744c3be317
The first build in the container hung for 18+ minutes: the image had only bun's node shim, and `node --check` under that shim runs each script instead of parsing it. The gates also already passed before a commit reaches main, so the container now runs clean, token, bundles, tree and check:sri only. The public exclusions and the refuse-the-swap check still run on every build. runtime-config.js was written with python3, which the image does not have; bun writes it now. The build's PID goes to /tmp/build-cdn.pid so it can be stopped without touching the container.
34 lines
2.3 KiB
Docker
34 lines
2.3 KiB
Docker
# dx-maps cloud dev server: one shared Vite dev server with hot reload for a whole team.
|
|
# This image is only a bootstrap: at start it clones the repo and runs deployment/cloud/entry.sh
|
|
# FROM THE REPO, so the recipe lives in git and updates with it. Paste this file as-is into a
|
|
# container host (Coolify "Dockerfile" build pack, Railway, or `docker build`).
|
|
FROM quay.io/oauth2-proxy/oauth2-proxy:v7.15.3 AS oauth2proxy
|
|
FROM oven/bun:1-debian
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates curl unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=oauth2proxy /bin/oauth2-proxy /usr/local/bin/oauth2-proxy
|
|
# Real Node for the repo's `node internal/...` scripts: bun's node shim runs `node --check` files
|
|
# instead of only parsing them, which hung the production build.
|
|
COPY --from=node:22-bookworm-slim /usr/local/bin/node /usr/local/bin/node
|
|
# Go, to build Rudder's local engine (backend/rudder-engine, go 1.22) when RUDDER_ENGINE=1.
|
|
COPY --from=golang:1.22-bookworm /usr/local/go /usr/local/go
|
|
ENV PATH="/usr/local/go/bin:${PATH}"
|
|
# PocketBase, pinned and checked: the backend for plugins (a dev and a prod instance, see entry.sh).
|
|
ARG PB_VERSION=0.40.4
|
|
ARG PB_SHA256=9042ec818570e79c3628dadcd0a756c1496d9e1173918ec409d133c02f82e5fa
|
|
RUN curl -fsSL -o /tmp/pb.zip "https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_amd64.zip" \
|
|
&& echo "${PB_SHA256} /tmp/pb.zip" | sha256sum -c - \
|
|
&& unzip -q /tmp/pb.zip pocketbase -d /usr/local/bin && rm /tmp/pb.zip && chmod 755 /usr/local/bin/pocketbase
|
|
RUN printf '%s\n' \
|
|
'#!/bin/bash' \
|
|
'set -u; export GIT_TERMINAL_PROMPT=0' \
|
|
'T="${GIT_TOKEN:-${FORGEJO_TOKEN:-}}"' \
|
|
'if [ -n "$T" ]; then printf "#!/bin/sh\ncase \"\$1\" in *sername*) echo \"\$GIT_TOKEN_EFF\";; *) echo;; esac\n" > /tmp/askpass.sh; chmod 700 /tmp/askpass.sh; export GIT_ASKPASS=/tmp/askpass.sh GIT_TOKEN_EFF="$T"; fi' \
|
|
': "${REPO_URL:?set REPO_URL to the dx-maps git URL}"' \
|
|
'[ -d /app/repo/.git ] || git clone -q --depth 1 --branch "${BRANCH:-main}" "$REPO_URL" /app/repo || { echo "clone failed"; sleep 60; exit 1; }' \
|
|
'cp /app/repo/deployment/cloud/entry.sh /tmp/entry.sh && exec bash /tmp/entry.sh' \
|
|
> /boot.sh && chmod 755 /boot.sh
|
|
ENV PORT=5173 BRANCH=main PULL_INTERVAL=15
|
|
VOLUME /data
|
|
EXPOSE 5173
|
|
CMD ["/boot.sh"]
|