From 5809cb237407a00265237724982467914aff5190 Mon Sep 17 00:00:00 2001
From: Jerry Yan <792602257@qq.com>
Date: Mon, 27 Jul 2026 10:51:50 +0800
Subject: [PATCH] Docker

---
 .dockerignore |  38 +++++++++++++
 Dockerfile    | 115 +++++++++++++++++++++++++++++++++++++++
 Jenkinsfile   | 146 ++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 299 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 Dockerfile
 create mode 100644 Jenkinsfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..b82542c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,38 @@
+.venv/
+.venv.bak/
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.idea/
+.vscode/
+.DS_Store
+
+# 凭据与本地配置
+.env
+.env.*
+!.env.example
+
+# 运行时产物
+logs/
+.probe/
+
+# 测试不进镜像（Jenkinsfile 里单独跑）
+tests/
+
+# 仓库元数据与文档
+.git/
+.gitignore
+.gitattributes
+.mcp.json
+README.md
+*.md
+
+# CI / 部署文件本身
+Dockerfile
+.dockerignore
+Jenkinsfile
+docker-compose*.yml
+deploy/
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..749d83b
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,115 @@
+# syntax=docker/dockerfile:1.7
+#
+# 多阶段构建：
+#   builder —— 装 uv、跑 uv sync 拿到 .venv（含 browser 兜底的 playwright）
+#   runtime —— 仅保留 .venv + app + Chromium 二进制；非 root 运行
+#
+# 镜像默认包含 Playwright 浏览器兜底（与 .env.example 的
+# RAKUTEN_BROWSER_FALLBACK_ENABLED=true 对齐），首次构建多约 400MB。
+# 若要裁剪，可改为 uv sync --no-dev（去掉 --extra browser）。
+
+# ----------------------------- builder -----------------------------
+FROM registry.jerryyan.top/library/python:3.13-slim AS builder
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_COMPILE_BYTECODE=1 \
+    # 国内 PyPI 镜像：uv sync / uv pip install 走阿里云，避免从官方 PyPI 拉包缓慢
+    UV_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/
+
+# uv pin 一个已知版本，保证构建可复现
+COPY --from=registry-ghcr.jerryyan.top/astral-sh/uv:python3.13-bookworm-slim /uv /uvx /usr/local/bin/
+
+WORKDIR /app
+
+# 先拷锁文件 + 元数据，让依赖层独立缓存
+COPY uv.lock pyproject.toml ./
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev --extra browser
+
+# 再拷源码并 install（这样改 app/ 不会重下依赖）
+COPY app ./app
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev --extra browser
+
+# ----------------------------- runtime -----------------------------
+FROM registry.jerryyan.top/library/python:3.13-slim AS runtime
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    VIRTUAL_ENV=/app/.venv \
+    PATH="/app/.venv/bin:${PATH}" \
+    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \
+    # Playwright 浏览器二进制走 npmmirror 镜像，避免从 azureedge 拉取缓慢
+    PLAYWRIGHT_DOWNLOAD_HOST=https://cdn.npmmirror.com/binaries/playwright \
+    RAKUTEN_APP_HOST=0.0.0.0 \
+    RAKUTEN_APP_PORT=31107
+
+# Chromium 运行所需的最小系统依赖。
+# 这里显式列出而不是用 `playwright install-deps`，是因为后者要求 root + apt
+# 且版本敏感；锁版本后构建更稳。当前用 libasound2（bookworm 命名）；
+# 若基础镜像切到 trixie，需改为 libasound2t64。
+RUN set -e; \
+    { \
+        if [ -f /etc/apt/sources.list ]; then \
+            sed -i 's|deb.debian.org|mirrors.aliyun.com|g; s|security.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list; \
+        fi; \
+        if [ -f /etc/apt/sources.list.d/debian.sources ]; then \
+            sed -i 's|deb.debian.org|mirrors.aliyun.com|g; s|security.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources; \
+        fi; \
+    } && \
+    apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        fonts-liberation \
+        libasound2 \
+        libatk-bridge2.0-0 \
+        libatk1.0-0 \
+        libcairo2 \
+        libcups2 \
+        libdbus-1-3 \
+        libdrm2 \
+        libgbm1 \
+        libglib2.0-0 \
+        libnspr4 \
+        libnss3 \
+        libpango-1.0-0 \
+        libx11-6 \
+        libxcb1 \
+        libxcomposite1 \
+        libxdamage1 \
+        libxext6 \
+        libxfixes3 \
+        libxkbcommon0 \
+        libxrandr2 \
+        xdg-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# 非 root 账号
+RUN groupadd --system --gid 10001 rakuten \
+    && useradd --system --uid 10001 --gid rakuten --no-create-home --shell /usr/sbin/nologin rakuten
+
+WORKDIR /app
+
+# venv + 源码
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/app /app/app
+
+# 可写目录：logs（Loguru）、浏览器二进制（~300MB）
+RUN mkdir -p /app/logs /ms-playwright \
+    && chown -R rakuten:rakuten /app /ms-playwright
+
+USER rakuten
+
+# 下载 Chromium（仅二进制，不再装系统依赖）
+RUN /app/.venv/bin/playwright install chromium
+
+# 健康检查走应用自带的 /health（轻量、不会触发真实抓取）
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD curl -fsS http://127.0.0.1:${RAKUTEN_APP_PORT}/health || exit 1
+
+EXPOSE 31107
+
+# 配置走环境变量（生产请挂 .env 或用 k8s ConfigMap/Secret 注入）
+CMD ["python", "-m", "app.main"]
\ No newline at end of file
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 0000000..981c3ce
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,146 @@
+// Jenkinsfile —— jp-rakuten（乐天 / ラクマ 抓取服务）
+//
+// 默认 registry: git.jerryyan.net/jp/rakuten-api
+// 构建参数说明见各 stage 顶部；首次使用前请在 Jenkins 里配置凭据：
+//   - git-credentials : 拉代码的 SSH / HTTPS 凭据
+//   - gitea-registry  : docker login git.jerryyan.net 的凭据（username/password）
+
+pipeline {
+    agent any
+
+    options {
+        timestamps()
+        timeout(time: 30, unit: 'MINUTES')
+        disableConcurrentBuilds()
+        buildDiscarder(logRotator(numToKeepStr: '20', daysToKeepStr: '14'))
+    }
+
+    parameters {
+        string(name: 'IMAGE_NAME',
+               defaultValue: 'git.jerryyan.net/jp/rakuten-api',
+               description: '镜像完整名（含 registry host）')
+        string(name: 'IMAGE_TAG',
+               defaultValue: '',
+               description: '自定义 tag；留空则用 <BUILD_NUMBER>-<git short sha>')
+        booleanParam(name: 'SKIP_TEST',
+                     defaultValue: false,
+                     description: '跳过单测（紧急发版用，正常构建不要勾）')
+        booleanParam(name: 'PUSH_LATEST',
+                     defaultValue: true,
+                     description: '同时打 :latest 并推送')
+    }
+
+    environment {
+        // 让 docker build 看到 BuildKit 缓存挂载等特性
+        DOCKER_BUILDKIT = '1'
+        // 禁掉 pip 警告、Jenkins 写 .pyc
+        PYTHONUNBUFFERED = '1'
+        PYTHONDONTWRITEBYTECODE = '1'
+        // 国内镜像：uv / pip 拉包走阿里云 PyPI 镜像，避免拉取缓慢
+        UV_INDEX_URL = 'https://mirrors.aliyun.com/pypi/simple/'
+    }
+
+    stages {
+
+        stage('Checkout') {
+            steps {
+                checkout scm
+                script {
+                    env.GIT_SHA = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
+                    env.GIT_TAG = sh(script: 'git describe --tags --always --dirty 2>/dev/null || echo ""', returnStdout: true).trim()
+                    if (!params.IMAGE_TAG?.trim()) {
+                        env.IMAGE_TAG = "${env.BUILD_NUMBER}-${env.GIT_SHA}"
+                    }
+                    echo "镜像目标: ${env.IMAGE_NAME}:${env.IMAGE_TAG}（git=${env.GIT_SHA}）"
+                }
+            }
+        }
+
+        stage('Test') {
+            // 跳过逻辑：SKIP_TEST=true 时整个 stage 不跑
+            when {
+                expression { return !params.SKIP_TEST }
+            }
+            // 在官方 Python 镜像里跑测试，避免污染宿主机；只装 dev extra，不装 browser
+            agent {
+                docker {
+                    image 'registry.jerryyan.top/library/python:3.13-slim'
+                    reuseNode true
+                }
+            }
+            steps {
+                sh '''
+                    set -e
+                    # 阿里云 PyPI 镜像，UV_INDEX_URL 由 pipeline environment 注入
+                    python -m pip install --quiet --upgrade pip -i "$UV_INDEX_URL"
+                    pip install --quiet uv -i "$UV_INDEX_URL"
+                    uv sync --frozen --extra dev
+                    .venv/bin/python -m pytest -q
+                '''
+            }
+        }
+
+        stage('Build image') {
+            steps {
+                script {
+                    // 同时打两个 tag：精确 tag + 可选 latest
+                    def tags = ["-t ${env.IMAGE_NAME}:${env.IMAGE_TAG}"]
+                    if (params.PUSH_LATEST) {
+                        tags << "-t ${env.IMAGE_NAME}:latest"
+                    }
+                    sh """
+                        docker build ${tags.join(' ')} \
+                            --label org.opencontainers.image.revision=${env.GIT_SHA} \
+                            --label org.opencontainers.image.version=${env.IMAGE_TAG} \
+                            -f Dockerfile .
+                    """
+                }
+            }
+        }
+
+        stage('Push image') {
+            // 只在 master / 手动构建时推送；PR 构建只产镜像不推
+            when {
+                anyOf {
+                    branch 'master'
+                    branch 'main'
+                    buildingTag()
+                    expression { return !params.IMAGE_TAG?.trim().isEmpty() && params.IMAGE_TAG != "${env.BUILD_NUMBER}-${env.GIT_SHA}" }
+                }
+            }
+            steps {
+                withCredentials([usernamePassword(
+                    credentialsId: 'gitea-registry',
+                    usernameVariable: 'REGISTRY_USER',
+                    passwordVariable: 'REGISTRY_PASS',
+                )]) {
+                    sh """
+                        echo "\$REGISTRY_PASS" | docker login git.jerryyan.net -u "\$REGISTRY_USER" --password-stdin
+                        docker push ${env.IMAGE_NAME}:${env.IMAGE_TAG}
+                    """
+                    script {
+                        if (params.PUSH_LATEST) {
+                            sh "docker push ${env.IMAGE_NAME}:latest"
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    post {
+        always {
+            // 清理本次构建产生的镜像，避免 Jenkins agent 磁盘膨胀
+            sh """
+                docker rmi -f ${env.IMAGE_NAME}:${env.IMAGE_TAG} 2>/dev/null || true
+                docker rmi -f ${env.IMAGE_NAME}:latest 2>/dev/null || true
+            """
+        }
+        success {
+            echo "构建成功：${env.IMAGE_NAME}:${env.IMAGE_TAG}"
+        }
+        failure {
+            echo "构建失败，请查看上方日志"
+        }
+    }
+}
\ No newline at end of file