jochen
f4fb0a7461
mesh/merge-gate pass: builds build-agent, gitea, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did witho…
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
mesh/delivery delivered
Every merge to the controller's repository rebuilt the route proxy and the build seat's holder, because their builds read that repository whole. Named, the build seat hands each only its program's build source and the planner moves each only when that changes. A rename was said under its new name alone, so a file moved out of a build source changed nothing the planner could see.
31 lines
1.7 KiB
Docker
31 lines
1.7 KiB
Docker
ARG ALPINE_BASE=alpine:3.20
|
|
ARG GO_BASE=golang:1.25
|
|
# The route-proxy module's runtime image: the reference reverse proxy compiled into a container.
|
|
#
|
|
# **The proxy source is not vendored here.** The canonical proxy — the contract written as something
|
|
# that runs — lives in the mesh-controller repository at examples/route-proxy (novox/hq 08-connectivity
|
|
# §3). This module ships the *packaging*, not a second copy of the contract, so the build context is
|
|
# the mesh-controller repository, and this Dockerfile compiles ./examples/route-proxy from it. The build seat
|
|
# hands it only that program's build source — its import closure, go.mod, go.sum and the vendored packages
|
|
# it uses (novox/hq ADR 0267, the artifact's `compiles`) — so a merge elsewhere in that repository does not
|
|
# move this image, and a COPY of anything outside it fails by name.
|
|
#
|
|
# docker build -f mesh-catalog/modules/route-proxy/Dockerfile \
|
|
# -t mesh-route-proxy:development <path-to>/mesh-controller
|
|
#
|
|
# The mesh pins the digest of what this produces; the committed module.json carries the placeholder
|
|
# digest every mesh-built image does, replaced at publish.
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-route-proxy ./examples/route-proxy
|
|
|
|
# A small runtime with the public CA roots the ACME client needs to reach a real authority, and run
|
|
# as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.
|
|
FROM ${ALPINE_BASE}
|
|
RUN apk add --no-cache ca-certificates
|
|
COPY --from=build /mesh-route-proxy /usr/local/bin/mesh-route-proxy
|
|
ENTRYPOINT ["/usr/local/bin/mesh-route-proxy"]
|