You've already forked agentic-coding-workflow
53 lines
2.3 KiB
Docker
53 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ─── Stage 1: web build ───
|
|
FROM registry.jerryyan.top/library/node:22-alpine AS web
|
|
WORKDIR /web
|
|
RUN npm config set registry https://registry.npmmirror.com
|
|
COPY web/package.json web/pnpm-lock.yaml* ./
|
|
RUN corepack enable && (pnpm install --frozen-lockfile || pnpm install)
|
|
COPY web .
|
|
RUN pnpm build
|
|
|
|
# ─── Stage 2: go build ───
|
|
FROM registry.jerryyan.top/library/golang:1.25-alpine AS go
|
|
WORKDIR /src
|
|
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
|
|
&& apk add --no-cache git
|
|
ENV GOPROXY=https://goproxy.cn,direct
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
COPY --from=web /web/dist/. ./cmd/server/web/dist/
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/server ./cmd/server
|
|
|
|
# ─── Stage 3: runtime ───
|
|
FROM registry.jerryyan.top/library/alpine:3.24
|
|
# nodejs/npm 供安装 ACP agent CLI（claude-code-acp / codex / gemini-cli 等，
|
|
# 均为 npm 包）。npm 全局 prefix 指到 /data/npm-global（持久卷），容器内
|
|
# `npm i -g xxx` 一次安装，重建镜像后无需重装；binary_path 填
|
|
# /data/npm-global/bin/<cli> 即可。
|
|
# bubblewrap + util-linux(prlimit/setpriv) 供 acp.sandbox mode=uid/container 使用：
|
|
# - prlimit 给 agent 子进程套 RLIMIT_AS/NPROC/CPU/FSIZE（sandbox_uid_linux.go）
|
|
# - bubblewrap 作 rootless 隔离（USER app 无 CAP_SYS_ADMIN，bwrap 走 user namespace）
|
|
# mode=none（默认）时这些工具不被调用，安装它们对默认部署无副作用。
|
|
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
|
|
&& apk add --no-cache ca-certificates tzdata git openssh-client nodejs npm \
|
|
bubblewrap util-linux && \
|
|
addgroup -S app && adduser -S app -G app && \
|
|
addgroup -S sandbox && \
|
|
for i in 0 1 2 3 4 5 6 7 8 9; do adduser -S -D -H -G sandbox "sbx$i" 2>/dev/null || true; done
|
|
WORKDIR /app
|
|
COPY --from=go /out/server /app/server
|
|
COPY migrations /app/migrations
|
|
RUN mkdir -p /data/uploads /data/npm-global && chown -R app:app /data
|
|
ENV APP_DATA_DIR=/data \
|
|
APP_WORKSPACE_DATA_DIR=/data \
|
|
APP_STORAGE_LOCALFS_BASE_PATH=/data/uploads \
|
|
NPM_CONFIG_PREFIX=/data/npm-global \
|
|
NPM_CONFIG_REGISTRY=https://registry.npmmirror.com \
|
|
PATH=/data/npm-global/bin:$PATH
|
|
USER app
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/app/server"]
|