c966ac4801
All checks were successful
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / changes (pull_request) Successful in 9s
shell-lint / shellcheck (pull_request) Successful in 8s
PR build (required check) / build-backend (pull_request) Has been skipped
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 2s
docker-stack.yml previously had no cpu/memory limits on db or forgejo, unlike every service in the app stack. Add generous limits (several times observed steady-state usage) as a backstop, overridable via env vars matching the app stack's convention. Also add ci-runner/Dockerfile: a slim Debian base with the Docker CLI + buildx preinstalled, replacing node:20-bookworm (leftover from when the frontend was Python/Jinja; nothing in CI uses npm/node anymore). Closes a COPY --chown group-resolution bug in the classic Docker builder that apt-get install docker.io currently pulls in on every build-push job, and drops that install step's cost once cut over. Built and verified locally; not yet pushed to the registry (needs a write:package-scoped token) or wired into the live runner.
41 lines
2.4 KiB
Docker
41 lines
2.4 KiB
Docker
# Job-container image for the LAN Forgejo Actions runner's `docker`-labeled
|
|
# jobs (see ../register-lan-runner.sh) — used by every backend/frontend
|
|
# build-push, deploy, and validation workflow that needs `docker build`.
|
|
#
|
|
# Replaces the stock node:20-bookworm image. That base is pure leftover from
|
|
# when the frontend was a Python/Jinja app the old GitHub runner also built
|
|
# JS assets for; the frontend is Go now (no npm/node anywhere in
|
|
# .forgejo/workflows/) so carrying a full Node runtime here just adds weight.
|
|
# Every workflow using the `docker` label also currently re-provisions the
|
|
# Docker CLI itself on each run via `apt-get install docker.io` — that step
|
|
# costs ~15-20s per job and, more importantly, installs the CLASSIC Docker
|
|
# builder rather than BuildKit, which mishandles `COPY --chown=<name>` group
|
|
# resolution on images without a matching system group (a real bug hit during
|
|
# the frontend Go rewrite). Installing docker-buildx-plugin here makes
|
|
# BuildKit the default, closing that bug class, on a much smaller base.
|
|
#
|
|
# Build/push (manual — see ../README.md for when to rebuild):
|
|
# docker build -t git.thermograph.org/emi/thermograph/ci-runner:vN \
|
|
# infra/deploy/forgejo/ci-runner
|
|
# docker push git.thermograph.org/emi/thermograph/ci-runner:vN
|
|
#
|
|
# Cutting over the live runner to a new tag means editing the `labels` array
|
|
# in ~/forgejo-runner/.runner on the runner host directly (same runner
|
|
# id/token, no re-registration needed) and updating register-lan-runner.sh's
|
|
# LABELS default so future re-provisioning picks it up too.
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update -qq \
|
|
&& apt-get install -y -qq --no-install-recommends \
|
|
ca-certificates curl gnupg git python3 python3-yaml \
|
|
&& install -m 0755 -d /etc/apt/keyrings \
|
|
&& curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
|
|
&& chmod a+r /etc/apt/keyrings/docker.asc \
|
|
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" \
|
|
> /etc/apt/sources.list.d/docker.list \
|
|
&& apt-get update -qq \
|
|
&& apt-get install -y -qq --no-install-recommends docker-ce-cli docker-buildx-plugin \
|
|
&& rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/docker.list
|
|
|
|
RUN docker --version && docker buildx version && git --version \
|
|
&& python3 -c "import yaml; print('PyYAML', yaml.__version__)"
|