jochen
ef3e5ae9b0
mesh/merge-gate head ef3e5ae9b0dc merged into trunk 1d244d5aa24e — pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus…
mesh/repo-check head ef3e5ae9b0dc merged into trunk 1d244d5aa24e — pass: its merge-check.sh passed
mesh/delivery delivered
The genesis image copies the whole clone with .git, so its controller carried the commit it was built at, as the bundles did.
23 lines
1022 B
Docker
23 lines
1022 B
Docker
ARG ALPINE_BASE=alpine:3
|
|
ARG GO_BASE=golang:1.25-alpine
|
|
# The builder, as a module ships one.
|
|
#
|
|
# Not FROM scratch, unlike the control plane: this one runs git and a container client, so it
|
|
# needs a filesystem with them on it. That is the honest cost of a machine whose job is to build —
|
|
# and it is why building is a MODULE on a machine that has a runtime rather than something the
|
|
# control plane does (novox/hq ADR 0005).
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags '-s -w' -o /mesh-builder ./cmd/mesh-builder
|
|
|
|
FROM ${ALPINE_BASE}
|
|
# git to clone what it is asked to build, and the docker client to build and push it. The daemon
|
|
# is the machine's, reached through its socket — a build machine shares the runtime it was given
|
|
# rather than running one inside itself.
|
|
RUN apk add --no-cache git docker-cli
|
|
COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
|
|
ENTRYPOINT ["/usr/local/bin/mesh-builder"]
|