Add FE code to Docker image

[aponcedeleonch]

The PR adds:

• The stage webbuilder to download and build the FE code.
  • It downloads the code as .zip from GH using a GH token. The token is needed since the repository is private.
• Modifies the runtime stage to install nginx and also serve the FE code.

[aponcedeleonch]

This needs a GH token setup for the repo to be able to download the FE repo since it's private. I tried secrets.GITHUB_TOKEN and it didn't have enough permissions. For the moment I inserted a personal token to test and is working

[jhrozek]

My spider sense is tingling. Why would we allow insecure connections and allow curl to do redirects? Also main might be OK for now, but we should do tags then and fetch a particular blob.

[aponcedeleonch]

I removed the insecure connections bit by installing ca-certificates, I was missing that. We need redirects because otherwise we cannot download :( , it returns an empty file. Do you think that at some point we would need something else than main from FE?

[jhrozek]

For some reason I can't build the Dockerfile locally (it complains about missing main.zip?) but does this mean that the container stdout wouldn't have codegate log messages? Could we do that the other way around and run nginx on the background instead or forward the messages to stdout?

(Ideally Docker containers are meant to serve 1 process..it would be ideal to serve the FE from the same codegate process as well...but..let's discuss this next week)

[aponcedeleonch]

That happens when you don't pass a GH token with enough permissions, we need to read FE private repo. If you setup a token then you should be able to build with something like

docker build \
  --build-arg LATEST_COMMIT_SHA=$(curl -LSsk "https://api.github.com/repos/stacklok/codegate-ui/commits?per_page=1" -H "Authorization: Bearer $GITHUB_TOKEN" | jq -r '.[0].sha') \
  --secret id=gh_token,env=GITHUB_TOKEN \
  -t codegate .;

And I checked and it seems that both were forwarding to stdout even though one was at the background. Anyways, just to be extra cautious I followed your suggestion and moved nginx to the background and fastapi now is at the front.

[jhrozek]

after I stopped fumbling with the ports this works!