deploy/Dockerfile at main

mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00

Files

T

zooqueenandHanzo Dev 649cac9021 mirror: run in a repository, and ship as a subcommand of the one binary

Reconcile could never have worked. RealGit set no working directory, so every
command ran wherever the process started — for a scheduled job, nowhere — and git
answers "fatal: not a git repository" to the fetch. That error arrives on the
branch that reports GITHUB as unreadable, so a reconciler with perfect
credentials and a perfect table would have called all 24 repos unreachable and
asked a person to look at each one. The dry run passed throughout, because a dry
run resolves names and never touches git.

Git therefore takes the directory as a parameter, and Workspace prepares one
store per repo under a root that MAY survive between runs. May, not must: git's
fetch negotiation offers whatever is already present, so a kept root makes later
runs deltas, and an empty one is equally correct and merely slower. That is what
lets the job use an emptyDir instead of a claim — a ReadWriteOnce volume would
buy the same time at the price of a job pod deadlocking on Multi-Attach whenever
it schedules away from the node holding it.

Both sides are now fetched, not just GitHub. The forge goes first for two
reasons: its tip has to be local before a genuine divergence can be NAMED rather
than reported as "ancestry undetermined", and once its history is present those
objects are offered in negotiation, so the internet side of every run is a delta
even on an empty store. That is the whole reason ten-minute scheduling is
affordable over two dozen repositories.

The proof is a real one. TestFastForwardMovesARealRepository builds two bare
repositories, leaves the forge a commit behind, and requires it to end on
GitHub's tip — then rewinds GitHub so the two genuinely disagree and requires the
forge NOT to move. Every other test in this file uses a fake that agrees with the
code about what git is, which is exactly why none of them caught this. Verified
by mutation: drop `cmd.Dir` and it fails.

Shipping is one binary, not two. cmd/hanzo-mirror becomes cmd/cd-mirror,
dispatched by argv[0] like every other cd command, so the reconciler travels in
the image the control plane already builds, pins and deploys — no second artifact
to version, and no second chance for the two to disagree about which repos exist.
The table travels with it at common.DefaultMirrorTable rather than living in a
ConfigMap, so the JSON that CI validates is the JSON the scheduled run reads.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-04 16:53:25 -07:00

174 lines

7.0 KiB

Docker

Raw Permalink Blame History

 ARG BASE_IMAGE=docker.io/library/ubuntu:26.04@sha256:f3d28607ddd78734bb7f71f117f3c6706c666b8b76cbff7c9ff6e5718d46ff64
 ####################################################################################################
 # Builder image
 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image
 # Also used as the image in CI jobs so needs all dependencies
 ####################################################################################################
 FROM docker.io/library/golang:1.26.5@sha256:63f132d58c1f589f0dcda584933a9bb44bfda1150f1506377f5a902f34d86033 AS builder
 WORKDIR /tmp
 # renovate: datasource=deb depName=git registryUrl=https://deb.debian.org/debian?suite=trixie&components=main,security&binaryArch=amd64
 ARG GIT_APT_VERSION=1:2.47.3-0+deb13u1
 RUN apt-get update && apt-get install --no-install-recommends -y \
     openssh-server \
     nginx \
     unzip \
     fcgiwrap \
     git=${GIT_APT_VERSION} \
     make \
     wget \
     gcc \
     sudo \
     zip && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY hack/install.sh hack/tool-versions.sh ./
 COPY hack/installers installers
 RUN ./install.sh helm && \
     INSTALL_PATH=/usr/local/bin ./install.sh kustomize && \
     ./install.sh git-lfs
 ####################################################################################################
 # Argo CD Base - used as the base for both the release and dev argocd images
 ####################################################################################################
 FROM $BASE_IMAGE AS argocd-base
 LABEL org.opencontainers.image.source="https://github.com/hanzoai/cd"
 USER root
 ENV CD_USER_ID=999 \
     DEBIAN_FRONTEND=noninteractive
 # renovate: datasource=deb depName=git registryUrl=https://archive.ubuntu.com/ubuntu?suite=resolute&components=main,security&binaryArch=amd64
 ARG GIT_APT_VERSION=1:2.53.0-1ubuntu1
 RUN groupadd -g $CD_USER_ID argocd && \
     useradd -r -u $CD_USER_ID -g argocd argocd && \
     mkdir -p /home/argocd && \
     chown argocd:0 /home/argocd && \
     chmod g=u /home/argocd && \
     apt-get update && \
     apt-get dist-upgrade -y && \
     apt-get install --no-install-recommends -y \
     git=${GIT_APT_VERSION} tini ca-certificates gpg gpg-agent tzdata connect-proxy openssh-client && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
 COPY hack/gpg-wrapper.sh \
     hack/git-verify-wrapper.sh \
     entrypoint.sh \
     /usr/local/bin/
 COPY --from=builder /usr/local/bin/helm /usr/local/bin/helm
 COPY --from=builder /usr/local/bin/kustomize /usr/local/bin/kustomize
 COPY --from=builder /usr/local/bin/git-lfs /usr/local/bin/git-lfs
 # Initialize git-lfs system configuration (/etc/gitconfig) so LFS filters are active
 RUN git lfs install --system
 # keep uid_entrypoint.sh for backward compatibility
 RUN ln -s /usr/local/bin/entrypoint.sh /usr/local/bin/uid_entrypoint.sh
 # support for mounting configuration from a configmap
 WORKDIR /app/config/ssh
 RUN touch ssh_known_hosts && \
     ln -s /app/config/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts
 WORKDIR /app/config
 RUN mkdir -p tls && \
     mkdir -p gpg/source && \
     mkdir -p gpg/keys && \
     chown argocd gpg/keys && \
     chmod 0700 gpg/keys
 ENV USER=argocd
 # Disable gRPC service config lookups via DNS TXT records to prevent excessive
 # DNS queries for _grpc_config.<hostname> which can cause timeouts in dual-stack
 # environments. This can be overridden via argocd-cmd-params-cm ConfigMap.
 # See https://github.com/argoproj/argo-cd/issues/24991
 ENV GRPC_ENABLE_TXT_SERVICE_CONFIG=false
 USER $CD_USER_ID
 WORKDIR /home/argocd
 ####################################################################################################
 # Argo CD UI stage
 ####################################################################################################
 FROM --platform=$BUILDPLATFORM docker.io/library/node:24.17.0@sha256:032e78d7e54e352129831743737e3a83171d9cc5b5896f411649c597ce0b11ea AS argocd-ui
 WORKDIR /src
 COPY ["ui/package.json", "ui/pnpm-lock.yaml", "./"]
 RUN npm install -g [email protected] && corepack enable && pnpm install --frozen-lockfile
 COPY ["ui/", "."]
 ARG ARGO_VERSION=latest
 ENV ARGO_VERSION=$ARGO_VERSION
 # Note: the UI bundle is architecture-independent. Keep this stage free of any
 # per-target-arch inputs (e.g. TARGETARCH) so buildx builds it once and copies an
 # identical dist into every per-arch image. Otherwise the bundle's contenthash
 # diverges across archs and mixed-arch clusters serve mismatched asset filenames.
 RUN NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OPTIONS=--max_old_space_size=8192 pnpm build
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
 ####################################################################################################
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.5@sha256:63f132d58c1f589f0dcda584933a9bb44bfda1150f1506377f5a902f34d86033 AS argocd-build
 WORKDIR /go/src/github.com/argoproj/argo-cd
 COPY go.* ./
 RUN mkdir -p gitops-engine
 COPY gitops-engine/go.* ./gitops-engine
 RUN go mod download
 # Perform the build
 COPY . .
 COPY --from=argocd-ui /src/dist/app /go/src/github.com/argoproj/argo-cd/ui/dist/app
 ARG TARGETOS \
     TARGETARCH
 # These build args are optional; if not specified the defaults will be taken from the Makefile
 ARG GIT_TAG \
     BUILD_DATE \
     GIT_TREE_STATE \
     GIT_COMMIT
 RUN GIT_COMMIT=$GIT_COMMIT \
     GIT_TREE_STATE=$GIT_TREE_STATE \
     GIT_TAG=$GIT_TAG \
     BUILD_DATE=$BUILD_DATE \
     GOOS=$TARGETOS \
     GOARCH=$TARGETARCH \
     make argocd-all
 ####################################################################################################
 # Final image
 ####################################################################################################
 FROM argocd-base
 ENTRYPOINT ["/usr/bin/tini", "--"]
 COPY --from=argocd-build /go/src/github.com/argoproj/argo-cd/dist/hanzocd* /usr/local/bin/
 USER root
 RUN ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-server && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-repo-server && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-cmp-server && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-application-controller && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-dex && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-applicationset-controller && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-k8s-auth && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-commit-server && \
     ln -s /usr/local/bin/hanzocd /usr/local/bin/hanzocd-mirror
 # The repository table travels with the binary that reads it. One home for "which
 # repos sync which way", validated by the same code in CI that consumes it at run
 # time — as opposed to a ConfigMap, which is a second copy that can disagree with
 # the checks. common.DefaultMirrorTable names this path.
 COPY --from=argocd-build /go/src/github.com/argoproj/argo-cd/mirror/repos.json /usr/local/share/cd/repos.json
 USER $CD_USER_ID

174 lines 7.0 KiB Docker Raw Permalink Blame History

174 lines

7.0 KiB

Docker

Raw Permalink Blame History