e34ed7e
# syntax=docker/dockerfile:1
# The actions engine (gitdata-actions-engine) lives in its own repository now,
# `git-data-actions`. Pin the tag on release — the runner pool pulls the very same
# image, so an unset/`latest` value is only a convenience for local builds.
ARG ACTIONS_IMAGE=harbor.gitdata.me/app/gitdata-act:latest
# Bun bundles the web SPA from inside web/build.rs. Take the binary from the
# official image instead of running the network installer: the installer pulls
# its archive from GitHub releases, which regularly times out here.
FROM oven/bun:1-slim AS bun
FROM rust:1-bookworm AS rust-deps
RUN apt-get update && apt-get install -y --no-install-recommends \
pkg-config \
libssl-dev \
cmake \
perl \
git \
curl \
ca-certificates \
unzip \
protobuf-compiler \
&& rm -rf /var/lib/apt/lists/*
COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
FROM rust-deps AS builder
COPY lib ./lib
COPY app ./app
COPY web ./web
RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=/build/target \
rm -rf /build/target/release/build/web-* \
/build/target/release/deps/web-* 2>/dev/null; \
cargo build --release --workspace --bins && \
mkdir -p /out && \
for b in apihost githost synchost searchhost migrate openapi im webhook runner; do \
cp "target/release/$b" /out/; \
done
# The runner shells out to `docker run` for `container:` jobs; ship just the
# static CLI so the image stays daemon-free.
RUN curl -fsSL "https://mirrors.aliyun.com/docker-ce/linux/static/stable/x86_64/docker-27.3.1.tgz" -o /tmp/docker.tgz \
&& tar -xzf /tmp/docker.tgz -C /tmp \
&& cp /tmp/docker/docker /out/docker \
&& rm -rf /tmp/docker /tmp/docker.tgz
########## actions engine ##########
# The server side of CI (workflow parse/trigger/evaluate/expand, cron matching,
# OIDC) shells out to `gitdata-actions-engine` on every operation, not just the
# runner; ship it in this image too. The binary is lifted out of the published
# actions image instead of built here, so the server and the runner pool always
# run the very same engine build.
FROM ${ACTIONS_IMAGE} AS actions-engine
########## runtime ##########
FROM debian:bookworm-slim
# git: githost/synchost spawn system git; openssh-client: ssh-keygen for host key
RUN apt-get update && apt-get install -y --no-install-recommends \
git \
ca-certificates \
libssl3 \
openssh-client \
&& rm -rf /var/lib/apt/lists/* \
&& useradd --system --create-home --uid 10001 gitdata \
&& mkdir -p /opt/gitdata/repos /opt/gitdata/objects /var/lib/gitdata-runner \
&& chown -R gitdata:gitdata /opt/gitdata /var/lib/gitdata-runner
WORKDIR /app
COPY --chown=gitdata:gitdata config/default.toml config/default.toml
COPY --from=builder /out/apihost /out/githost /out/synchost /out/searchhost /out/migrate /out/openapi /out/im /out/webhook /out/runner /usr/local/bin/
COPY --from=builder /out/docker /usr/local/bin/docker
# `gitdata-actions-engine` is spawned by the CI service (lib/ci/src/actions.rs:145)
# as well as by the runner, so the default APP_CI__ACTIONS_ENGINE_BINARY value
# (a bare name resolved via PATH) works in every role.
COPY --from=actions-engine /usr/local/bin/gitdata-actions-engine /usr/local/bin/gitdata-actions-engine
USER gitdata
EXPOSE 3000 9418 22 3001 3002 3003 3005 3006 3007
CMD ["apihost"]