amd64 image binding

.woodpecker/bff.yml

@@ -7,6 +7,9 @@ matrix:
       BFF_VAULT_SECRET_PATH: sendico/edge/bff/vault
       BFF_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -87,6 +90,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/bff/build-image.sh
 
   - name: deploy

.woodpecker/billing_documents.yml

@@ -5,6 +5,9 @@ matrix:
       DOCUMENTS_MONGO_SECRET_PATH: sendico/db
       DOCUMENTS_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -82,6 +85,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/billing_documents/build-image.sh
 
   - name: deploy

.woodpecker/billing_fees.yml

@@ -5,6 +5,9 @@ matrix:
       FEES_MONGO_SECRET_PATH: sendico/db
       FEES_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -82,6 +85,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/billing_fees/build-image.sh
 
   - name: deploy

.woodpecker/callbacks.yml

@@ -6,6 +6,9 @@ matrix:
       CALLBACKS_VAULT_SECRET_PATH: sendico/edge/callbacks/vault
       CALLBACKS_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -83,6 +86,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/callbacks/build-image.sh
 
   - name: deploy

.woodpecker/discovery.yml

@@ -4,6 +4,9 @@ matrix:
       DISCOVERY_DOCKERFILE: ci/prod/compose/discovery.dockerfile
       DISCOVERY_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -81,6 +84,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/discovery/build-image.sh
 
   - name: deploy

.woodpecker/frontend.yml

@@ -4,6 +4,9 @@ matrix:
       FRONTEND_DOCKERFILE: ci/prod/compose/frontend.dockerfile
       FRONTEND_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -54,6 +57,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ version, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/frontend/build-image.sh
 
   - name: deploy

.woodpecker/fx_ingestor.yml

@@ -8,6 +8,9 @@ matrix:
       FX_NEEDS_NATS: "true"
       FX_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -87,6 +90,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/fx/build-image.sh
 
   - name: deploy

.woodpecker/fx_oracle.yml

@@ -8,6 +8,9 @@ matrix:
       FX_NEEDS_NATS: "true"
       FX_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -88,6 +91,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/fx/build-image.sh
 
   - name: deploy

.woodpecker/gateway_chain.yml

@@ -8,6 +8,9 @@ matrix:
       CHAIN_GATEWAY_VAULT_SECRET_PATH: sendico/gateway/chain/vault
       CHAIN_GATEWAY_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -86,6 +89,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "chain gateway image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/chain_gateway/build-image.sh
 
   - name: deploy

.woodpecker/gateway_mntx.yml

@@ -7,6 +7,9 @@ matrix:
       MNTX_GATEWAY_NATS_SECRET_PATH: sendico/nats
       MNTX_GATEWAY_MONGO_SECRET_PATH: sendico/db
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -85,6 +88,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/mntx/build-image.sh
 
   - name: deploy

.woodpecker/gateway_tgsettle.yml

@@ -5,6 +5,9 @@ matrix:
       TGSETTLE_GATEWAY_MONGO_SECRET_PATH: sendico/db
       TGSETTLE_GATEWAY_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -83,6 +86,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/tgsettle/build-image.sh
 
   - name: deploy

.woodpecker/gateway_tron.yml

@@ -8,6 +8,9 @@ matrix:
       TRON_GATEWAY_VAULT_SECRET_PATH: sendico/gateway/tron/vault
       TRON_GATEWAY_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -86,6 +89,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/tron_gateway/build-image.sh
 
   - name: deploy

.woodpecker/ledger.yml

@@ -5,6 +5,9 @@ matrix:
       LEDGER_MONGO_SECRET_PATH: sendico/db
       LEDGER_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -82,6 +85,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/ledger/build-image.sh
 
   - name: deploy

.woodpecker/notification.yml

@@ -8,6 +8,9 @@ matrix:
       NOTIFICATION_TELEGRAM_SECRET_PATH: sendico/notification/telegram
       NOTIFICATION_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -85,6 +88,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/notification/build-image.sh
 
   - name: deploy

.woodpecker/payments_methods.yml

@@ -5,6 +5,9 @@ matrix:
       PAYMENTS_METHODS_MONGO_SECRET_PATH: sendico/db
       PAYMENTS_METHODS_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -83,6 +86,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/payments_methods/build-image.sh
 
   - name: deploy

.woodpecker/payments_orchestrator.yml

@@ -5,6 +5,9 @@ matrix:
       PAYMENTS_MONGO_SECRET_PATH: sendico/db
       PAYMENTS_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -83,6 +86,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/payments_orchestrator/build-image.sh
 
   - name: deploy

.woodpecker/payments_quotation.yml

@@ -5,6 +5,9 @@ matrix:
       PAYMENTS_QUOTATION_MONGO_SECRET_PATH: sendico/db
       PAYMENTS_QUOTATION_ENV: prod
 
+labels:
+  platform: linux/amd64
+
 when:
   - event: push
     branch: main
@@ -83,6 +86,7 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     depends_on: [ backend-lint, backend-tests, secrets ]
     commands:
+      - '[ "$(uname -m)" = "x86_64" ] || { echo "image build requires an amd64 runner"; exit 1; }'
       - sh ci/scripts/payments_quotation/build-image.sh
 
   - name: deploy

ci/prod/compose/bff.yml

@@ -22,6 +22,7 @@ services:
   sendico_bff:
     <<: *common-env
     container_name: sendico-bff
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/bff/service:${APP_V}
     pull_policy: always

ci/prod/compose/billing_documents.yml

@@ -14,6 +14,7 @@ services:
   sendico_billing_documents:
     <<: *common-env
     container_name: sendico-billing-documents
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/billing/documents:${APP_V}
     pull_policy: always

ci/prod/compose/billing_fees.yml

@@ -14,6 +14,7 @@ services:
   sendico_billing_fees:
     <<: *common-env
     container_name: sendico-billing-fees
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/billing/fees:${APP_V}
     pull_policy: always

ci/prod/compose/callbacks.yml

@@ -22,6 +22,7 @@ services:
   sendico_callbacks:
     <<: *common-env
     container_name: sendico-callbacks
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/edge/callbacks:${APP_V}
     pull_policy: always

ci/prod/compose/chain_gateway.yml

@@ -22,6 +22,7 @@ services:
   sendico_chain_gateway:
     <<: *common-env
     container_name: sendico-chain-gateway
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/gateway/chain:${APP_V}
     pull_policy: always

ci/prod/compose/discovery.yml

@@ -14,6 +14,7 @@ services:
   sendico_discovery:
     <<: *common-env
     container_name: sendico-discovery
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/discovery/service:${APP_V}
     pull_policy: always

ci/prod/compose/fx_ingestor.yml

@@ -14,6 +14,7 @@ services:
   sendico_fx_ingestor:
     <<: *common-env
     container_name: sendico-fx-ingestor
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/fx/ingestor:${APP_V}
     pull_policy: always

ci/prod/compose/fx_oracle.yml

@@ -14,6 +14,7 @@ services:
   sendico_fx_oracle:
     <<: *common-env
     container_name: sendico-fx-oracle
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/fx/oracle:${APP_V}
     pull_policy: always

ci/prod/compose/ledger.yml

@@ -14,6 +14,7 @@ services:
   sendico_ledger:
     <<: *common-env
     container_name: sendico-ledger
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/ledger/service:${APP_V}
     pull_policy: always

ci/prod/compose/mntx_gateway.yml

@@ -14,6 +14,7 @@ services:
   sendico_mntx_gateway:
     <<: *common-env
     container_name: sendico-mntx-gateway
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/gateway/mntx:${APP_V}
     pull_policy: always

ci/prod/compose/notification.yml

@@ -14,6 +14,7 @@ services:
   sendico_notification:
     <<: *common-env
     container_name: sendico-notification
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/notification/service:${APP_V}
     pull_policy: always

ci/prod/compose/payments_methods.yml

@@ -14,6 +14,7 @@ services:
   sendico_payments_methods:
     <<: *common-env
     container_name: sendico-payments-methods
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/payments/methods:${APP_V}
     pull_policy: always

ci/prod/compose/payments_orchestrator.yml

@@ -14,6 +14,7 @@ services:
   sendico_payments_orchestrator:
     <<: *common-env
     container_name: sendico-payments-orchestrator
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/payments/orchestrator:${APP_V}
     pull_policy: always

ci/prod/compose/payments_quotation.yml

@@ -14,6 +14,7 @@ services:
   sendico_payments_quotation:
     <<: *common-env
     container_name: sendico-payments-quotation
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/payments/quotation:${APP_V}
     pull_policy: always

ci/prod/compose/tgsettle_gateway.yml

@@ -14,6 +14,7 @@ services:
   sendico_tgsettle_gateway:
     <<: *common-env
     container_name: sendico-tgsettle-gateway
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/gateway/tgsettle:${APP_V}
     pull_policy: always

ci/prod/compose/tron_gateway.yml

@@ -22,6 +22,7 @@ services:
   sendico_tron_gateway:
     <<: *common-env
     container_name: sendico-tron-gateway
+    platform: linux/amd64
     restart: unless-stopped
     image: ${REGISTRY_URL}/gateway/tron:${APP_V}
     pull_policy: always

ci/scripts/common/buildx_build_and_push.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+set -eu
+
+if ! set -o pipefail 2>/dev/null; then
+  :
+fi
+
+REGISTRY_HOST="${REGISTRY_HOST:?missing REGISTRY_HOST}"
+REGISTRY_USER="${REGISTRY_USER:?missing REGISTRY_USER}"
+REGISTRY_PASSWORD="${REGISTRY_PASSWORD:?missing REGISTRY_PASSWORD}"
+BUILD_CONTEXT="${BUILD_CONTEXT:?missing BUILD_CONTEXT}"
+IMAGE_DOCKERFILE="${IMAGE_DOCKERFILE:?missing IMAGE_DOCKERFILE}"
+IMAGE_DESTINATION="${IMAGE_DESTINATION:?missing IMAGE_DESTINATION}"
+APP_V="${APP_V:?missing APP_V}"
+GIT_REV="${GIT_REV:?missing GIT_REV}"
+BUILD_BRANCH="${BUILD_BRANCH:?missing BUILD_BRANCH}"
+BUILD_DATE="${BUILD_DATE:?missing BUILD_DATE}"
+BUILD_USER="${BUILD_USER:?missing BUILD_USER}"
+
+BUILD_PLATFORM="${BUILD_PLATFORM:-linux/amd64}"
+BUILDER_NAME="${BUILDER_NAME:-sendico-cross-builder}"
+
+if [ ! -S /var/run/docker.sock ]; then
+  echo "[buildx] docker socket not found at /var/run/docker.sock" >&2
+  exit 69
+fi
+
+printf '%s' "${REGISTRY_PASSWORD}" | docker login "${REGISTRY_HOST}" --username "${REGISTRY_USER}" --password-stdin
+
+docker run --rm --privileged tonistiigi/binfmt --install amd64
+
+if docker buildx inspect "${BUILDER_NAME}" >/dev/null 2>&1; then
+  docker buildx use "${BUILDER_NAME}"
+else
+  docker buildx create --name "${BUILDER_NAME}" --driver docker-container --use
+fi
+
+docker buildx inspect --bootstrap >/dev/null
+
+docker buildx build \
+  --platform "${BUILD_PLATFORM}" \
+  --file "${IMAGE_DOCKERFILE}" \
+  --tag "${IMAGE_DESTINATION}" \
+  --build-arg APP_VERSION="${APP_V}" \
+  --build-arg GIT_REV="${GIT_REV}" \
+  --build-arg BUILD_BRANCH="${BUILD_BRANCH}" \
+  --build-arg BUILD_DATE="${BUILD_DATE}" \
+  --build-arg BUILD_USER="${BUILD_USER}" \
+  --provenance=false \
+  --pull \
+  --push \
+  "${BUILD_CONTEXT}"