Monorepo for building and publishing multiple Docker containers as microservices within a single repository.

Table of Contents

• Table of Contents
  • What is Orion?
  • How does it operate?
  • Build Instructions and Development
    • Usage
    • Testing

What is Orion?

Orion is a build environment for containerized services we run in our Fuzzing infrastructure (eg. libFuzzer).

For spawning a cluster of Docker containers at EC2 or other cloud providers, see the parent project Laniakea.

How does it operate?

GitHub Actions runs the generated Orion service dependency graph for pull requests, pushes to master, a weekly expiry check, and manual rebuilds. The graph selects only affected tests and builds. Successful master runs publish Docker :latest manifests and import service archives into Taskcluster, preserving the existing artifact and index routes used by downstream workers. See Orion Decision for repository and Taskcluster configuration. For service details, see each service README or the Wiki.

Build Instructions and Development

Usage

You can build, test and push locally, which is great for testing locally. The commands below are general, and each service may have more specific instructions defined in the README.md of the service.

TAG=dev
docker build -t mozillasecurity/service:$TAG ../.. -f Dockerfile

... or to test the latest build:

TAG=latest

Running the fuzzer locally:

eval $(TASKCLUSTER_ROOT_URL=https://community-tc.services.mozilla.com taskcluster signin)
LOGS="logs-$(date +%Y%m%d%H%M%S)"
mkdir -p "$LOGS"
docker run --rm -e TASKCLUSTER_ROOT_URL -e TASKCLUSTER_CLIENT_ID -e TASKCLUSTER_ACCESS_TOKEN -it -v "$(pwd)/$LOGS":/logs mozillasecurity/service:$TAG 2>&1 | tee "$LOGS/live.log"

... add any environment variables required by the fuzzer using -e VAR=value. Some fuzzer images alter kernel sysctls and will require docker run --privileged.

Testing

GitHub Actions runs the selected service tests and builds for each pull request and master push. To catch formatting and service definition issues locally, install the pre-commit hooks with pre-commit install and run any tests defined in the service folder before pushing your commit.