mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-24 16:21:54 +02:00
Arunavo Ray
89babdf461
The test failed in CI because another file replaces bun:sqlite with mock.module, which leaks across files depending on order. It now runs in an isolated child process like the other fetch and sqlite driven suites. Each case builds its database with manage-db init, so the tables come from drizzle/ instead of hand written DDL that could drift, and the bundle is built once in beforeAll instead of at import time. The Dockerfile rewrite of the manage-db scripts is now a one line sed.
115 lines
4.7 KiB
Docker
115 lines
4.7 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
FROM oven/bun:1.3.14-debian@sha256:9dba1a1b43ce28c9d7931bfc4eb00feb63b0114720a0277a8f939ae4dfc9db6f AS base
|
|
WORKDIR /app
|
|
RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \
|
|
python3 make g++ gcc wget sqlite3 openssl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ----------------------------
|
|
FROM base AS builder
|
|
COPY package.json ./
|
|
COPY bun.lock* ./
|
|
RUN bun install --frozen-lockfile
|
|
|
|
COPY . .
|
|
RUN bun run build
|
|
RUN mkdir -p dist/scripts && \
|
|
for script in scripts/*.ts; do \
|
|
if [ "$(basename "$script")" = "runtime-server.ts" ]; then continue; fi; \
|
|
bun build "$script" --target=bun --outfile=dist/scripts/$(basename "${script%.ts}.js"); \
|
|
done
|
|
|
|
# ----------------------------
|
|
FROM base AS pruner
|
|
COPY package.json ./
|
|
COPY bun.lock* ./
|
|
RUN bun install --production --omit=peer --frozen-lockfile
|
|
|
|
# ----------------------------
|
|
# Build git-lfs from source with patched Go to resolve Go stdlib CVEs
|
|
FROM debian:trixie-slim AS git-lfs-builder
|
|
RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \
|
|
wget ca-certificates git make \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
ARG GO_VERSION=1.27.1
|
|
ARG GIT_LFS_VERSION=3.7.1
|
|
# Pinned rather than @latest: a cached layer kept an old @latest resolution
|
|
# after golang.org/x/crypto 0.56.0 fixed CVE-2026-56855 and CVE-2026-78662.
|
|
# x/crypto 0.56.0 needs Go 1.26 or newer, hence the toolchain above.
|
|
ARG GO_X_CRYPTO_VERSION=v0.56.0
|
|
ARG GO_X_NET_VERSION=v0.58.0
|
|
RUN ARCH="$(dpkg --print-architecture)" \
|
|
&& wget -qO /tmp/go.tar.gz "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" \
|
|
&& tar -C /usr/local -xzf /tmp/go.tar.gz \
|
|
&& rm /tmp/go.tar.gz
|
|
ENV PATH="/usr/local/go/bin:/root/go/bin:${PATH}"
|
|
# Force using our installed Go (not the version in go.mod toolchain directive)
|
|
ENV GOTOOLCHAIN=local
|
|
RUN git clone --branch "v${GIT_LFS_VERSION}" --depth 1 https://github.com/git-lfs/git-lfs.git /tmp/git-lfs \
|
|
&& cd /tmp/git-lfs \
|
|
&& go get "golang.org/x/crypto@${GO_X_CRYPTO_VERSION}" \
|
|
&& go get "golang.org/x/net@${GO_X_NET_VERSION}" \
|
|
&& go mod tidy \
|
|
&& make \
|
|
&& install -m 755 /tmp/git-lfs/bin/git-lfs /usr/local/bin/git-lfs
|
|
|
|
# ----------------------------
|
|
FROM oven/bun:1.3.14-debian@sha256:9dba1a1b43ce28c9d7931bfc4eb00feb63b0114720a0277a8f939ae4dfc9db6f AS runner
|
|
WORKDIR /app
|
|
RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \
|
|
git wget sqlite3 openssl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
# The app runs as an unprivileged user and never calls a setuid helper.
|
|
# Dropping the bits closes the path CVE-2026-78409 and CVE-2026-78410 need
|
|
# in mount(8); Debian ships no trixie fix for them. See .vex/README.md.
|
|
RUN find / -xdev -type f -perm /6000 -exec chmod a-s '{}' +
|
|
# OpenVEX statements for CVEs this image cannot reach, so that
|
|
# `docker scout cves` on the published image reports them as not affected.
|
|
COPY .vex/*.vex.json /var/lib/db/
|
|
COPY --from=git-lfs-builder /usr/local/bin/git-lfs /usr/local/bin/git-lfs
|
|
RUN git lfs install
|
|
COPY --from=pruner /app/node_modules ./node_modules
|
|
COPY --from=builder /app/dist ./dist
|
|
COPY --from=builder /app/package.json ./package.json
|
|
COPY --from=builder /app/docker-entrypoint.sh ./docker-entrypoint.sh
|
|
COPY --from=builder /app/scripts/runtime-server.ts ./scripts/runtime-server.ts
|
|
COPY --from=builder /app/drizzle ./drizzle
|
|
|
|
# Database commands must use the bundled script: sources are not shipped.
|
|
RUN sed -i 's#bun scripts/manage-db.ts#bun dist/scripts/manage-db.js#g' package.json
|
|
|
|
# Remove build-only packages that are not needed at runtime
|
|
# (esbuild, vite, rollup, tailwind, svgo — all only used during `astro build`)
|
|
RUN rm -rf node_modules/esbuild node_modules/@esbuild \
|
|
node_modules/rollup node_modules/@rollup \
|
|
node_modules/vite node_modules/svgo \
|
|
node_modules/@tailwindcss/vite \
|
|
node_modules/tailwindcss
|
|
|
|
ENV NODE_ENV=production
|
|
ENV HOST=0.0.0.0
|
|
ENV PORT=4321
|
|
ENV DATABASE_URL=file:data/gitea-mirror.db
|
|
ENV BASE_URL=/
|
|
|
|
# Create directories and setup permissions
|
|
RUN mkdir -p /app/certs && \
|
|
chmod +x ./docker-entrypoint.sh && \
|
|
mkdir -p /app/data && \
|
|
groupadd --system --gid 1001 nodejs && \
|
|
useradd --system --uid 1001 --gid 1001 --create-home --home-dir /home/gitea-mirror gitea-mirror && \
|
|
chown -R gitea-mirror:nodejs /app/data && \
|
|
chown -R gitea-mirror:nodejs /app/certs && \
|
|
chown -R gitea-mirror:nodejs /home/gitea-mirror
|
|
|
|
USER gitea-mirror
|
|
|
|
VOLUME /app/data
|
|
EXPOSE 4321
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD sh -c 'BASE="${BASE_URL:-/}"; if [ "$BASE" = "/" ]; then BASE=""; else BASE="${BASE%/}"; fi; wget --no-verbose --tries=1 --spider "http://localhost:4321${BASE}/api/health" || exit 1'
|
|
|
|
ENTRYPOINT ["./docker-entrypoint.sh"]
|