insights/Dockerfile.recording-rasterizer at main

mirror of https://github.com/hanzoai/insights.git synced 2026-10-30 16:15:31 +00:00

Files

T

zeekay 1b367e2b62 chore: rebase the tree onto upstream master

The tree was a debranded snapshot of upstream taken around 2026-02-20, and
upstream has moved about five months since. This replaces it with upstream
master, mechanically re-derived: bin/debrand does the rename, and the
pipeline and squashed migrations are restored from the shipped tree.

Not a merge. The previous import replaced the tree wholesale in a single
commit, so there is no shared content history to merge against. Reproducing
the rename on the new tree is what actually converges.

What survives: .hanzo/workflows, the Dockerfiles and bin/docker* entrypoints,
compose files, LLM.md, and insights/migrations. The squashed initial
migration is load-bearing — the live database records it by name, so
upstream's ~918 individual migrations cannot come back.

Nine products are dropped as unreferenced. Twenty-one more that we do not run
are kept anyway because the core app still imports them; unpicking those is a
refactor and does not belong in a rebase.

This base does not build yet, and the reasons are not in the rename:
upstream now wants Python 3.13.13 against our 3.12.12 and Django 5.2 against
our 4.2, and the dependency manifests still name upstream packages that we
republish under our own names. Those are decisions, not renames.

2026-08-01 15:44:40 -07:00

182 lines

8.7 KiB

Docker

Raw Permalink Blame History

 #
 # Dockerfile.recording-rasterizer - Session Replay Recording Rasterizer Worker
 #
 # Temporal worker that records session replays to video using Puppeteer + Chromium.
 # Based on Dockerfile.node with added Chromium and ffmpeg for video recording.
 #
 #
 # Build stage: Compile nodejs and dependencies
 #
 FROM ghcr.io/insights/rust-node-container:bookworm_rust_1.91-node_24.13.0 AS nodejs-build
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "wget" \
     "gnupg" \
     && \
     mkdir -p /etc/apt/keyrings && \
     wget -qO - https://packages.confluent.io/clients/deb/archive.key | gpg --dearmor -o /etc/apt/keyrings/confluent-clients.gpg && \
     echo "deb [signed-by=/etc/apt/keyrings/confluent-clients.gpg] https://packages.confluent.io/clients/deb/ bookworm main" > /etc/apt/sources.list.d/confluent-clients.list && \
     apt-get update && \
     apt-get install -y --no-install-recommends --allow-downgrades \
     "make" \
     "g++" \
     "gcc" \
     "python3" \
     "librdkafka1=2.12.0-1.cflt~deb12" \
     "librdkafka++1=2.12.0-1.cflt~deb12" \
     "librdkafka-dev=2.12.0-1.cflt~deb12" \
     # libssl pinned to the 3.0 series (ABI-stable), not an exact version: Debian rotates
     # point releases out of the security archive, which breaks exact pins on uncached builds.
     "libssl-dev=3.0.*" \
     "libssl3=3.0.*" \
     "zlib1g-dev" \
     && \
     rm -rf /var/lib/apt/lists/*
 WORKDIR /code
 COPY turbo.json package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json ./
 COPY ./bin/turbo ./bin/turbo
 COPY ./patches ./patches
 COPY ./rust ./rust
 COPY ./common/esbuilder/ ./common/esbuilder/
 COPY ./common/plugin_transpiler/ ./common/plugin_transpiler/
 COPY ./common/scriptvm/typescript/ ./common/scriptvm/typescript/
 COPY ./nodejs/package.json ./nodejs/tsconfig.json ./nodejs/
 COPY ./common/replay-shared/package.json ./common/replay-shared/
 COPY ./common/replay-headless/package.json ./common/replay-headless/
 SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
 ENV BUILD_LIBRDKAFKA=0 \
     PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
 RUN --mount=type=cache,id=pnpm,target=/tmp/pnpm-store-v24 \
     corepack enable && \
     NODE_OPTIONS="--max-old-space-size=16384" CI=1 pnpm --filter=@hanzo/nodejs... install --frozen-lockfile --store-dir /tmp/pnpm-store-v24 && \
     NODE_OPTIONS="--max-old-space-size=16384" CI=1 pnpm --filter=@hanzo/replay-headless... install --frozen-lockfile --store-dir /tmp/pnpm-store-v24 && \
     NODE_OPTIONS="--max-old-space-size=16384" CI=1 pnpm --filter=@hanzo/plugin-transpiler... install --frozen-lockfile --store-dir /tmp/pnpm-store-v24 && \
     NODE_OPTIONS="--max-old-space-size=16384" bin/turbo --filter=@hanzo/plugin-transpiler build
 COPY ./nodejs/src/ ./nodejs/src/
 COPY ./nodejs/tests/ ./nodejs/tests/
 COPY ./nodejs/assets/ ./nodejs/assets/
 COPY ./nodejs/bin/ ./nodejs/bin/
 COPY ./common/replay-shared/src/ ./common/replay-shared/src/
 COPY ./common/replay-shared/tsconfig.json ./common/replay-shared/
 COPY ./common/replay-headless/src/ ./common/replay-headless/src/
 COPY ./common/replay-headless/build.mjs ./common/replay-headless/
 RUN NODE_OPTIONS="--max-old-space-size=16384" bin/turbo --filter=@hanzo/cyclotron build
 RUN NODE_OPTIONS="--max-old-space-size=16384" bin/turbo --filter=@hanzo/replay-headless build
 RUN NODE_OPTIONS="--max-old-space-size=16384" bin/turbo --filter=@hanzo/nodejs build
 #
 # Runtime stage: Node.js + chrome-headless-shell + ffmpeg
 #
 # Uses chrome-headless-shell instead of full Chromium. This binary supports
 # HeadlessExperimental.beginFrame for deterministic frame-by-frame capture
 # via puppeteer-capture (virtual time, no rAF dependency).
 #
 # Major-only tag so weekly rebuilds pick up the latest 24.x (node + bundled OpenSSL/V8 patches).
 # Must stay same major as the build stage (node 24) for native-addon ABI, and keep -bookworm-slim
 # so glibc / system libs match what the addons were linked against in the build stage.
 FROM node:24-bookworm-slim
 WORKDIR /code
 SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
 # Cache-bust marker for the floated deps below (ffmpeg, chrome-headless-shell). The weekly
 # scheduled rebuild passes a changing value, invalidating the apt/npx layers so security
 # updates are actually re-fetched; normal builds pass the constant default and reuse cache.
 # Without this, the unpinned layers' cache key never changes and the rebuild is a no-op.
 ARG DEPS_CACHE_BUST=pinned
 RUN echo "deps cache bust: ${DEPS_CACHE_BUST}"
 # Install runtime dependencies: librdkafka, chrome-headless-shell deps, ffmpeg
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "ca-certificates" \
     "wget" \
     "gnupg" \
     "unzip" \
     && \
     mkdir -p /etc/apt/keyrings && \
     wget -qO - https://packages.confluent.io/clients/deb/archive.key | gpg --dearmor -o /etc/apt/keyrings/confluent-clients.gpg && \
     echo "deb [signed-by=/etc/apt/keyrings/confluent-clients.gpg] https://packages.confluent.io/clients/deb/ bookworm main" > /etc/apt/sources.list.d/confluent-clients.list && \
     apt-get update && \
     apt-get install -y --no-install-recommends --allow-downgrades \
     "librdkafka1=2.12.0-1.cflt~deb12" \
     "librdkafka++1=2.12.0-1.cflt~deb12" \
     # libssl pinned to the 3.0 series (ABI-stable), not an exact version: Debian rotates
     # point releases out of the security archive, which breaks exact pins on uncached builds.
     "libssl3=3.0.*" \
     # ffmpeg intentionally unpinned: tracks the latest bookworm candidate so security point-updates flow in on rebuild
     "ffmpeg" \
     # Shared libraries required by chrome-headless-shell
     libasound2 \
     libatk-bridge2.0-0 \
     libatk1.0-0 \
     libcups2 \
     libdbus-1-3 \
     libdrm2 \
     libgbm1 \
     libglib2.0-0 \
     libnspr4 \
     libnss3 \
     libpango-1.0-0 \
     libx11-6 \
     libxcb1 \
     libxcomposite1 \
     libxdamage1 \
     libxext6 \
     libxfixes3 \
     libxkbcommon0 \
     libxrandr2 \
     && \
     rm -rf /var/lib/apt/lists/*
 # Install chrome-headless-shell via @puppeteer/browsers CLI.
 # This provides the minimal Chrome binary that supports HeadlessExperimental.
 # Tracks the stable channel so security patches flow in; the weekly scheduled rebuild
 # re-resolves it and the validation step below guards install-time breakage.
 RUN npx --yes @puppeteer/browsers install chrome-headless-shell@stable \
     --path /opt/chrome-headless-shell && \
     ln -s "$(find /opt/chrome-headless-shell -name chrome-headless-shell -type f | head -1)" /usr/local/bin/chrome-headless-shell
 RUN groupadd -g 10001 insights && \
     useradd -u 10001 -g insights -m -d /home/insights insights && \
     chown -R insights:insights /code
 USER insights
 ARG COMMIT_HASH
 RUN echo ${COMMIT_HASH:-unknown} > /code/commit.txt
 # Copy compiled nodejs from build stage
 COPY --from=nodejs-build --chown=insights:insights /code/rust/cyclotron-node/dist /code/rust/cyclotron-node/dist
 COPY --from=nodejs-build --chown=insights:insights /code/rust/cyclotron-node/package.json /code/rust/cyclotron-node/package.json
 COPY --from=nodejs-build --chown=insights:insights /code/rust/cyclotron-node/index.node /code/rust/cyclotron-node/index.node
 COPY --from=nodejs-build --chown=insights:insights /code/common/plugin_transpiler/dist /code/common/plugin_transpiler/dist
 COPY --from=nodejs-build --chown=insights:insights /code/common/plugin_transpiler/node_modules /code/common/plugin_transpiler/node_modules
 COPY --from=nodejs-build --chown=insights:insights /code/common/plugin_transpiler/package.json /code/common/plugin_transpiler/package.json
 COPY --from=nodejs-build --chown=insights:insights /code/common/scriptvm/typescript/dist /code/common/scriptvm/typescript/dist
 COPY --from=nodejs-build --chown=insights:insights /code/common/scriptvm/typescript/node_modules /code/common/scriptvm/typescript/node_modules
 COPY --from=nodejs-build --chown=insights:insights /code/common/scriptvm/typescript/package.json /code/common/scriptvm/typescript/package.json
 COPY --from=nodejs-build --chown=insights:insights /code/nodejs/dist /code/nodejs/dist
 COPY --from=nodejs-build --chown=insights:insights /code/node_modules /code/node_modules
 COPY --from=nodejs-build --chown=insights:insights /code/nodejs/node_modules /code/nodejs/node_modules
 COPY --from=nodejs-build --chown=insights:insights /code/nodejs/package.json /code/nodejs/package.json
 COPY --from=nodejs-build --chown=insights:insights /code/common/replay-headless/dist /code/common/replay-headless/dist
 COPY --from=nodejs-build --chown=insights:insights /code/common/replay-headless/package.json /code/common/replay-headless/package.json
 ENV NODE_ENV=production \
     BUILD_LIBRDKAFKA=0 \
     PUPPETEER_EXECUTABLE_PATH=/usr/local/bin/chrome-headless-shell \
     PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
 # Validate runtime dependencies
 RUN chrome-headless-shell --version && ffmpeg -version
 EXPOSE 6738
 CMD ["node", "nodejs/dist/session-replay/recording-rasterizer/index.js"]

182 lines 8.7 KiB Docker Raw Permalink Blame History

182 lines

8.7 KiB

Docker

Raw Permalink Blame History