Skip to content

ci: STEP 1: ECR BuildKit cache for oe-core Docker image#348

Open
neo-jesse wants to merge 2 commits into
mainfrom
feat/ci-docker-ecr-buildkit-cache
Open

ci: STEP 1: ECR BuildKit cache for oe-core Docker image#348
neo-jesse wants to merge 2 commits into
mainfrom
feat/ci-docker-ecr-buildkit-cache

Conversation

@neo-jesse

@neo-jesse neo-jesse commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Cache the CI Dockerfile build in ECR via BuildKit (cache-from / cache-to) when OT3_OE_DOCKER_ECR_REPOSITORY_{DEV,PROD} is set.
  • Pin aws-actions/amazon-ecr-login to the peeled v2.0.1 commit SHA (zizmor-safe).
  • Document the ECR cache variables and required IAM permissions.

Test plan

  • Stage-dev build with ECR repo vars set: Docker build reuses layers on a second run
  • Confirm zizmor passes on the workflow
  • Unset ECR vars still falls back to plain docker build

neo-jesse and others added 2 commits July 13, 2026 11:13
@neo-jesse
buildkit caching on ecr
b9ff893
@neo-jesse @cursoragent
fix(ci): pin amazon-ecr-login to commit SHA
d2b931e 
Use the peeled v2.0.1 commit instead of the annotated tag object so
zizmor impostor-commit and ref-version-mismatch checks pass.

Co-authored-by: Cursor <cursoragent@cursor.com>
@neo-jesse neo-jesse changed the title ci: ECR BuildKit cache for oe-core Docker image ci: STEP 1: ECR BuildKit cache for oe-core Docker image Jul 13, 2026
@neo-jesse

neo-jesse commented Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Remote Caching: For CI/CD environments with ephemeral runners, BuildKit supports external backends to persist cache between builds:

Registry: Push/pull cache layers to/from a container registry using --cache-from and --cache-to flags.
GitHub Actions: Use type=gha for native integration with the GitHub cache API.
Local/Filesystem: Export to a shared directory for persistent storage on self-hosted runners.
Cache Mounts: Beyond layer caching, BuildKit uses RUN --mount=type=cache to persist specific directories (e.g., package managers' caches) across builds. These mounts do not add layers to the final image, keeping images small while significantly speeding up dependency installation and compilation.

Use mode=max with remote cache exports to include intermediate build stages in the cache, not just final layers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@neo-jesse