mirror of
https://github.com/hanzoai/agent.git
synced 2026-09-11 21:08:51 +00:00
zeekay
6430482a64
deployments/docker/Dockerfile.demo-go-agent: switch runtime from gcr.io/distroless/static-debian12:nonroot to FROM scratch. CA certs, tzdata, /etc/passwd and /etc/group (nonroot uid/gid 65532) come from the builder. deployments/docker/Dockerfile.control-plane: switch runtime from gcr.io/distroless/base-debian12 (glibc + sqlite_fts5 CGO needs libc) to ghcr.io/hanzoai/debian12:base. TODO flagged for ghcr-auth in CI.
51 lines
1.9 KiB
Docker
51 lines
1.9 KiB
Docker
FROM --platform=$BUILDPLATFORM node:20-alpine AS ui-builder
|
|
WORKDIR /app/web
|
|
|
|
COPY control-plane/web/client/package*.json ./
|
|
RUN npm ci
|
|
COPY control-plane/web/client/ .
|
|
RUN npm run build
|
|
|
|
FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS go-builder
|
|
WORKDIR /app
|
|
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
ENV CGO_ENABLED=1
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
pkg-config \
|
|
gcc-aarch64-linux-gnu \
|
|
libc6-dev-arm64-cross \
|
|
gcc-x86-64-linux-gnu \
|
|
libc6-dev-amd64-cross \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY control-plane/go.mod control-plane/go.sum ./control-plane/
|
|
RUN cd control-plane && go mod download
|
|
|
|
COPY control-plane/ ./control-plane/
|
|
COPY --from=ui-builder /app/web/dist ./control-plane/web/client/dist
|
|
|
|
RUN cd control-plane && \
|
|
if [ "${TARGETARCH}" = "arm64" ]; then export CC=aarch64-linux-gnu-gcc; \
|
|
elif [ "${TARGETARCH}" = "amd64" ] && [ "$(uname -m)" != "x86_64" ]; then export CC=x86_64-linux-gnu-gcc; \
|
|
else export CC=gcc; fi && \
|
|
GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags "embedded sqlite_fts5" -o /app/bin/hanzo-agents-server ./cmd/hanzo-agents-server
|
|
|
|
# Pre-create writable data directory for distroless runtime. The nonroot user
|
|
# has UID/GID 65532 in the base image, so match that here.
|
|
RUN mkdir -p /tmp/hanzo-agents-data && chown 65532:65532 /tmp/hanzo-agents-data
|
|
|
|
FROM ghcr.io/hanzoai/debian12:base
|
|
COPY --from=go-builder /app/bin/hanzo-agents-server /usr/local/bin/hanzo-agents-server
|
|
COPY --from=go-builder /app/control-plane/config /etc/hanzo-agents/config
|
|
COPY --from=go-builder --chown=nonroot:nonroot /tmp/hanzo-agents-data /data
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["/usr/local/bin/hanzo-agents-server"]
|
|
|
|
# TODO(ghcr-auth): CI workflows building this image must `docker login`
|
|
# to ghcr.io/hanzoai with a PAT (secret: GHCR_PULL_TOKEN) — the default
|
|
# GITHUB_TOKEN scopes to the repo's own package only.
|