mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekay
ff59fc4680
Gateway main accumulated breakage while org-wide CI was down (no image
built in a while), so none of it was caught:
- luxfi/metric migration (b85a050) was mechanical s/prometheus/metric/ but
left prometheus's two-step create-then-Register pattern. luxfi/metric's
NewCounter create-and-registers on DefaultRegistry, so the explicit
metric.Register(c) pass (undefined symbol) is dead — removed it.
- zip API drift: Ctx.SendString(code,s) was renamed Ctx.String(code,s).
- Drop local-path replaces (=> ../cloud, ../zip): they break the CI Docker
build (no siblings in context). Pin hermetic versions instead — cloud at
origin/main pseudo-version (has HIP-0106 Mount), zip v0.2.1 (has String) —
and tidy go.mod so `go mod vendor` stops failing the consistency check.
- Dockerfile: fetch private hanzoai/* + luxfi/* modules via an authenticated
git insteadOf (gh_token BuildKit secret) + GOPRIVATE; bump builder to
golang:1.26.4 to satisfy the go directive under GOTOOLCHAIN=local.
Cross-compiles clean for linux/amd64 (gateway + ingress). Carries PR #24's
balance-path fix so the prepaid usage gate enforces.
66 lines
2.3 KiB
Docker
66 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1
|
||
ARG GOLANG_VERSION=1.26.4
|
||
ARG ALPINE_VERSION=3.23
|
||
|
||
# Stage 1: Build the gateway binary from source
|
||
# Use BUILDPLATFORM so Go cross-compiles natively (no QEMU for compiler)
|
||
FROM golang:${GOLANG_VERSION}-alpine${ALPINE_VERSION} AS builder
|
||
|
||
ARG TARGETOS TARGETARCH
|
||
|
||
RUN apk --no-cache --virtual .build-deps add make gcc musl-dev binutils-gold git wget
|
||
|
||
COPY . /app
|
||
WORKDIR /app
|
||
|
||
# Per SCALE_STANDARD.md §2 — every Go production Dockerfile at the
|
||
# gateway edge or in any JSON-emitting subsystem builds with
|
||
# GOEXPERIMENT=jsonv2. Verified −12% time / −23% allocs on the edge
|
||
# POST roundtrip vs encoding/json v1 (json_bench_test.go in zip).
|
||
ARG GO_EXPERIMENT=jsonv2
|
||
ENV GOEXPERIMENT=${GO_EXPERIMENT}
|
||
|
||
# Private cross-repo modules (hanzoai/cloud, hanzoai/zip, luxfi/*) are fetched
|
||
# directly via authenticated git, bypassing the public proxy + checksum DB.
|
||
ENV GOPRIVATE=github.com/hanzoai/*,github.com/luxfi/*
|
||
|
||
RUN --mount=type=cache,target=/go/pkg/mod \
|
||
--mount=type=cache,target=/root/.cache/go-build \
|
||
--mount=type=secret,id=gh_token \
|
||
if [ -s /run/secrets/gh_token ]; then \
|
||
git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
|
||
fi && \
|
||
GOEXPERIMENT=jsonv2 GOOS=${TARGETOS} GOARCH=${TARGETARCH} make build && \
|
||
GOEXPERIMENT=jsonv2 GOOS=${TARGETOS} GOARCH=${TARGETARCH} make build-ingress
|
||
|
||
# Stage 2: Runtime image
|
||
FROM alpine:${ALPINE_VERSION}
|
||
|
||
LABEL maintainer="[email protected]"
|
||
|
||
RUN apk upgrade --no-cache --no-interactive && \
|
||
apk add --no-cache ca-certificates tzdata && \
|
||
adduser -u 1000 -S -D -H gateway && \
|
||
mkdir /etc/gateway /etc/ingress && \
|
||
echo '{ "version": 3 }' > /etc/gateway/gateway.json
|
||
|
||
COPY --from=builder /app/gateway /usr/bin/gateway
|
||
COPY --from=builder /app/ingress /usr/bin/ingress
|
||
|
||
# Bake in configs for the target cluster
|
||
ARG CONFIG=hanzo
|
||
COPY configs/${CONFIG}/gateway.json /etc/gateway/gateway.json
|
||
COPY configs/${CONFIG}/ingress.json /etc/ingress/ingress.json
|
||
|
||
USER 1000
|
||
|
||
WORKDIR /etc/gateway
|
||
|
||
ENTRYPOINT [ "/usr/bin/gateway" ]
|
||
CMD [ "run", "-c", "/etc/gateway/gateway.json" ]
|
||
|
||
EXPOSE 8080 8090
|
||
|
||
HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=3 \
|
||
CMD wget -qO- http://localhost:8080/healthz || exit 1
|