-test, save) आणि push job (load, बॅज, ECR login, tag, push)
app/Dockerfile आणि app/server.js — ARG APP_VERSION आत भाजून बसवले जाते, आणि / version … छापते म्हणजे चालू copy आपण कोणता commit आहोत ते सांगू शकते
.circleci/config.yml, .gitlab-ci.yml, Jenkinsfile — तेच build, smoke, tag, push प्रत्येकी एकाच job मध्ये

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

तपासणी डेस्कने ✅ गृहपाठावर शिक्का मारला. आता फोटोकॉपी मशीन 🍱 सूचना फलकांवर जाणारी प्रत काढते, आणि या डेस्कच्या तीन सवयी आहेत.

प्रत काढतानाच त्यावर ठसा लिहा. Commit ला 40 अक्षरांचा ठसा असतो, तो म्हणजे SHA. त्याची पहिली 7 अक्षरे डब्याच्या आत APP_VERSION म्हणून जातात, म्हणजे चालू ॲप "तू कोणती प्रत आहेस?" याचे उत्तर देऊ शकतो. पूर्ण SHA label वर जातो — image चा tag — म्हणजे लॉकरची फळी त्याच प्रश्नाचे उत्तर नावाने देते. latest नाही, main नाही: ते आठवड्या-आठवड्याला वेगवेगळ्या bytes कडे निर्देश करतात.

ठेवण्याआधी प्रत नीट पाहा. Tests runner च्या Node वर चालल्या; डब्याचे स्वतःचे Node, स्वतःच्या files, स्वतःचा port असतो. म्हणून डेस्क डबा सुरू करतो, /healthz उत्तर देईपर्यंत विचारत राहतो, आणि / अपेक्षित version छापते का ते तपासतो. तो डब्याचा smoke test आहे, कोडचा नाही.

नीट हस्तांतरण करा. फोटोकॉपी मशीन आणि फाइलिंग डेस्क वेगवेगळ्या खोल्यांमध्ये आहेत, म्हणून प्रत धडा 05 च्या पाकिटातून प्रवास करते; फाइलिंग डेस्क धडा 06 च्या डे पासने लॉकर 🏦 उघडतो; लॉकर प्रत्येक नव्या डब्याचा X-ray काढतो (scan on push).

🗺️ आकृती

flowchart LR
    build["🍱 docker build<br/>--build-arg APP_VERSION=abc1234"]
    smoke["🧪 smoke-test the BOX<br/>curl /healthz, grep version abc1234"]
    env["📎 image.tar.gz<br/>docker save, then gzip"]
    push["🚚 push job, another machine<br/>docker load, 🪪 badge, 🎫 ECR login"]
    ecr["🏦 ECR hello-courier:abc1234…<br/>tag = full SHA, scan on push"]
    build -->|"1 run it"| smoke
    smoke -->|"2 only if it answers"| env
    env -->|"3 download by name"| push
    push -->|"4 docker push"| ecr

❓ काय

Build argument = --build-arg APP_VERSION=… → Dockerfile मध्ये ARG → ENV → server.js मध्ये process.env.APP_VERSION. Version label म्हणजे short SHA (7 अक्षरे).
Smoke test = container सुरू करा, /healthz 200 देईपर्यंत विचारत राहा, मग / version <short SHA> छापते का ते तपासा. यावरून सिद्ध होते की डबा सुरू होतो, port 3000 वर ऐकतो, आणि याच commit पासून build झाला आहे.
Image tag = पूर्ण commit SHA (40 अक्षरे). तोच tag, तेच bytes; git show <sha> कोड शोधतो; नंतरचा deploy म्हणजे "ही string बदला". हलणारा tag (main, latest) कालांतराने वेगवेगळ्या images कडे निर्देश करतो — bookmark म्हणून ठीक, deploy target म्हणून चुकीचा.
Scan on push = ECR प्रत्येक नव्या image चे layers ओळखीच्या CVEs साठी तपासते; ही repository ची setting आहे, pipeline ची नाही.

🧠 एकच ठसा, आत आणि बाहेर

commit  abc1234ef56…  (40 chars — git's fingerprint of the code)
   ├─ INSIDE the box:  APP_VERSION=abc1234            (short SHA — what the app prints)
   └─ ON the label:    hello-courier:abc1234ef56…     (full SHA — what you deploy by)

Tag विरुद्ध digest. Commit-SHA tag आपल्याला सांगतो की image कोणत्या source revision पासून बनली; image चा digest (sha256:…, docker image inspect आणि ECR console मध्ये दिसतो) नेमके, न बदलणारे image bytes ओळखतो. तोच commit दोनदा build करा आणि तुम्हाला एक tag पण कदाचित दोन digests मिळतील — tag म्हणजे पत्ता, digest म्हणजे ओळख, जसे Docker शाळेचा धडा 11 सांगतो. याच कारणासाठी धडा 12 base images digest ने pin करतो.

🤔 का

Version आत भाजून बसवलेले नसेल तर "कोणते version चालू आहे?" हा अंदाजच असतो. Smoke test शिवाय, एखादी file विसरणारी Dockerfile unit tests पास करते आणि पहिल्याच readiness probe ला मरते. SHA tags शिवाय, "कालचे परत लावा" अशक्य होते, latest गपचूप खोटे बोलतो, आणि नंतरच्या GitOps commits कडे बदलण्यासारखे अर्थपूर्ण काहीच नसते. Docker शाळेचा धडा 12 नेमक्या याच हस्तांतरणावर संपतो; त्याचा धडा 08 tag स्वच्छतेबद्दल सांगतो.

🔧 कसे (या repo मध्ये)

ठसा आत भाजून बसवा. app/Dockerfile तो build argument म्हणून घेते आणि environment मध्ये गोठवते:

ARG APP_VERSION=dev                 # CI passes the commit SHA here (lesson 07)
ENV APP_VERSION=$APP_VERSION

डबा build करा आणि त्याचा smoke-test करा. ship.yml मधला build job — ${GITHUB_SHA::7} म्हणजे bash मध्ये "पहिली 7 अक्षरे"; loop डब्याला सुरू व्हायला सुमारे दहा सेकंद देतो:

      - name: 🍱 docker build (version label = short SHA)
        run: docker build --build-arg APP_VERSION=${GITHUB_SHA::7} -t hello-courier:${GITHUB_SHA} app
      - name: 🧪 test the BOX, not just the code
        run: |
          docker run -d --rm -p 3000:3000 --name smoke hello-courier:${GITHUB_SHA}
          for i in $(seq 1 20); do curl -fsS localhost:3000/healthz && break; sleep 0.5; done
          curl -fsS localhost:3000/ | grep -q "version ${GITHUB_SHA::7}"
          docker stop smoke
      - name: 💾 keep the image for the push job (same run, different machine)
        run: docker save hello-courier:${GITHUB_SHA} | gzip > image.tar.gz

grep -q ची ओळ जुना किंवा चुकीचे label असलेला build पकडते: डब्याने version dev छापले, तर काहीही push होण्याआधीच job fail होतो.

Load, log in, tag, push. push job नव्या मशीनवर उतरतो, म्हणून तो पाकिटापासून सुरू करतो, धडा 06 चा बॅज दाखवतो, मग:

      - run: docker load < image.tar.gz
      - name: 🎫 log in to ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: 🏷️ tag with the commit SHA and push
        id: meta
        env:
          IMAGE: ${{ steps.ecr.outputs.registry }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
        run: |
          docker tag hello-courier:${GITHUB_SHA} "$IMAGE"
          docker push "$IMAGE"
          echo "image=$IMAGE" >> "$GITHUB_OUTPUT"

amazon-ecr-login डे पासचे रूपांतर docker login मध्ये करते आणि registry hostname output करते, म्हणून IMAGE होते 123456789012.dkr.ecr.ap-south-1.amazonaws.com/hello-courier:<full sha> — job चा image output म्हणून export केलेली, धडा 10 मध्ये delivery van ला मिळणारी नेमकी string. Scan चे निकाल ECR console मध्ये image शेजारी दिसतात (repository धडा 06 मध्ये scanOnPush=true सह बनवली होती).

🔁 हेच CircleCI मध्ये

            IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${CIRCLE_SHA1}"
            docker build --build-arg APP_VERSION=${CIRCLE_SHA1:0:7} -t "$IMAGE" app
            docker run -d --rm -p 3000:3000 --name smoke "$IMAGE"
            sleep 2 && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
            docker push "$IMAGE"

एकच job build करतो, aws ecr get-login-password ने log in करतो आणि push करतो, म्हणून पाकिटाची गरज नाही. setup_remote_docker सह container वेगळ्या engine वर चालतो, म्हणूनच smoke test curl localhost ऐवजी docker exec smoke wget वापरतो.

🦊 हेच GitLab CI मध्ये

    - IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${CI_COMMIT_SHA}"
    - docker build --build-arg APP_VERSION=${CI_COMMIT_SHORT_SHA} -t "$IMAGE" app
    - docker run -d --rm -p 3000:3000 --name smoke "$IMAGE" && sleep 2 && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
    - docker push "$IMAGE"

CI_COMMIT_SHA हा पूर्ण SHA आहे; GitLab चा built-in CI_COMMIT_SHORT_SHA 8 अक्षरांचा आहे, म्हणून या बोलीत version ची ओळ एक अक्षराने लांब दिसते. Docker स्वतः docker:27-dind service मधून येतो.

🎩 हेच Jenkins मध्ये

            IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${GIT_COMMIT}"
            docker build --build-arg APP_VERSION=$(echo "$GIT_COMMIT" | cut -c1-7) -t "$IMAGE" app   # POSIX sh: no ${VAR:0:7}
            docker run -d --rm -p 3000:3000 --name smoke "$IMAGE" && sleep 2 \
              && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
            docker push "$IMAGE"

GIT_COMMIT हा Jenkins चा पूर्ण SHA आहे. संपूर्ण sh block धडा 06 मधल्या withAWS(...) च्या आत बसतो, त्याच प्रकारे log in करतो, आणि agent कडे स्वतःचा Docker CLI असावा लागतो.

🧪 करून पाहा

SHA=$(git rev-parse HEAD)                       # 1) build exactly like CI, from your checkout — no AWS needed
docker build --build-arg APP_VERSION=${SHA::7} -t hello-courier:${SHA} app

# 2) smoke-test the BOX — the same lines as ship.yml
docker run -d --rm -p 3000:3000 --name smoke hello-courier:${SHA}
for i in $(seq 1 20); do curl -fsS localhost:3000/healthz && break; sleep 0.5; done
curl -fsS localhost:3000/ | grep -q "version ${SHA::7}" && echo "✅ the box says ${SHA::7}"
docker stop smoke

# 3) the version is baked in, not guessed
docker image inspect hello-courier:${SHA} --format '{{json .Config.Env}}'   # …"APP_VERSION=abc1234"…

# 4) the same build ran in your fork's mailroom — the build job needs no AWS
RUN=$(gh run list --workflow ship.yml --limit 1 --json databaseId --jq '.[0].databaseId')
gh run view "$RUN"     # "build & smoke-test the image" ✅ · "push to ECR" skipped without the lesson 06 variables

⚠️ नेहमीच्या चुका

latest किंवा branch च्या नावाने deploy करणे — tag चा अर्थ एकच bytes चा संच असा राहत नाही, आणि "कालचे परत लावा" अंदाजपंचे होते
कोड तपासणे पण डबा न तपासणे — file चुकवणारा COPY, चुकीचा USER किंवा port unit tests पास करतो आणि पहिल्याच probe ला मरतो
"पटकन होते म्हणून" push job मध्ये पुन्हा build करणे — push झालेली image तुम्ही smoke-test केलेली राहत नाही; त्याऐवजी पाकीट सोबत न्या

⏭️ पुढे

प्रत तिच्या ठशासह लॉकरमध्ये आहे. मुख्य फलकावर पोहोचण्याआधी ती आधी सराव फलकावर जाते — आणि प्राचार्य सही करतात. 🛑

git checkout lesson-08-environments-gates

📦 Lesson 07 — Build & push the image: the photocopier

📍 You are here: Lesson 07 of 12 · Previous: lesson-06-secrets-oidc · Next: lesson-08-environments-gates

📦 What's in this branch

Lessons 01–06, plus the photocopier desk: the checked homework becomes a box, gets the commit's fingerprint, and is filed in the locker. Real files:

.github/workflows/ship.yml — the build job (build, smoke-test, save) and the push job (load, badge, ECR login, tag, push)
app/Dockerfile and app/server.js — ARG APP_VERSION is baked in, and / prints version … so a running copy can say which commit it is
.circleci/config.yml, .gitlab-ci.yml, Jenkinsfile — the same build, smoke, tag, push in one job each

🧒 Explain like I'm 5

The checking desk ✅ stamped the homework. Now the photocopier 🍱 makes the copy that goes on the notice boards, and this desk has three habits.

Write the fingerprint on the copy while copying. A commit has a 40-character fingerprint, the SHA. Its first 7 characters go inside the box as APP_VERSION, so the running app can answer "which copy are you?" The full SHA goes on the label — the image tag — so the locker shelf answers the same question by name. Not latest, not main: those point at different bytes from week to week.

Look at the copy before filing it. The tests ran on the runner's Node; the box has its own Node, its own files, its own port. So the desk starts the box, asks /healthz until it answers, and checks that / prints the expected version. That is a smoke test of the box, not of the code.

Hand it over properly. The photocopier and the filing desk are different rooms, so the copy travels in the envelope from lesson 05; the filing desk opens the locker 🏦 with the day pass from lesson 06; the locker X-rays each new box (scan on push).

🗺️ Diagram

flowchart LR
    build["🍱 docker build<br/>--build-arg APP_VERSION=abc1234"]
    smoke["🧪 smoke-test the BOX<br/>curl /healthz, grep version abc1234"]
    env["📎 image.tar.gz<br/>docker save, then gzip"]
    push["🚚 push job, another machine<br/>docker load, 🪪 badge, 🎫 ECR login"]
    ecr["🏦 ECR hello-courier:abc1234…<br/>tag = full SHA, scan on push"]
    build -->|"1 run it"| smoke
    smoke -->|"2 only if it answers"| env
    env -->|"3 download by name"| push
    push -->|"4 docker push"| ecr

❓ What

Build argument = --build-arg APP_VERSION=… → ARG → ENV in the Dockerfile → process.env.APP_VERSION in server.js. The version label is the short SHA (7 characters).
Smoke test = start the container, poll /healthz until it returns 200, then check / prints version <short SHA>. It proves the box starts, listens on port 3000, and was built from this commit.
Image tag = the full commit SHA (40 characters). Same tag, same bytes; git show <sha> finds the code; a deploy later is "change this string". A moving tag (main, latest) points at different images over time — fine as a bookmark, wrong as a deploy target.
Scan on push = ECR checks each new image's layers for known CVEs; a setting of the repository, not of the pipeline.

🧠 One fingerprint, inside and out

commit  abc1234ef56…  (40 chars — git's fingerprint of the code)
   ├─ INSIDE the box:  APP_VERSION=abc1234            (short SHA — what the app prints)
   └─ ON the label:    hello-courier:abc1234ef56…     (full SHA — what you deploy by)

Tag vs digest. The commit-SHA tag tells us which source revision produced the image; the image digest (sha256:…, shown by docker image inspect and in the ECR console) identifies the exact immutable image bytes. Build the same commit twice and you get one tag but possibly two digests — the tag is the address, the digest is the identity, as the Docker school's lesson 11 puts it. Lesson 12 pins base images by digest for the same reason.

🤔 Why

Without the version baked in, "which version is running?" is a guess. Without the smoke test, a Dockerfile that forgets a file passes the unit tests and dies at the first readiness probe. Without SHA tags, "put back yesterday's" is impossible, latest quietly lies, and GitOps commits later have nothing meaningful to change. The Docker school's lesson 12 ends on this exact handoff; its lesson 08 covers tag hygiene.

🔧 How (in this repo)

Bake the fingerprint. app/Dockerfile takes it as a build argument and freezes it into the environment:

ARG APP_VERSION=dev                 # CI passes the commit SHA here (lesson 07)
ENV APP_VERSION=$APP_VERSION

Build and smoke-test the box. The build job in ship.yml — ${GITHUB_SHA::7} is bash for "the first 7 characters"; the loop gives the box roughly ten seconds to start:

      - name: 🍱 docker build (version label = short SHA)
        run: docker build --build-arg APP_VERSION=${GITHUB_SHA::7} -t hello-courier:${GITHUB_SHA} app
      - name: 🧪 test the BOX, not just the code
        run: |
          docker run -d --rm -p 3000:3000 --name smoke hello-courier:${GITHUB_SHA}
          for i in $(seq 1 20); do curl -fsS localhost:3000/healthz && break; sleep 0.5; done
          curl -fsS localhost:3000/ | grep -q "version ${GITHUB_SHA::7}"
          docker stop smoke
      - name: 💾 keep the image for the push job (same run, different machine)
        run: docker save hello-courier:${GITHUB_SHA} | gzip > image.tar.gz

The grep -q line catches a stale or mislabeled build: if the box prints version dev, the job fails before anything is pushed.

Load, log in, tag, push. The push job lands on a fresh machine, so it starts from the envelope, shows the lesson 06 badge, then:

      - run: docker load < image.tar.gz
      - name: 🎫 log in to ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: 🏷️ tag with the commit SHA and push
        id: meta
        env:
          IMAGE: ${{ steps.ecr.outputs.registry }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
        run: |
          docker tag hello-courier:${GITHUB_SHA} "$IMAGE"
          docker push "$IMAGE"
          echo "image=$IMAGE" >> "$GITHUB_OUTPUT"

amazon-ecr-login turns the day pass into a docker login and outputs the registry hostname, so IMAGE becomes 123456789012.dkr.ecr.ap-south-1.amazonaws.com/hello-courier:<full sha> — exported as the job's image output, the exact string the delivery van receives in lesson 10. Scan results appear next to the image in the ECR console (the repository was created with scanOnPush=true in lesson 06).

🔁 The same thing in CircleCI

            IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${CIRCLE_SHA1}"
            docker build --build-arg APP_VERSION=${CIRCLE_SHA1:0:7} -t "$IMAGE" app
            docker run -d --rm -p 3000:3000 --name smoke "$IMAGE"
            sleep 2 && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
            docker push "$IMAGE"

One job builds, logs in with aws ecr get-login-password and pushes, so no envelope is needed. With setup_remote_docker the container runs on a separate engine, which is why the smoke test uses docker exec smoke wget rather than curl localhost.

🦊 The same thing in GitLab CI

    - IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${CI_COMMIT_SHA}"
    - docker build --build-arg APP_VERSION=${CI_COMMIT_SHORT_SHA} -t "$IMAGE" app
    - docker run -d --rm -p 3000:3000 --name smoke "$IMAGE" && sleep 2 && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
    - docker push "$IMAGE"

CI_COMMIT_SHA is the full SHA; GitLab's built-in CI_COMMIT_SHORT_SHA is 8 characters, so the version line reads one character longer in this dialect. Docker itself comes from the docker:27-dind service.

🎩 The same thing in Jenkins

            IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${GIT_COMMIT}"
            docker build --build-arg APP_VERSION=$(echo "$GIT_COMMIT" | cut -c1-7) -t "$IMAGE" app   # POSIX sh: no ${VAR:0:7}
            docker run -d --rm -p 3000:3000 --name smoke "$IMAGE" && sleep 2 \
              && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
            docker push "$IMAGE"

GIT_COMMIT is Jenkins' full SHA. The whole sh block sits inside the withAWS(...) from lesson 06, logs in the same way, and the agent needs a Docker CLI of its own.

🧪 Try it

SHA=$(git rev-parse HEAD)                       # 1) build exactly like CI, from your checkout — no AWS needed
docker build --build-arg APP_VERSION=${SHA::7} -t hello-courier:${SHA} app

# 2) smoke-test the BOX — the same lines as ship.yml
docker run -d --rm -p 3000:3000 --name smoke hello-courier:${SHA}
for i in $(seq 1 20); do curl -fsS localhost:3000/healthz && break; sleep 0.5; done
curl -fsS localhost:3000/ | grep -q "version ${SHA::7}" && echo "✅ the box says ${SHA::7}"
docker stop smoke

# 3) the version is baked in, not guessed
docker image inspect hello-courier:${SHA} --format '{{json .Config.Env}}'   # …"APP_VERSION=abc1234"…

# 4) the same build ran in your fork's mailroom — the build job needs no AWS
RUN=$(gh run list --workflow ship.yml --limit 1 --json databaseId --jq '.[0].databaseId')
gh run view "$RUN"     # "build & smoke-test the image" ✅ · "push to ECR" skipped without the lesson 06 variables

⚠️ Common mistakes

deploying by latest or a branch name — the tag stops meaning one set of bytes, and "put back yesterday's" becomes guesswork
testing the code but not the box — a COPY that misses a file, a wrong USER or port passes unit tests and dies at the first probe
rebuilding in the push job "because it's quick" — the pushed image is no longer the one you smoke-tested; carry the envelope instead

⏭️ Next

The copy is in the locker with its fingerprint. Before it reaches the main board it goes on the practice board first — and the principal signs. 🛑

git checkout lesson-08-environments-gates

← Previoussecrets oidc Next →environments gates

This page is the lesson's README from the lesson-07-build-push-image branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.