Nguyen Minh Phuc
e7496562b3
ci / lint (push) Successful in 23s
ci / types (push) Successful in 34s
ci / unit (push) Successful in 26s
ci / security (push) Successful in 36s
ci / dockerfile (push) Successful in 5s
ci / chart (push) Successful in 7s
ci / integration (push) Successful in 45s
ci / image (reconciler) (push) Successful in 1m58s
ci / image (worker) (push) Successful in 1m55s
ci / image (api) (push) Successful in 1m40s
ci / bump (push) Successful in 13s
Run #70's logs still showed one Docker Hub reference, from the one place that does not look like an image reference: #2 resolve image config for docker-image://docker.io/docker/dockerfile:1.10 `# syntax=` is an image pull. Same mirror, same digest, and pinned now — it was the only unpinned image left in the build.
57 lines
2.6 KiB
Docker
57 lines
2.6 KiB
Docker
# syntax=mirror.gcr.io/docker/dockerfile:1.10@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
|
|
#
|
|
# svcforge reconciler. Build from the REPO ROOT:
|
|
# docker buildx build -f services/reconciler/Dockerfile -t svcforge/reconciler:dev .
|
|
#
|
|
# Reads helm state to detect drift, so it carries helm — but never kubectl, and it never
|
|
# writes: the four checks enqueue tasks, they do not provision. Orphans are logged, never
|
|
# deleted.
|
|
|
|
FROM mirror.gcr.io/library/python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6 AS builder
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.11.29@sha256:eb2843a1e56fd9e30c7276ce1a52cba86e64c7b385f5e3279a0e08e02dd058fc /uv /usr/local/bin/uv
|
|
|
|
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml uv.lock ./
|
|
COPY libs/svcforge_core/pyproject.toml libs/svcforge_core/
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-editable \
|
|
--no-install-project --no-install-package svcforge-core
|
|
|
|
COPY libs/ libs/
|
|
COPY services/reconciler/ services/reconciler/
|
|
COPY catalog.yaml ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-editable && \
|
|
/app/.venv/bin/python -c 'import svcforge_core, sys; \
|
|
p = svcforge_core.__file__; \
|
|
sys.exit(0) if "site-packages" in p else sys.exit("not a wheel install: " + p)'
|
|
|
|
# --- runtime --------------------------------------------------------------------------
|
|
FROM mirror.gcr.io/library/python:3.14-slim@sha256:cea0e6040540fb2b965b6e7fb5ffa00871e632eef63719f0ea54bca189ce14a6
|
|
|
|
ARG BUILD_SHA=unknown
|
|
LABEL org.opencontainers.image.title="svcforge-reconciler" \
|
|
org.opencontainers.image.source="https://gitea.oci-oci.duckdns.org/gitea_admin/svcforge" \
|
|
org.opencontainers.image.revision="${BUILD_SHA}"
|
|
|
|
RUN useradd -u 10001 -m -s /usr/sbin/nologin svcforge
|
|
WORKDIR /app
|
|
COPY --from=builder --chown=10001:10001 /app /app
|
|
|
|
# helm 3.21.3, not 3.16.2 — see services/worker/Dockerfile. 3.16.2 is a Go 1.22.9 build
|
|
# carrying CRITICAL CVE-2025-68121 (crypto/tls) and CVE-2026-33186 (grpc) and HIGH
|
|
# CVE-2026-35469 (spdystream). Kept on 3.x on purpose: helm 4 is a breaking change.
|
|
COPY --from=mirror.gcr.io/alpine/helm:3.21.3@sha256:35da09ba0716fc7c3cd63b6b31ee380a9c7662e95f29ab0e4ae962420afd315b /usr/bin/helm /usr/local/bin/helm
|
|
|
|
ENV PATH="/app/.venv/bin:$PATH" \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
HELM_CACHE_HOME=/tmp/helm/cache \
|
|
HELM_CONFIG_HOME=/tmp/helm/config \
|
|
HELM_DATA_HOME=/tmp/helm/data
|
|
USER 10001
|
|
ENTRYPOINT ["python", "-m", "services.reconciler.main"]
|