-
Notifications
You must be signed in to change notification settings - Fork 153
/
Copy pathDockerfile
executable file
·230 lines (181 loc) · 7.78 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
# Globally defined ARGS
ARG TESTED_API_IMAGE=undefined_test_image_used_in_ci
ARG PROD_API_IMAGE=undefined_prod_image_used_in_ci
FROM --platform=$BUILDPLATFORM node:22-alpine3.20 AS frontend-dev
ENV NODE_OPTIONS="--max-old-space-size=4096"
# Install curl
RUN apk add --no-cache curl
WORKDIR /app/packages/
FROM --platform=$BUILDPLATFORM frontend-dev AS frontend-base
# Copy package.json files of all packages
COPY packages/package.json packages/package-lock.json /app/packages/
COPY packages/frontend/package.json /app/packages/frontend/
COPY packages/markdown/package.json /app/packages/markdown/
COPY packages/pdfviewer/package.json /app/packages/pdfviewer/
COPY packages/nuxt-base-layer/package.json /app/packages/nuxt-base-layer/
COPY packages/plugin-base-layer/package.json /app/packages/plugin-base-layer/
COPY packages/rendering/package.json /app/packages/rendering/
# Install dependencies of all packages
RUN npm install
FROM --platform=$BUILDPLATFORM frontend-base AS pdfviewer
# Build JS bundle
COPY packages/pdfviewer /app/packages/pdfviewer/
WORKDIR /app/packages/pdfviewer/
RUN npm run build
FROM --platform=$BUILDPLATFORM frontend-base AS rendering
# Include source code
COPY packages/markdown /app/packages/markdown/
COPY packages/rendering /app/packages/rendering/
# Build JS bundle
WORKDIR /app/packages/rendering/
RUN npm run build
FROM --platform=$BUILDPLATFORM frontend-base AS frontend-test
# Include source code
COPY packages/markdown /app/packages/markdown/
COPY packages/nuxt-base-layer /app/packages/nuxt-base-layer/
COPY packages/frontend /app/packages/frontend/
COPY api/src/reportcreator_api/tasks/rendering/global_assets /app/packages/frontend/src/assets/rendering/
COPY --from=pdfviewer /app/packages/pdfviewer/dist/ /app/packages/nuxt-base-layer/src/public/static/pdfviewer/dist/
# Test command
WORKDIR /app/packages/frontend/
CMD ["npm", "run", "test"]
FROM --platform=$BUILDPLATFORM frontend-test AS frontend
# Build JS bundle
RUN npm run postinstall && npm run generate
FROM --platform=$BUILDPLATFORM frontend-dev AS plugin-builder-dev
RUN apk add --no-cache \
bash \
git \
curl \
wget \
unzip \
jq \
inotify-tools
WORKDIR /app/plugins/
FROM --platform=$BUILDPLATFORM plugin-builder-dev AS plugin-builder
# Copy installed node_modules
COPY --from=frontend-base /app/packages /app/packages/
# Copy source code
COPY packages/nuxt-base-layer /app/packages/nuxt-base-layer/
COPY --from=pdfviewer /app/packages/pdfviewer/dist/ /app/packages/nuxt-base-layer/src/public/static/pdfviewer/dist/
COPY packages/plugin-base-layer /app/packages/plugin-base-layer/
COPY packages/markdown /app/packages/markdown/
COPY plugins /app/plugins/
# Build plugins
RUN /app/plugins/build.sh
FROM python:3.12-slim-bookworm AS api-dev
# Get a list a preinstalled apt packages
RUN mkdir /src && \
chown 1000:1000 /src && \
dpkg-query -W -f='${binary:Package}=${Version}\n' > /src/pre_installed.txt && \
echo "This image distributes binaries of copyleft licensed software. Please find the corresponding source code in our source-code distributing images (append -src to the image tags; e.g. syslifters/sysreptor:2024.58-src)." > /src/SOURCES.txt
# Install system dependencies required by weasyprint and chromium
# Install ghostscript from debian testing
RUN echo 'Types: deb\nURIs: http://deb.debian.org/debian\nSuites: trixie\nComponents: main\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg' > /etc/apt/sources.list.d/testing.sources \
&& echo 'APT::Default-Release "stable";' > /etc/apt/apt.conf.d/default-release \
&& apt-get update && apt-get install -y --no-install-recommends \
chromium \
curl \
fontconfig \
fonts-noto \
fonts-noto-mono \
fonts-noto-ui-core \
fonts-noto-color-emoji \
fonts-noto-cjk \
fonts-noto-cjk-extra \
gpg \
gpg-agent \
libharfbuzz-subset0 \
libpango-1.0-0 \
libpangoft2-1.0-0 \
unzip \
wget \
postgresql-client \
&& apt-get -t testing install -y --no-install-recommends ghostscript \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
# Install fonts
COPY api/fonts /usr/share/fonts/truetype/
RUN mv /usr/share/fonts/truetype/fontconfig.conf /etc/fonts/conf.d/00-sysreptor-fonts.conf && \
rm -rf /usr/share/fonts/truetype/dejavu/ && \
rm -f /etc/fonts/conf.d/*dejavu* && \
fc-cache -f
# Install python packages
ENV PYTHONUNBUFFERED=on \
PYTHONDONTWRITEBYTECODE=on \
CHROMIUM_EXECUTABLE=/usr/lib/chromium/chromium \
GHOSTSCRIPT_EXECUTABLE=/usr/bin/gs \
PATH=$PATH:/root/.local/bin \
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
WORKDIR /app/api/
COPY api/pyproject.toml api/poetry.lock /app/api/
RUN pip install --no-cache poetry==1.8.5 && \
poetry config virtualenvs.create false && \
poetry install --no-cache --no-interaction --no-root
# Unprivileged user
RUN useradd --uid=1000 --create-home --shell=/bin/bash user \
&& mkdir -p /data /app/api && chown user:user /data /app/api
# Change owner and permissions to allow adding custom CA certificates
RUN chown 0:1000 /etc/ssl/certs/ && \
chown 0:1000 /usr/local/share/ca-certificates/ && \
chmod g+w /etc/ssl/certs/ && \
chmod g+w /usr/local/share/ca-certificates/
USER 1000
VOLUME [ "/data" ]
# Configure application
ARG VERSION=dev
ENV VERSION=dev \
DEBUG=off \
MEDIA_ROOT=/data/ \
SERVER_WORKERS=4 \
PDF_RENDER_SCRIPT_PATH=/app/packages/rendering/dist/bundle.js \
PLUGIN_DIRS=/app/plugins/
# Start server
EXPOSE 8000
COPY --chown=1000:1000 api/start.sh /app/api/
CMD ["/bin/bash", "/app/api/start.sh"]
FROM --platform=$BUILDPLATFORM api-dev AS api-prebuilt
# Copy source code (including pre-build static files)
COPY --chown=user:user api/src /app/api/
COPY --chown=user:user rendering/dist /app/packages/rendering/dist/
FROM --platform=$BUILDPLATFORM api-dev AS api-test
# Copy source code
COPY --chown=user:user api/src /app/api/
COPY --chown=user:user plugins /app/plugins/
RUN mkdir -p /app/api/sysreptor_plugins/ && chmod 777 /app/api/sysreptor_plugins/
# Copy generated template rendering script
COPY --from=rendering --chown=user:user /app/packages/rendering/dist /app/packages/rendering/dist/
FROM --platform=$BUILDPLATFORM api-test AS api-statics
# Generate static frontend files
# Post-process django files (for admin, API browser) and post-process them (e.g. add unique file hash)
# Do not post-process nuxt files, because they already have hash names (and django failes to post-process them)
RUN python3 manage.py collectstatic --no-input --clear
COPY --from=frontend /app/packages/frontend/dist/index.html /app/packages/frontend/dist/static/ /app/api/frontend/static/
COPY --from=plugin-builder --chown=user:user /app/plugins/ /app/plugins/
RUN mv /app/api/frontend/static/index.html /app/api/frontend/index.html \
&& ENABLED_PLUGINS='*' python3 manage.py collectstatic --no-input --no-post-process
FROM api-test AS api
COPY --from=api-statics /app/api/frontend/index.html /app/api/frontend/index.html
COPY --from=api-statics /app/api/static/ /app/api/static/
COPY --from=api-statics /app/plugins/ /app/plugins/
USER 0
COPY --chown=1000:1000 api/generate_notice.sh api/download_sources.sh api/start.sh api/NOTICE /app/api/
RUN /bin/bash /app/api/generate_notice.sh
# Copy of changelog should be one of the last things to use cache for prod releases
COPY LICENSE CHANGELOG.md /app/
ARG VERSION=dev
ENV VERSION=${VERSION}
USER 1000
# These stages are only used in CI
FROM ${TESTED_API_IMAGE} AS api-prod
ARG VERSION
ENV VERSION=${VERSION}
COPY CHANGELOG.md /app/
FROM ${PROD_API_IMAGE} AS api-src
USER 0
RUN dpkg-query -W -f='${binary:Package}=${Version}\n' > /src/post_installed.txt \
&& bash /app/api/download_sources.sh
USER 1000
# Default stage
FROM api