mirror of
https://github.com/luxfi/dex.git
synced 2026-09-24 00:26:31 +00:00
zeekay
efd4c4c976
The dex Docker builds set GOPRIVATE over our orgs, which routes those module fetches `direct` (git) and bypasses sum.golang.org. After luxfi tags were force-republished (e.g. luxfi/[email protected], luxfi/[email protected]) the git tag content diverged from the immutable proxy/sumdb hash, so a `direct` fetch pulled bits that no longer matched the canonical go.sum — failing image builds with a checksum mismatch (or poisoning go.sum to the moved bits). Resolving through the default public proxy + sumdb yields the canonical immutable hash that matches go.sum and that a re-publish can no longer break — the same model already adopted by lux/kms. Supersedes f6b7ab9 ("GOPRIVATE must cover hanzos3 + all our orgs"): that was a correct interim fix when github.com/hanzoai/vfs and github.com/hanzos3/go-sdk were still private and unreachable through the public proxy. Both are now public and sumdb-verifiable, so GOPRIVATE is no longer needed. Verified by a clean (empty-GOMODCACHE) `go mod download all` with GOPRIVATE empty: every module — including hanzos3/[email protected] and hanzoai/[email protected] (pulled transitively via luxfi/database/zapdb) — fetches and verifies from proxy.golang.org + sum.golang.org. dex pulls no zooai/parsdao/lux-private modules. - Dockerfile, deploy/testnet/Dockerfile: drop `ENV GOPRIVATE=...`. The gh_token BuildKit secret stays only for the cold `direct` fetch fallback. - go.sum: realign luxfi/[email protected] and luxfi/[email protected] h1: hashes to the canonical public sumdb values (`go mod tidy`; `go mod verify` = all modules verified). go.mod unchanged.
58 lines
2.7 KiB
Docker
58 lines
2.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# ---------------------------------------------------------------------------
|
|
# dexd — the ONE D-Chain DEX image (CPU, linux/amd64) — ghcr.io/luxfi/dex
|
|
#
|
|
# Builds the single `dexd` binary and runs it as the standalone D-Chain venue:
|
|
# it opens the persisted zapdb, serves the frozen clob_* surface over ZAP, and
|
|
# runs the consensus sealer loop itself (WaitForEvent->BuildBlock->Verify->Accept)
|
|
# so every write returns consensus-computed fills. CGO_ENABLED=0 selects pkg/lx's
|
|
# pure-Go CPU matcher (the !cgo build tag) — no CUDA, no MLX, runs on any amd64.
|
|
#
|
|
# Same binary, other modes (override the default CMD):
|
|
# docker run … plugin run as a luxd rpcchainvm plugin (luxd execs it)
|
|
# docker run … version print the plugin version line
|
|
# ---------------------------------------------------------------------------
|
|
ARG GO_VERSION=1.26.4
|
|
FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
git ca-certificates && rm -rf /var/lib/apt/lists/*
|
|
|
|
# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
|
|
# dex's deps (luxfi/*, hanzoai/*, hanzos3/go-sdk) are all PUBLIC now; the immutable
|
|
# proxy+sumdb hash a force-moved tag can't break. The gh_token BuildKit secret
|
|
# below stays only for a cold `direct` fetch fallback.
|
|
ENV GOFLAGS=-mod=mod
|
|
ENV GOTOOLCHAIN=auto
|
|
ENV GOEXPERIMENT=jsonv2
|
|
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=secret,id=gh_token,required=false \
|
|
if [ -s /run/secrets/gh_token ]; then \
|
|
git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
|
|
fi && \
|
|
go mod download
|
|
COPY . .
|
|
|
|
# CPU build: CGO_ENABLED=0 → !cgo build tag → pure-Go CPU matcher in pkg/lx.
|
|
RUN --mount=type=secret,id=gh_token,required=false \
|
|
if [ -s /run/secrets/gh_token ]; then \
|
|
git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
|
|
fi && \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -trimpath -ldflags="-s -w" -o /out/dexd ./cmd/dexd
|
|
|
|
FROM debian:12-slim AS execution
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates && rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -g 1000 dexd && useradd -u 1000 -g dexd -m -s /usr/sbin/nologin dexd \
|
|
&& mkdir -p /data && chown -R dexd:dexd /data
|
|
COPY --from=builder /out/dexd /usr/local/bin/dexd
|
|
USER dexd
|
|
EXPOSE 9099
|
|
# Default: standalone venue. Override CMD with `plugin` / `version` for the
|
|
# other run modes.
|
|
ENTRYPOINT ["/usr/local/bin/dexd"]
|
|
CMD ["run", "-addr", "0.0.0.0:9099", "-db", "/data/db"]
|