CI: use pre-built Docker image for Linux build jobs by kadykov · Pull Request #21909 · darktable-org/darktable

kadykov · 2026-08-18T16:40:05Z

Follows up on #19597 (devcontainer configuration).

What this changes

Replaces the per-run apt-get install steps in the Linux CI jobs with a
pre-built Docker image hosted on GHCR. The image is built from
.devcontainer/Dockerfile, which was introduced in the prerequisite PR and
already mirrors the CI environment exactly.

Files changed:

.github/workflows/build-docker.yml — new workflow: builds and pushes the
image to GHCR when .devcontainer/Dockerfile changes
.github/workflows/ci.yml — Linux job: use GHCR image, remove compiler
and dependency install steps
.devcontainer/devcontainer.json — switch from local build to pulling the
published GHCR image (faster for devcontainer users)
.ci/Dockerfile — removed (2016-era Jenkins artefact, superseded)

Why

Single source of truth: the Dockerfile is the only place that defines
the Linux build environment. ci.yml and the devcontainer both consume it.
No more risk of drift between them.
Faster CI feedback: the dependency install steps currently add several
minutes to every Linux job. Pre-built images eliminate that overhead.
Easier onboarding: devcontainer.json now uses "image": instead of
"build":, so opening the devcontainer is a docker pull rather than a
full image build.

What does NOT change

Windows and macOS CI jobs — unchanged, containers are not applicable there
nightly.yml — the AppImage build deliberately targets ubuntu-22.04 for
glibc compatibility and builds libs from source; it stays as-is
The CI matrix structure (compiler variants, build types, eco flags) —
unchanged; compiler choice continues to be CC/CXX env vars

Image tagging strategy

Images are pushed as:

ghcr.io/darktable-org/darktable-build:latest — rolling, used by CI
ghcr.io/darktable-org/darktable-build:YYYY-MM-DD-SHORTSHA — pinned, for
auditing

The build-docker workflow triggers on:

Push to master that modifies .devcontainer/Dockerfile
Manual workflow_dispatch

Add a complete devcontainer environment for building and testing darktable, including Dockerfile with all dependencies, configuration, and documentation. Also update .gitignore to exclude AppDir for AppImage builds.

Co-authored-by: Philipp Lutz <810285+da-phil@users.noreply.github.com>

…e to Ubuntu 26.04 and installing matching packages. Enhance README with compiler details and CI alignment information.

…ncing compatibility details for various IDEs.

…nfiguration

…ment for contributors in the main README

…ontainer-based build environment

…se pre-built image, and create GitHub Actions workflow for image build and publish

…ache

kadykov · 2026-08-21T17:17:30Z

Action needed from a `darktable-org` organization admin: make the GHCR package public

The build-docker.yml workflow that was merged with #19597 successfully pushed the image:

ghcr.io/darktable-org/darktable-build:latest
ghcr.io/darktable-org/darktable-build:970e38b1c30bdfd71c27a2615b4098c52055f245

However, when a GitHub Actions workflow pushes a package to GHCR for an organization, it seems that it is created as private by default. The package is there — it's just invisible and inaccessible to anyone who isn't authenticated to the org:

aleksandr@bluefin ~> docker pull ghcr.io/darktable-org/darktable-build:latest
Error response from daemon: Head "https://ghcr.io/v2/darktable-org/darktable-build/manifests/latest": unauthorized

How to fix it:

An org admin needs to change the visibility once:

Go to https://github.com/orgs/darktable-org/packages/container/darktable-build/settings
Scroll to the Danger Zone section
Click "Change visibility" → select Public → confirm

Alternatively, with the GitHub CLI and an org-admin token:

gh api --method PATCH /orgs/darktable-org/packages/container/darktable-build \
  -f visibility=public

Why this must happen before this PR can work:

The CI in this PR pulls ghcr.io/darktable-org/darktable-build:sha-<sha> (a per-commit image). Without the package being public, the runner cannot pull it.
Contributors and devcontainer users need docker pull ghcr.io/darktable-org/darktable-build:latest to work without any authentication.
This is a one-time action. GitHub Actions workflows cannot set package visibility themselves — the packages:write scope only covers pushing images, not changing org-level visibility settings.

Copilot

Pull request overview

This PR switches Linux GitHub Actions CI builds from installing dependencies on every run to using a pre-built Docker image published to GHCR, aligning CI and the devcontainer on a shared build environment definition.

Changes:

Update Linux CI job to run inside ghcr.io/darktable-org/darktable-build:latest, removing per-run apt-get install steps.
Add image publishing/build steps (including a publish-image job in ci.yml and a manual build-docker.yml workflow).
Update the devcontainer configuration and documentation to pull and use the published image.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
`.github/workflows/ci.yml`	Linux job now uses a GHCR image; adds a `publish-image` job to build/push updated images.
`.github/workflows/build-docker.yml`	Changes the image build workflow to be manual-only and adds tag computation + caching.
`.devcontainer/README.md`	Updates docs to describe the new CI/devcontainer image flow and GHCR usage.
`.devcontainer/devcontainer.json`	Switches devcontainer from building locally to consuming the published GHCR image.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

 permissions:
  contents: read
+  packages: write


 on:
-  push:
-    branches:
-      - master
-    paths:
-      - '.devcontainer/Dockerfile'
+  # Manual trigger only — useful when the upstream ubuntu:26.04 base image
+  # updates without a Dockerfile change. Normal :latest updates happen via ci.yml.
  workflow_dispatch:


+To add or remove packages, edit `.devcontainer/Dockerfile` and submit it as a
+normal PR. CI will build from the updated Dockerfile automatically, so you can
+verify the environment works before the change is merged.


da-phil · 2026-08-21T19:16:09Z


  Linux:
    if: github.repository == 'darktable-org/darktable' || github.event_name == 'workflow_dispatch'
-    name: Linux_${{ matrix.distro }}_${{ matrix.compiler.compiler }}_${{ matrix.btype }}${{ matrix.name_suffix }}


Instead of matrix.distro we could keep the flexibility to test against docker images which are based on different distros, e.g. Ubuntu 26.04, Fedora 44, OpenSUSE 16 etc. (potential future work if we want to follow-up with that).

da-phil · 2026-08-21T19:18:49Z

+  publish-image:
+    name: Publish CI Docker image
+    needs: Linux
+    if: (github.repository == 'darktable-org/darktable' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/master'


What does github.event_name == 'workflow_dispatch') mean?
I'm just trying to understand when this action is even triggered. Could possibly be triggered manually, right?

Does this mean after .github/workflows/build-docker.yml finishes building the image?
I wonder why this action is part of the ci.yml file and not part of build-docker.yml as the final step after the docker image was built?
The step Compute image tags is also duplicated across both files.

Since this review the architecture has changed significantly. The publish-image job has been removed from ci.yml entirely. build-docker.yml now owns all image publishing and implements a build → smoke-test → push sequence. workflow_dispatch on that workflow lets a maintainer force a manual rebuild (e.g. to pick up Ubuntu security patches without changing the Dockerfile). ci.yml has no publishing step at all — it simply pulls :latest.

da-phil · 2026-08-21T19:25:51Z

Merging in master brought back the deprecated dockerfile.

Also, I don't think that syncing feature branches against master is done via merge commits in the darktable repo, we usually rebase against master.
It's also not nice to have merge commits in a feature branch commit history, when it gets merged back to master via a merge commit.

da-phil · 2026-08-21T19:27:41Z

@TurboGit I think #21909 (comment) was addressed to you

Action needed from a darktable-org organization admin: make the GHCR package public

… script, move image publishing to build-docker workflow

kadykov · 2026-08-23T18:03:42Z

@da-phil Thank you for the thorough review on this PR! I wanted to let you know that I've addressed all of the feedback, including the dirty git history, in a fresh PR #21972

A brief summary of what changed in response to the review:

Dirty git history / merge commit / `.ci/Dockerfile` reappearing

You were right on all counts. The original branch was based on an early draft made before #19597 merged, and I resolved the conflicts by merging master into the feature branch — which is not how darktable normally handles this, and it brought back the deleted .ci/Dockerfile as a side effect. The new PR starts from a clean checkout of current master and contains a single commit with only the relevant files.

`packages: write` at workflow level

Removed from ci.yml entirely — the publish-image job that needed it has been removed from ci.yml (see below).

`build-docker.yml` trigger / PR description mismatch

Both the workflow and the PR description are now consistent. The push trigger on .devcontainer/Dockerfile changes is restored. The workflow now implements a build→test→push sequence: it builds a candidate image, runs all four Linux CI matrix configurations against it using a new .github/scripts/test-image.sh helper, and only pushes to GHCR if every configuration passes. The workflow_dispatch trigger remains for manual rebuilds (e.g. picking up upstream Ubuntu security patches).

README "CI will verify Dockerfile changes before merge"

The README now correctly describes what actually happens: Dockerfile changes are picked up when they merge to master (triggering build-docker.yml), not during the PR itself.

`publish-image` in `ci.yml` / confusion about `workflow_dispatch`

You were right that it was confusing. The publish-image job has been removed from ci.yml entirely. Image publishing now belongs exclusively to build-docker.yml. ci.yml is back to its original simplicity — Linux jobs just pull :latest. The workflow_dispatch you asked about is on build-docker.yml, not ci.yml.

`matrix.image` / distro flexibility`

A great idea for future work. It's not in this PR to keep the scope focused, but the groundwork is there — adding an image: matrix dimension to ci.yml would be straightforward once :latest images for other distros are published.

I'll close this PR in favour of #21972. Thanks again for the careful review — it directly led to a significantly better architecture.

TurboGit · 2026-08-23T18:05:00Z

@kadykov : the GHCR package is now set to public.

kadykov and others added 16 commits October 27, 2025 16:15

build(devcontainer): add development container setup

c93f3f3

Add a complete devcontainer environment for building and testing darktable, including Dockerfile with all dependencies, configuration, and documentation. Also update .gitignore to exclude AppDir for AppImage builds.

Merge branch 'darktable-org:master' into devcontainer

c2ee361

Merge branch 'darktable-org:master' into devcontainer

196a090

Merge branch 'darktable-org:master' into devcontainer

1908f7f

Remove apt cache in the container

8582a3b

Co-authored-by: Philipp Lutz <810285+da-phil@users.noreply.github.com>

Merge branch 'darktable-org:master' into devcontainer

505cf46

Merge branch 'darktable-org:master' into devcontainer

fe0fbbd

Merge branch 'darktable-org:master' into devcontainer

9dc1426

Add devcontainer-lock.json for common-utils feature configuration

3dc0a80

Add additional dependencies for image processing and tools in Dockerfile

4eca62a

Align development container with CI environment by updating base imag…

f6d62f3

…e to Ubuntu 26.04 and installing matching packages. Enhance README with compiler details and CI alignment information.

Update README to clarify devcontainer purpose and prerequisites, enha…

a9019c5

…ncing compatibility details for various IDEs.

Remove clang-format extension from VSCode settings in devcontainer co…

a9123e5

…nfiguration

Rewrite dev container README, reference container-based build environ…

9ae2189

…ment for contributors in the main README

Enhance README with Docker and Podman installation instructions for c…

5eef79e

…ontainer-based build environment

Refactor CI Docker setup: remove Dockerfile, update devcontainer to u…

cf55266

…se pre-built image, and create GitHub Actions workflow for image build and publish

da-phil mentioned this pull request Aug 20, 2026

Add VS Code Dev Container Configuration #19597

Merged

kadykov added 3 commits August 21, 2026 12:25

Merge branch 'master' into ci-docker-build-environment

93cc54d

Refactor CI Linux workflow to build from Dockerfile and use GHCH as c…

87fc0c8

…ache

Revert for using images from GHCR, add publish-image job in CI workflow

547ba6f

kadykov marked this pull request as ready for review August 21, 2026 17:17

Copilot AI lite review requested due to automatic review settings August 21, 2026 17:17

Copilot started reviewing on behalf of kadykov August 21, 2026 17:18 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

da-phil reviewed Aug 21, 2026

View reviewed changes

Refactor CI Docker workflow: remove legacy Dockerfile, add test-image…

a64930a

… script, move image publishing to build-docker workflow

kadykov mentioned this pull request Aug 23, 2026

Refactor Linux CI to use pre-built Docker image from GHCR #21972

Open

kadykov closed this Aug 23, 2026

Navigation Menu

Uh oh!

CI: use pre-built Docker image for Linux build jobs - #21909

CI: use pre-built Docker image for Linux build jobs#21909
kadykov wants to merge 20 commits into
darktable-org:masterfrom
kadykov:ci-docker-build-environment

kadykov commented Aug 18, 2026

Uh oh!

kadykov commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

da-phil Aug 21, 2026

Uh oh!

da-phil Aug 21, 2026

Uh oh!

da-phil Aug 21, 2026 •

edited

Loading

Uh oh!

kadykov Aug 23, 2026

Uh oh!

da-phil Aug 21, 2026

Uh oh!

da-phil commented Aug 21, 2026

Uh oh!

kadykov commented Aug 23, 2026

Uh oh!

TurboGit commented Aug 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

kadykov commented Aug 18, 2026

What this changes

Why

What does NOT change

Image tagging strategy

Uh oh!

kadykov commented Aug 21, 2026

Action needed from a darktable-org organization admin: make the GHCR package public

How to fix it:

Why this must happen before this PR can work:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

da-phil Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

da-phil Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

da-phil Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kadykov Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

da-phil Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

da-phil commented Aug 21, 2026

Uh oh!

kadykov commented Aug 23, 2026

Dirty git history / merge commit / .ci/Dockerfile reappearing

packages: write at workflow level

build-docker.yml trigger / PR description mismatch

README "CI will verify Dockerfile changes before merge"

publish-image in ci.yml / confusion about workflow_dispatch

matrix.image / distro flexibility`

Uh oh!

TurboGit commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Action needed from a `darktable-org` organization admin: make the GHCR package public

da-phil Aug 21, 2026 •

edited

Loading

Dirty git history / merge commit / `.ci/Dockerfile` reappearing

`packages: write` at workflow level

`build-docker.yml` trigger / PR description mismatch

`publish-image` in `ci.yml` / confusion about `workflow_dispatch`

`matrix.image` / distro flexibility`

TurboGit commented Aug 23, 2026 •

edited

Loading