docker/release: Move to distribution directory (#40460)

Signed-off-by: Ryan Northey <[email protected]>

Author: phlax

.dockerignore

@@ -2,6 +2,7 @@
 !/VERSION.txt
 !/build_envoy
 !/ci
+!/distribution/docker
 !/configs/google-vrp
 !/configs/*yaml
 !/linux/amd64/release.tar.zst

.github/dependabot.yml

@@ -34,6 +34,12 @@ updates:
     interval: daily
     time: "06:00"
 
+- package-ecosystem: "docker"
+  directory: "/distribution/docker"
+  schedule:
+    interval: daily
+    time: "06:00"
+
 - package-ecosystem: "github-actions"
   directory: "/"
   schedule:

ci/do_ci.sh

@@ -596,7 +596,7 @@ case $CI_TARGET in
             # then load to Docker (ie local build)
             export DOCKER_LOAD_IMAGES=1
         fi
-        "${ENVOY_SRCDIR}/ci/docker_ci.sh"
+        "${ENVOY_SRCDIR}/distribution/docker/docker_ci.sh"
         ;;
 
     dockerhub-publish)

ci/docker_rebuild_google-vrp.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Script to rebuild Dockerfile-envoy-google-vrp locally (i.e. not in CI) for development purposes.
+# Script to rebuild Dockerfile-envoy google-vrp target locally (i.e. not in CI) for development purposes.
 # This makes use of the latest envoy:dev base image on Docker Hub as the base and takes an
 # optional local path for an Envoy binary. When a custom local Envoy binary is used, the script
 # switches to using ${BASE_DOCKER_IMAGE} for the build, which should be configured to provide
@@ -22,7 +22,7 @@ set -e
 # Don't use the local envoy:dev, but pull from Docker Hub instead, this avoids having to rebuild
 # this local dep which is fairly stable.
 BASE_DOCKER_IMAGE="envoyproxy/envoy:dev"
-declare -r DOCKER_BUILD_FILE="ci/Dockerfile-envoy"
+declare -r DOCKER_BUILD_FILE="distribution/docker/Dockerfile-envoy"
 
 DOCKER_CONTEXT=.
 DOCKER_BUILD_ARGS=(

ci/test_docker_ci.sh

@@ -64,16 +64,16 @@ _test () {
 
     if [[ "$DOCKER_CI_TEST_COMMIT" ]]; then
         echo "COMMIT(${name}): > ${testdata}"
-        echo "  ENVOY_VERSION=${version} ENVOY_DOCKER_IMAGE_DIRECTORY=/non/existent/test/path CI_BRANCH=${branch} DOCKER_CI_DRYRUN=1 ./ci/docker_ci.sh | grep -E \"^>\""
-        ./ci/docker_ci.sh | grep -E "^>" > "$testdata"
+        echo "  ENVOY_VERSION=${version} ENVOY_DOCKER_IMAGE_DIRECTORY=/non/existent/test/path CI_BRANCH=${branch} DOCKER_CI_DRYRUN=1 ./distribution/docker/docker_ci.sh | grep -E \"^>\""
+        ./distribution/docker/docker_ci.sh | grep -E "^>" > "$testdata"
         return
     fi
 
     echo "TEST(${name}): <> ${testdata}"
-    echo "  ENVOY_VERSION=${version} ENVOY_DOCKER_IMAGE_DIRECTORY=/non/existent/test/path CI_BRANCH=${branch} DOCKER_CI_DRYRUN=1 ./ci/docker_ci.sh | grep -E \"^>\""
+    echo "  ENVOY_VERSION=${version} ENVOY_DOCKER_IMAGE_DIRECTORY=/non/existent/test/path CI_BRANCH=${branch} DOCKER_CI_DRYRUN=1 ./distribution/docker/docker_ci.sh | grep -E \"^>\""
     generated="$(mktemp)"
 
-    ./ci/docker_ci.sh | grep -E "^>" > "$generated"
+    ./distribution/docker/docker_ci.sh | grep -E "^>" > "$generated"
 
     cmp --silent "$testdata" "$generated" || {
         echo "files are different" >&2

distribution/docker/BUILD

@@ -0,0 +1,7 @@
+licenses(["notice"])  # Apache 2
+
+exports_files([
+    "Dockerfile-envoy",
+    "docker-entrypoint.sh",
+    "docker_ci.sh",
+])

ci/Dockerfile-envoy renamed to distribution/docker/Dockerfile-envoy

@@ -5,7 +5,7 @@ ARG ENVOY_VRP_BASE_IMAGE=envoy-base
 
 
 FROM scratch AS binary
-COPY ci/docker-entrypoint.sh /
+COPY distribution/docker/docker-entrypoint.sh /
 ADD configs/envoyproxy_io_proxy.yaml /etc/envoy/envoy.yaml
 # See https://github.com/docker/buildx/issues/510 for why this _must_ be this way
 ARG TARGETPLATFORM

distribution/docker/README.md

@@ -0,0 +1,35 @@
+# Envoy Docker Distribution
+
+This directory contains the Docker build configuration for Envoy container images.
+
+## Files
+
+- `Dockerfile-envoy` - Main Dockerfile for building Envoy container images
+- `docker_ci.sh` - Script for building and pushing Docker images in CI
+- `docker-entrypoint.sh` - Entrypoint script for Envoy containers
+
+## Usage
+
+The Docker build is typically invoked through the main CI script:
+
+```bash
+./ci/do_ci.sh docker
+```
+
+This will build Docker images for multiple platforms and variants including:
+- Standard Envoy image
+- Debug image
+- Contrib image (with additional extensions)
+- Distroless image
+- Google VRP image
+- Tools image
+
+## Development
+
+For local development, you can build images directly using the docker_ci.sh script:
+
+```bash
+DOCKER_CI_DRYRUN=1 ./distribution/docker/docker_ci.sh
+```
+
+This will show what commands would be executed without actually building images.

ci/docker-entrypoint.sh renamed to distribution/docker/docker-entrypoint.sh

@@ -147,7 +147,7 @@ build_args() {
 
     target="${build_type/-debug/}"
     target="${target/-contrib/}"
-    printf ' -f ci/Dockerfile-envoy --target %s' "envoy${target}"
+    printf ' -f distribution/docker/Dockerfile-envoy --target %s' "envoy${target}"
 
     if [[ "${build_type}" == *-contrib* ]]; then
         printf ' --build-arg ENVOY_BINARY=envoy-contrib'