jochen
b849af53dd
A mail client's release is about 80 MB per version, too large to keep in a repository at every upgrade, and an add-on whose licence forbids copying it to third parties may not be in a repository at all. An archive artifact may now name url, sha256 and version (and file or within) instead of from: the build seat fetches it once, refuses it when its digest is not the pin's and names both, keeps it in its workspace under the digest (a vendor that serves only its newest version cannot break a later build of the same pin), and packs it like any archive, so a node gets the mesh's own archive by digest and never asks the vendor. The build seat's image carries xz, which Go's standard library does not read. The installation check takes the vendor's address and version of such a pin for the world's, as a registry is an image's.
24 lines
1.1 KiB
Docker
24 lines
1.1 KiB
Docker
ARG ALPINE_BASE=alpine:3
|
|
ARG GO_BASE=golang:1.25-alpine
|
|
# The builder, as a module ships one.
|
|
#
|
|
# Not FROM scratch, unlike the control plane: this one runs git and a container client, so it
|
|
# needs a filesystem with them on it. That is the honest cost of a machine whose job is to build —
|
|
# and it is why building is a MODULE on a machine that has a runtime rather than something the
|
|
# control plane does (novox/hq ADR 0005).
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags '-s -w' -o /mesh-builder ./cmd/mesh-builder
|
|
|
|
FROM ${ALPINE_BASE}
|
|
# git to clone what it is asked to build, and the docker client to build and push it. The daemon
|
|
# is the machine's, reached through its socket — a build machine shares the runtime it was given
|
|
# rather than running one inside itself. xz to read an upstream release an archive is pinned to
|
|
# (novox/hq ADR 0316): Go's standard library reads gzip and bzip2 and not xz.
|
|
RUN apk add --no-cache git docker-cli xz
|
|
COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
|
|
ENTRYPOINT ["/usr/local/bin/mesh-builder"]
|