mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 07:41:27 +00:00
Tomáš Dvořák
3cc84553f4
Git-sourced deploys never materialized a checkout: sourcePath was build_path resolved against the server cwd, so builds consumed the backend's own directory. Remote placement could only run registry-pulled images. - internal/source: per-deployment checkout (init/fetch/checkout) at branch or commit; GIT_ASKPASS keeps tokens out of argv, .git/config, and the build context; dumb-transport and SHA-refusal fallbacks; build_path validated inside the checkout. - BuildManager.PackageContext: produces the same tar context Build ships to the daemon — generated Dockerfile at tar root, .git excluded. Fixes nixpacks passing the Dockerfile path as content. - Agent artifact endpoint: GET /api/agents/artifacts/:id streams build contexts and docker-save tarballs behind agent-token auth; hex-validated ids, per-deployment cleanup, boot-time purge. - Agent commands: build_image (docker build -, --build-arg values via process env, not argv) and load_image (docker load for containr-* rollback tags no registry serves). - Deployment flow: remote git builds package context → artifact → node docker-builds the deployment tag; remote rollbacks of local tags export via SaveImage → artifact → node docker-loads. Verified end-to-end: agent-pinned git service built on the node (build_image → create_container → deployed) and rollback shipped a docker-save tarball (load_image → deployed). Artifact auth returns 401/404 correctly; workspaces and blobs are removed after deploy. Authored By: TDvorak <[email protected]>
55 lines
1.5 KiB
Docker
55 lines
1.5 KiB
Docker
# Build Go API binary
|
|
FROM golang:1.26-alpine AS go-builder
|
|
|
|
RUN apk add --no-cache git ca-certificates tzdata
|
|
|
|
WORKDIR /app
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo \
|
|
-ldflags "-X containr/internal/api.Version=${VERSION}" -o main cmd/server/main.go
|
|
|
|
# Node-agent binaries served by the API for SSH/bootstrap installs.
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-amd64 ./cmd/agent && \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-arm64 ./cmd/agent
|
|
|
|
# Build embedded Better Auth runtime dependencies
|
|
FROM node:22-alpine AS auth-builder
|
|
|
|
WORKDIR /auth
|
|
|
|
COPY auth/package*.json ./
|
|
RUN npm ci --omit=dev
|
|
|
|
COPY auth/src ./src
|
|
|
|
# Final runtime image (Go API + Better Auth sidecar in one container)
|
|
FROM node:22-alpine
|
|
|
|
RUN apk --no-cache add ca-certificates tzdata wget git
|
|
|
|
RUN addgroup -g 1001 -S appgroup && \
|
|
adduser -u 1001 -S appuser -G appgroup
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=go-builder /app/main ./main
|
|
COPY --from=go-builder /app/migrations_goose ./migrations_goose
|
|
COPY --from=go-builder /agents /agents
|
|
COPY --from=auth-builder /auth ./auth
|
|
|
|
RUN chown -R appuser:appgroup /app
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/health || exit 1
|
|
|
|
CMD ["./main"]
|