clawbot
0cef03d3a5
check / check (push) Successful in 7m45s
Both scripts pass a new CHECK_EPOCH, which the Dockerfile's make fmt-check, make lint and make test steps name in their commands. On an unchanged tree Docker used to serve those steps from its build cache, so a run could pass without checking anything. The script/bootstrap steps stay cached. A plain docker build . still works, as upaas builds the image that way: it leaves CHECK_EPOCH empty and reuses the check steps only for an identical build context. Model: opus-5-5
111 lines
4.1 KiB
Docker
111 lines
4.1 KiB
Docker
# Lint stage
|
|
# Same image as Dockerfile.lint: change both pins together.
|
|
# golangci/golangci-lint:v2.12.2-alpine, 2026-08-07
|
|
FROM golangci/golangci-lint:v2.12.2-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60 AS lint
|
|
|
|
WORKDIR /src
|
|
|
|
# script/bootstrap installs the build dependencies and downloads the Go
|
|
# modules. Only script/, go.mod and go.sum are copied first, so this
|
|
# layer is reused until one of them changes.
|
|
COPY script/ ./script/
|
|
COPY go.mod go.sum ./
|
|
RUN script/bootstrap
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Tells script/lint it is inside a container, so it runs the linter.
|
|
ENV container=docker
|
|
|
|
# Run formatting check and linter. script/cibuild and script/docker pass
|
|
# a new CHECK_EPOCH on every run, and each check step names it in its
|
|
# command, so a new value reruns the step instead of reusing a cached
|
|
# success that checked nothing. A plain `docker build .` leaves it empty
|
|
# and reuses the check steps only for an identical build context.
|
|
ARG CHECK_EPOCH
|
|
RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
|
|
RUN echo "check epoch: ${CHECK_EPOCH}" && make lint
|
|
|
|
# Build stage
|
|
# golang:1.25.4-alpine, 2026-02-25
|
|
FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
|
|
|
|
# Depend on lint stage passing
|
|
COPY --from=lint /src/go.sum /dev/null
|
|
|
|
WORKDIR /src
|
|
|
|
# Build dependencies and Go modules, as in the lint stage
|
|
COPY script/ ./script/
|
|
COPY go.mod go.sum ./
|
|
RUN script/bootstrap
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Run tests; a new CHECK_EPOCH reruns them, as in the lint stage.
|
|
ARG CHECK_EPOCH
|
|
RUN echo "check epoch: ${CHECK_EPOCH}" && make test
|
|
|
|
# VERSION is declared here, not earlier: a new value reruns only the
|
|
# build, not script/bootstrap or the tests. Given none, the version is
|
|
# `git describe --tags --always` of the .git in the build context (git
|
|
# comes from script/bootstrap): the tag on a tagged commit, tag-N-gHASH
|
|
# after one, the short commit when no tag is reachable. A context that
|
|
# carries .git and still yields no version fails the build; one without
|
|
# .git, as from a source tarball, stamps an empty version. CGO stays
|
|
# enabled for govips; -trimpath keeps build paths out of the binary, and
|
|
# -s -w leave out the symbol table and debug information.
|
|
ARG VERSION
|
|
RUN version="${VERSION:-$(git describe --tags --always)}"; \
|
|
if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
|
|
[ "$version" = unknown ]; }; then \
|
|
echo "the build context carries .git but yields no version" >&2; \
|
|
exit 1; \
|
|
fi; \
|
|
CGO_ENABLED=1 GOTOOLCHAIN=auto go build -trimpath \
|
|
-ldflags "-s -w -X main.Version=${version}" \
|
|
-o /pixad ./cmd/pixad
|
|
|
|
# Runtime stage
|
|
# alpine:3.21, 2026-02-25
|
|
FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
|
|
|
|
# Install runtime dependencies only
|
|
RUN apk add --no-cache \
|
|
vips \
|
|
libheif \
|
|
ca-certificates \
|
|
tzdata \
|
|
su-exec
|
|
|
|
# Copy binary from builder
|
|
COPY --from=builder /pixad /usr/local/bin/pixad
|
|
COPY deploy/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
# Create non-root user, config directory, and data directory. pixad
|
|
# gets uid and gid 65532, which host login and system accounts do not
|
|
# use: a bind-mounted /var/lib/pixa is given to pixad, and on the host
|
|
# it must not belong to a person's account.
|
|
RUN addgroup -g 65532 pixad && \
|
|
adduser -D -H -s /sbin/nologin -u 65532 -G pixad pixad && \
|
|
mkdir -p /var/lib/pixa /etc/pixa && \
|
|
chown pixad:pixad /var/lib/pixa
|
|
|
|
# No USER: the entrypoint must start as root to give a bind-mounted
|
|
# /var/lib/pixa to pixad; it then runs the server as pixad.
|
|
WORKDIR /var/lib/pixa
|
|
|
|
EXPOSE 8080
|
|
|
|
# Shell form so the probe follows PORT; a port set only in a mounted
|
|
# config file is not seen here.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget --spider -q "http://localhost:${PORT:-8080}/.well-known/healthcheck.json" || exit 1
|
|
|
|
# Settings come from PORT and the PIXA_ environment variables; only
|
|
# PIXA_SIGNING_KEY is required. A config file mounted at
|
|
# /etc/pixa/config.yml is optional and is read when present.
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|