Keep newFromSmartConfig within the length limit (closes #64 )

Rebasing onto the four settings from #142 put newFromSmartConfig at 82 lines, over the linter's 80-line limit. validateKnownKeys now returns early for a nil config (no config file) itself, as lookupValue already does, so the caller drops its own nil check. Behavior is unchanged. Model: opus-5-5
Read a cached source only once a processing slot is taken (closes #64 )
2026-09-29 07:32:56 +00:00 · 2026-09-29 07:32:56 +00:00 · 2026-09-29 07:32:45 +00:00 · 2026-09-29 07:32:45 +00:00 · 2026-09-29 07:32:32 +00:00 · 2026-09-29 09:11:20 +02:00
4 changed files with 40 additions and 26 deletions
@@ -3,13 +3,14 @@
 # golangci/golangci-lint:v2.12.2-alpine, 2026-08-07
 FROM golangci/golangci-lint:v2.12.2-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60 AS lint

-RUN apk add --no-cache make build-base vips-dev libheif-dev pkgconfig
-
 WORKDIR /src

-# Copy go mod files first for better layer caching
+# script/bootstrap installs the build dependencies and downloads the Go
+# modules. Only script/, go.mod and go.sum are copied first, so this
+# layer is reused until one of them changes.
+COPY script/ ./script/
 COPY go.mod go.sum ./
-RUN go mod download
+RUN script/bootstrap

 # Copy source code
 COPY . .
@@ -28,20 +29,12 @@ FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66
 # Depend on lint stage passing
 COPY --from=lint /src/go.sum /dev/null

-ARG VERSION=dev
-
-# Install build dependencies for CGO image libraries
-RUN apk add --no-cache \
-    build-base \
-    vips-dev \
-    libheif-dev \
-    pkgconfig
-
 WORKDIR /src

-# Copy go mod files first for better layer caching
+# Build dependencies and Go modules, as in the lint stage
+COPY script/ ./script/
 COPY go.mod go.sum ./
-RUN GOTOOLCHAIN=auto go mod download
+RUN script/bootstrap

 # Copy source code
 COPY . .
@@ -49,8 +42,14 @@ COPY . .
 # Run tests
 RUN make test

-# Build with CGO enabled
-RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -ldflags "-X main.Version=${VERSION}" -o /pixad ./cmd/pixad
+# VERSION is declared here, not earlier: a new value reruns only the
+# build, not script/bootstrap or the tests. CGO stays enabled for
+# govips; -trimpath keeps build paths out of the binary, and -s -w
+# leave out the symbol table and debug information.
+ARG VERSION=dev
+RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -trimpath \
+    -ldflags "-s -w -X main.Version=${VERSION}" \
+    -o /pixad ./cmd/pixad

 # Runtime stage
 # alpine:3.21, 2026-02-25
@@ -6,16 +6,16 @@
 # golangci/golangci-lint:v2.12.2-alpine, 2026-08-07
 FROM golangci/golangci-lint:v2.12.2-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60

-# pixa is CGO/libvips: the type-aware linters compile every package, so
-# this image needs the same C libraries the build does.
-RUN apk add --no-cache build-base vips-dev libheif-dev pkgconfig
-
 WORKDIR /src

-# Modules first for layer caching; go.mod/go.sum settle this layer's
-# result, so it may safely be reused between runs.
+# pixa is CGO/libvips: the type-aware linters compile every package, so
+# this image needs the same C libraries the build does. script/bootstrap
+# installs them and downloads the Go modules. Only script/, go.mod and
+# go.sum are copied first; they settle this layer's result, so it may
+# safely be reused between runs.
+COPY script/ ./script/
 COPY go.mod go.sum ./
-RUN go mod download
+RUN script/bootstrap

 COPY . .

@@ -39,6 +39,14 @@ P2: security: referer blacklist
  10 seconds for a free one, then gets 503 `server busy, try again later`;
  libvips runs one worker thread per image with its operation cache off;
  documented in `README.md` and `config.example.yml`.
+- 2026-09-29 Dockerfiles install through `script/bootstrap` (closes #95): the
+  `Dockerfile` lint and build stages and `Dockerfile.lint` copy `script/`,
+  `go.mod` and `go.sum`, then run `script/bootstrap` in place of their own
+  `apk add` lines, so the build dependencies are listed in one place;
+  `script/bootstrap` now also installs a C compiler when `gcc` is missing; the
+  build uses `-trimpath` and `-s -w` and keeps `CGO_ENABLED=1` for govips;
+  `ARG VERSION` sits just above the build, so a new version reruns neither
+  `script/bootstrap` nor the tests.
 - 2026-09-29 migrations at the path `REPO_POLICIES.md` sets (closes #96): the
  migration files moved, contents unchanged, from `internal/database/schema/`
  to `internal/db/migrations/` as `000_migration.sql` and `001_schema.sql`; the
@@ -5,8 +5,10 @@
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). The linter is never installed on the host: golangci-lint
 # runs only inside a container, Dockerfile.lint or the Dockerfile lint
-# stage (see script/lint). CGO image libraries (pkg-config, vips,
-# libheif) are installed for the govips bindings.
+# stage (see script/lint). A C compiler and the CGO image libraries
+# (pkg-config, vips, libheif) are installed for the govips bindings.
+# Both Dockerfiles run this script too, so their build dependencies are
+# the ones listed here.
 set -eu

 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -53,6 +55,11 @@ missing() {

 # CGO dependencies for govips (image processing)
 ensure_cgo_deps() {
+    # cgo compiles with gcc on Linux; build-base and build-essential
+    # also bring the C library headers.
+    if missing gcc; then
+        pkg_install gcc build-essential gcc build-base
+    fi
    if missing pkg-config; then
        pkg_install pkg-config pkg-config pkg-config pkgconfig
    fi
Author	SHA1	Message	Date
clawbot	add0e2ba6a	Keep newFromSmartConfig within the length limit (closes #64 ) check / check (push) Successful in 3m41s Details Rebasing onto the four settings from #142 put newFromSmartConfig at 82 lines, over the linter's 80-line limit. validateKnownKeys now returns early for a nil config (no config file) itself, as lookupValue already does, so the caller drops its own nil check. Behavior is unchanged. Model: opus-5-5	2026-09-29 07:32:56 +00:00
clawbot	d800aa62a7	Read a cached source only once a processing slot is taken (closes #64 ) A request whose source was in the disk cache read the whole file into memory, then waited for a processing slot, so a burst of new sizes for one large cached image held one copy per waiting request, with no ceiling. The service now opens the cached file and hands it to the image processor, which reads it only after taking its slot. The file's size, now returned by GetSourceContent, still sends an empty or oversized cached source to upstream instead. A cached file that fails while being read now fails the request instead of being fetched again. Model: opus-5-5	2026-09-29 07:32:56 +00:00
clawbot	9e1f5d4cea	Test that a cached source is read only with a processing slot (closes #64 ) Failing test: with the only processing slot held, a request for a new width of a cached image waits for the slot while the cached file is rewritten; the answer must come from the rewritten file, so the request read none of the source before it had a slot. Also a test that a fetch whose request context ends while it waits for a connection shared by all hosts gives its host's slot back; that one passes already. Model: opus-5-5	2026-09-29 07:32:45 +00:00
clawbot	fffd97d3d8	Bound concurrent image processing and upstream fetches (closes #64 ) max_concurrent_processing (default: the number of CPUs Go uses) bounds the images processed at once, and upstream_connections (default 64) the fetches from all upstream hosts together, beside the per-host limit. A request that finds either full waits up to 10 seconds, then gets 503 "server busy, try again later". The processor holds its slot from before it reads the input until it returns, and takes a free slot even after the request context has ended; a fetch holds its connection until the response body is closed, after its image is processed. libvips now starts with one worker thread per image and no operation cache. Both settings have PIXA_ variables and are in README.md and config.example.yml. Model: opus-5-5	2026-09-29 07:32:45 +00:00
clawbot	6cb280919f	Test the processing and upstream connection limits (closes #64 ) Failing tests for two limits that do not exist yet. Config: max_concurrent_processing and upstream_connections, their defaults, and valid and invalid values from the file and the environment. Image processor: never more images at once than its limit, waiting and then failing with ErrTooManyImages when no slot frees, and freeing its slot on every error. Fetcher: connections to all hosts counted together, apart from the per-host limit, and freed on errors. Both image routes answer 503 when either wait gives up. TestEnvironmentSetsEveryKey sets the two new variables, as it compares the whole config. The tests do not compile until the limits exist. Model: opus-5-5	2026-09-29 07:32:32 +00:00
clawbot	0c99be939a	Install Dockerfile build dependencies through script/bootstrap (closes #95 ) check / check (push) Successful in 3m29s Details The Dockerfile lint and build stages and Dockerfile.lint each carried their own apk add list, a copy of what script/bootstrap installs. They now copy script/, go.mod and go.sum and run script/bootstrap, so that layer is reused until one of those changes. script/bootstrap gains a C compiler check: the golang image has none, and cgo needs one. The build adds -trimpath and -s -w; CGO_ENABLED=1 stays, as govips links libvips. ARG VERSION moves to just above the build, so a new version reruns neither script/bootstrap nor the tests. Model: opus-5-5	2026-09-29 09:11:20 +02:00