mirror of
https://github.com/luxfi/explorer.git
synced 2026-09-24 00:25:12 +00:00
zeekay
066a8060c6
The v1.3.1 image build reached the runner (lux-build works) but failed two
ways that the local build now proves fixed:
1. Dockerfile cloned private luxfi/{indexer,graph} over unauthenticated
https -> 'could not read Username'. Those clones were vestigial: explorer
has no replace directive, so under -mod=mod graph v1.2.3 + indexer v1.4.5
resolve from the module cache, not siblings. Drop the clones; add the
node-style BuildKit-secret git auth (ghtok) + GOPRIVATE/GONOSUMDB/GONOPROXY
before go mod download so private modules resolve.
2. GHCR push would be denied (repo-scoped GITHUB_TOKEN). Log in with the
cross-org PAT (GH_TOKEN/UNIVERSE_PAT) and stamp
org.opencontainers.image.source so the package stays linked.
Verified locally: docker buildx build --secret id=ghtok,... compiles the
unified FE+indexer+graph binary green (go mod download 74s, go build 98s,
image exported).
57 lines
2.2 KiB
Docker
57 lines
2.2 KiB
Docker
# Lux Explorer data-layer image (v1.3.0+).
|
|
#
|
|
# As of v1.3.0 the Go binary is API-only — it serves /v1/* (indexer +
|
|
# blockscout-compat REST), /health, /envs.js, and per-host brand SVGs.
|
|
# Every other path returns 404 and the IngressRoute routes it to the
|
|
# per-brand Blockscout FE Deployment (ghcr.io/{brand-org}/explore-{env}).
|
|
# Built from luxfi/explore via Dockerfile.branded — see ~/work/lux/explore.
|
|
|
|
ARG GO_VERSION=1.26
|
|
|
|
# ---- Stage 1: build the unified FE + indexer + graph binary ----
|
|
# graph + indexer are consumed as Go modules pinned in go.mod (luxfi/graph
|
|
# v1.2.3, luxfi/indexer v1.4.5), NOT cloned as siblings — explorer has no
|
|
# replace directive, so under -mod=mod the module cache is authoritative.
|
|
FROM golang:${GO_VERSION}-alpine AS builder
|
|
ARG VERSION=dev
|
|
RUN apk add --no-cache gcc musl-dev sqlite-dev git
|
|
|
|
# luxfi/* modules are private and may be re-tagged; resolve them direct
|
|
# (not via proxy/sumdb) and skip checksum-db cross-checks, exactly as the
|
|
# node image does. The default GITHUB_TOKEN is repo-scoped; a cross-org PAT
|
|
# is injected as the BuildKit secret `ghtok` by docker.yml.
|
|
ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
|
|
ENV GONOSUMCHECK=github.com/luxfi/*
|
|
ENV GONOSUMDB=github.com/luxfi/*
|
|
ENV GONOPROXY=github.com/luxfi/*
|
|
ENV GOFLAGS=-mod=mod
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
# Configure git auth once so both `go mod download` here and the implicit
|
|
# fetch during `go build` can reach private luxfi/* modules.
|
|
RUN --mount=type=secret,id=ghtok,required=false \
|
|
if [ -s /run/secrets/ghtok ]; then \
|
|
git config --global url."https://x-access-token:$(cat /run/secrets/ghtok)@github.com/".insteadOf "https://github.com/"; \
|
|
fi && \
|
|
go mod download
|
|
|
|
COPY . .
|
|
RUN CGO_ENABLED=1 CGO_CFLAGS="-D_LARGEFILE64_SOURCE" \
|
|
go build -trimpath \
|
|
-ldflags="-s -w -X main.version=${VERSION}" \
|
|
-o /out/explorer .
|
|
|
|
# ---- Stage 2: runtime ----
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates sqlite-libs wget
|
|
COPY --from=builder /out/explorer /usr/local/bin/explorer
|
|
RUN adduser -D -u 65532 explorer
|
|
USER explorer
|
|
VOLUME /data
|
|
ENV DATA_DIR=/data HTTP_ADDR=:8090
|
|
EXPOSE 8090
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
|
|
CMD wget -qO- http://localhost:8090/health || exit 1
|
|
ENTRYPOINT ["explorer"]
|