clawbot
4c2932d6d6
check / check (push) Failing after 2m11s
make fmt and make fmt-check now cover every Markdown file with prettier (4-space tabs, proseWrap always), as template-app-go does: prettier is pinned by package.json and yarn.lock and runs in a docker build on a digest-pinned node image, never on the host. The check is forced to run with --no-cache-filter, as script/lint is. script/fmt-check is split into a Go half and a Markdown half because the Dockerfile lint stage cannot run docker: that stage now runs the Go half and script/cibuild runs the Markdown half after the build. *.md leaves .dockerignore so documents reach the build context. README.md, TESTING.md and TODO.md are reformatted by make fmt; apart from the README Entrypoints entries, its make fmt line under Building and the TODO entry, that diff is mechanical. Model: opus-5-5
79 lines
2.9 KiB
Docker
79 lines
2.9 KiB
Docker
# Lint stage - fast feedback on lint issues, before the build starts.
|
|
# The linter is invoked directly rather than through `make lint`: that
|
|
# target shells out to `docker build -f Dockerfile.lint`, and there is
|
|
# no docker daemon inside a docker build. For the same reason this stage
|
|
# runs only the Go half of `make fmt-check`; script/cibuild runs the
|
|
# markdown half after this build.
|
|
# script/cibuild and script/docker name this stage in --no-cache-filter.
|
|
# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-10
|
|
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
RUN script/fmt-check-go
|
|
RUN golangci-lint run --config .golangci.yml ./...
|
|
|
|
# Build stage
|
|
# script/cibuild and script/docker name this stage in --no-cache-filter.
|
|
# golang 1.25-alpine, 2026-02-28
|
|
FROM golang@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
|
|
|
|
RUN apk add --no-cache git make gcc musl-dev binutils-gold
|
|
|
|
# Force BuildKit to run the lint stage before proceeding
|
|
COPY --from=lint /src/go.sum /dev/null
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Run the tests - build fails if any test fails
|
|
RUN make test
|
|
|
|
# Build the binary. .dockerignore leaves out .git, so `git describe` in
|
|
# the Makefile cannot find the version here: script/docker passes it as
|
|
# --build-arg VERSION, and a build that passes none reports `dev`.
|
|
ARG VERSION=dev
|
|
RUN make build VERSION="${VERSION}"
|
|
|
|
# Runtime stage
|
|
# alpine 3.21, 2026-02-28
|
|
FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
|
|
|
|
RUN apk add --no-cache ca-certificates tzdata su-exec
|
|
|
|
COPY --from=builder /src/bin/dnswatcher /usr/local/bin/dnswatcher
|
|
COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# dnswatcher runs as this unprivileged user. The entrypoint creates the
|
|
# data directory and gives it to this user on every start.
|
|
RUN addgroup -S -g 10001 dnswatcher \
|
|
&& adduser -S -G dnswatcher -u 10001 dnswatcher
|
|
|
|
ENV DNSWATCHER_DATA_DIR=/var/lib/dnswatcher
|
|
|
|
# Config loading also reads a `.env` file and a file named `dnswatcher`
|
|
# (any config extension, or none) from the working directory. `/` holds
|
|
# neither, so every setting comes from the environment. Do not make the
|
|
# data directory, or the binary's directory, the working directory.
|
|
WORKDIR /
|
|
|
|
# No USER: the entrypoint must start as root to set up the data
|
|
# directory; it then runs dnswatcher as the dnswatcher user.
|
|
|
|
EXPOSE 8080
|
|
|
|
# busybox wget (already in alpine) probes the health endpoint every 10
|
|
# seconds, so the container is healthy well before upaas reads its health
|
|
# 60 seconds after a deploy and fails the deploy unless it is healthy.
|
|
HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget -q -O /dev/null "http://127.0.0.1:${PORT:-8080}/.well-known/healthcheck" || exit 1
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|