windows containers

[reaperhulk]

Windows Server 2016 supports containers. Investigate whether we can build a container with all the Python/Visual Studio versions and replace our server 2012 VMs.

[reaperhulk]

Some followup...

https://blogs.msdn.microsoft.com/heaths/2017/09/18/installing-build-tools-for-visual-studio-2017-in-a-docker-container/

https://github.com/docker-library/python/blob/e4cfc4299e8b5ea35257d5daf3f93aaf94df0230/3.7/windows/windowsservercore-ltsc2016/Dockerfile

[reaperhulk]

Okay here's a container that can build and run the cryptography tests for amd64 Python 2.7:

FROM winamd64/python:2.7.15-windowsservercore-ltsc2016

RUN Invoke-WebRequest -Uri http://download.microsoft.com/download/7/9/6/796EF2E4-801B-4FC4-AB28-B59FBF6D907B/VCForPython27.msi -OutFile VCForPython27.msi; \
    Write-Host 'Installing VC For Python 2.7...'; \
    Start-Process msiexec -Wait \
        -ArgumentList @('/i', 'VCForPython27.msi', '/qn', 'ALLUSERS=1');
RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
    Write-Host 'Downloading OpenSSL...'; \
    Invoke-WebRequest -Uri https://ci.cryptography.io/job/cryptography-support-jobs/job/openssl-release-1.1/lastSuccessfulBuild/artifact/openssl-1.1.0h/openssl-1.1.0h-2010-x86_64.zip -OutFile openssl.zip; \
  Write-Host 'Unzipping OpenSSL...'; \
  Expand-Archive openssl.zip -DestinationPath "C:\\"
RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
    Write-Host 'Downloading cryptography...'; \
    Invoke-WebRequest -Uri https://github.com/pyca/cryptography/archive/master.zip -OutFile cryptography.zip; \
  Write-Host 'Unzipping cryptography...'; \
  Expand-Archive cryptography.zip -DestinationPath "C:\\"
RUN pip install tox
# necessary to make tox happy
RUN copy C:\\Python\\python.exe C:\\Python\\python2.7.exe
ENV LIB="C:\\OpenSSL-Win64-2010\\lib"
ENV INCLUDE="C:\\OpenSSL-Win64-2010\\include"
RUN cd "C:\\cryptography-master";tox -e py27

Obviously a real container would never run a tox job as part of its creation and I still haven't managed to make git actually work in the container, so there's plenty of work to be done.

Additional issues: no 3.4 or 3.5 docker base images so we'd need to create those. These images are quite large and fetching them isn't cheap.

We could also try building a nanoserver based image (docker-library/python#169) but there are some open problems there + it will be 64-bit only.

[alex]

We did it!