ref: Stop building local images for Sentry services (getsentry#834)

We used to build local images for Sentry services to be able to
include required plugins in the image. With this change we instead
do this in a custom entrypoint script and use the volume `/data`
to store the plugins permanently.

This should resolve many issues people have around building local
images and pushing them to places like private repositories or swarm
clusters.

This is not 100% compatible with the old way but it should still be
a mostly transparent change to many folks.

.github/workflows/test.yml

@@ -34,6 +34,8 @@ jobs:
           ./install.sh
           ./test.sh
           echo "Testing in-place upgrade"
+          # Also test plugin installation here
+          echo "sentry-auth-oidc" >> sentry/requirements.txt
           ./install.sh --minimize-downtime
           ./test.sh
 

docker-compose.yml

@@ -3,11 +3,7 @@ x-restart-policy: &restart_policy
   restart: unless-stopped
 x-sentry-defaults: &sentry_defaults
   <<: *restart_policy
-  build:
-    context: ./sentry
-    args:
-      - SENTRY_IMAGE
-  image: sentry-onpremise-local
+  image: "$SENTRY_IMAGE"
   depends_on:
     - redis
     - postgres
@@ -21,7 +17,10 @@ x-sentry-defaults: &sentry_defaults
     - snuba-replacer
     - symbolicator
     - kafka
+  entrypoint: "/etc/sentry/entrypoint.sh"
+  command: ["run", "web"]
   environment:
+    PYTHONUSERBASE: "/data/custom-packages"
     SENTRY_CONF: "/etc/sentry"
     SNUBA: "http://snuba-api:1218"
     # Leaving the value empty to just pass whatever is set
@@ -219,7 +218,7 @@ services:
     build:
       context: ./cron
       args:
-        BASE_IMAGE: "sentry-onpremise-local"
+        BASE_IMAGE: "$SENTRY_IMAGE"
     command: '"0 0 * * * gosu sentry sentry cleanup --days $SENTRY_EVENT_RETENTION_DAYS"'
   nginx:
     <<: *restart_policy

install.sh

@@ -247,8 +247,6 @@ echo "${_endgroup}"
 
 echo "${_group}Building and tagging Docker images ..."
 echo ""
-# Build the sentry onpremise image first as it is needed for the cron image
-$dc build --force-rm web
 $dc build --force-rm
 echo ""
 echo "Docker images built."

sentry/entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+set -e
+
+req_file="/etc/sentry/requirements.txt"
+plugins_dir="/data/custom-packages"
+checksum_file="$plugins_dir/.checksum"
+
+if [[ -s "$req_file" ]] && ! cat "$req_file" | grep '^[^#[:space:]]' | shasum -s -c "$checksum_file" 2>/dev/null; then
+    echo "Installing additional dependencies..."
+    mkdir -p "$plugins_dir"
+    pip install --user -r "$req_file"
+    cat "$req_file" | grep '^[^#[:space:]]' | shasum > "$checksum_file"
+    echo ""
+fi
+
+source /docker-entrypoint.sh