Docker Integration with GitHub Actions

# CHAPTER 11

Docker Integration with GitHub Actions #

1. Introduction #

2. Learning Objectives #

• Understand the role of Docker in a CI/CD pipeline.

• Authenticate GitHub Actions with a remote Docker Registry.

• Utilize official Docker Marketplace actions to build images.

• Tag Docker images dynamically using GitHub commit SHAs.

• Push the built container to a registry for deployment.

3. Beginner-Friendly Explanation #

• The Old Way (Source Code): You send the bakery a recipe (the code), a bag of flour, and some eggs. You hope they have the right oven temperature and the right pan size. Sometimes they mess it up, and the cake burns.

• The Docker Way: You bake the perfect cake in your own kitchen. You put it in a sealed, indestructible, climate-controlled titanium box (The Docker Container). You mail the box to the bakery. They just open the box and serve it. It is mathematically impossible for the cake to be burned.

Our GitHub Action is the automated factory that bakes the cake, seals it in the titanium box, and places it on the delivery truck.

4. The Docker Build Workflow #

1. 1. Login: Authenticate with the Registry (e.g., Docker Hub) so we have permission to upload.

1. 2. Build: Execute docker build to read the Dockerfile and create the image.

1. 3. Push: Execute docker push to upload the heavy image file to the cloud.

While you *could* run these commands manually using run: docker build..., Docker provides official Marketplace Actions that handle caching and tagging much more efficiently.

5. Mini Project: Build and Publish a Docker Image #

Prerequisites: You must add your Docker Hub username (DOCKERHUBUSERNAME) and password/token (DOCKERHUBTOKEN) to your GitHub Repository Secrets!

Step-by-Step Pipeline Concept:

name: Publish Docker Image
on:
  push:
    branches:
      - main

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      # Step 1: Authenticate with Docker Hub
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # Step 2: Set up Docker Buildx (A fast build engine)
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Step 3: Build and Push the Image
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: . # Looks for the Dockerfile in the root directory
          push: true
          # We tag the image with 'latest' AND the specific Git Commit SHA
          tags: |
            myusername/my-web-app:latest
            myusername/my-web-app:${{ github.sha }}

6. The Importance of Tagging (github.sha) #

7. Real-World Scenarios #

8. Best Practices #

• Use GHCR (GitHub Container Registry): Instead of paying for Docker Hub, GitHub provides its own registry natively. You can change the login action to authenticate with ghcr.io using the built-in ${{ secrets.GITHUB_TOKEN }}. This keeps your code and your Docker images perfectly synced in the same platform without needing external passwords.

9. Security Recommendations #

• Docker Image Scanning: Just because code is in a container doesn't mean it's secure. You should add a step *after* the build (but *before* the push) to scan the Docker image for vulnerabilities using a tool like Trivy (uses: aquasecurity/trivy-action). If Trivy detects a critical vulnerability in the base operating system of your container, it will fail the workflow and block the upload.

10. Troubleshooting Tips #

• Build Context Errors: If the build-push-action fails saying it cannot find files, ensure your context: is pointing to the correct directory. If your Dockerfile is inside a subfolder named backend/, you must set context: ./backend.

11. Exercises #

1. 1. What is the operational danger of tagging every Docker image build exclusively with the :latest tag?

1. 2. Why is building a Docker container considered a safer deployment strategy than running dependency installation scripts directly on a live production server?

12. FAQs #

13. Interview Questions #

• Q: Describe a complete Continuous Delivery pipeline utilizing Docker. Detail the authentication mechanism with the registry and the strategy used for tagging images to ensure robust rollback capabilities.

• Q: Explain the concept of an "Immutable Artifact." Why has the DevOps industry standardized on Docker containers rather than ZIP files for application delivery?

14. Summary #

15. Next Chapter Recommendation #