-
Notifications
You must be signed in to change notification settings - Fork 145
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updated Docker Build & Vulnerability Patching #240
Open
NOXCIS
wants to merge
16
commits into
darkwire:master
Choose a base branch
from
NOXCIS:master
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
16 commits
Select commit
Hold shift + click to select a range
043c6a8
push ready
NOXCIS f1b89ed
+
NOXCIS 5c1ebae
Update start.sh
NOXCIS fc77afe
Merge branch 'master' into master
NOXCIS 6cb3913
Update Dockerfile
NOXCIS d9fa642
+
NOXCIS ec08d15
updates
NOXCIS 04c42ec
updates
NOXCIS 8f1fb99
up
NOXCIS 1efe556
fix health check
NOXCIS 14842fe
Create docker-image.yml
NOXCIS 47d9d86
Update docker-image.yml
NOXCIS 28206fb
Update docker-image.yml
NOXCIS 903dbd3
Update docker-image.yml
NOXCIS 34c6f3b
Update Dockerfile
NOXCIS b63b41c
Update docker-image.yml
NOXCIS File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,6 +3,8 @@ | |
!yarn.lock | ||
!docker-entrypoint.sh | ||
!build.sh | ||
!start.sh | ||
!default.conf | ||
!server/* | ||
!client/* | ||
**/node_modules/* |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
name: Build and Push Docker Image (Daily) | ||
|
||
on: | ||
schedule: | ||
- cron: "0 0 * * *" # Daily at midnight (UTC) | ||
workflow_dispatch: # Allows manual triggering of the workflow | ||
inputs: | ||
trigger-build: | ||
description: 'Trigger a manual build and push' | ||
default: 'true' | ||
|
||
jobs: | ||
build_and_push_multiarch: | ||
runs-on: ubuntu-22.04 | ||
timeout-minutes: 42 # Job will timeout after 42 minutes | ||
|
||
steps: | ||
# Step 1: Check out the repository code | ||
- name: Checkout code | ||
uses: actions/checkout@v3 | ||
|
||
# Step 2: Log in to Docker Hub using secrets | ||
- name: Log in to Docker Hub | ||
uses: docker/login-action@v2 | ||
with: | ||
username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
|
||
|
||
# Step 3: Create and use a new builder with multi-platform support | ||
- name: Set up Docker Buildx (Multi-Arch Builder) | ||
uses: docker/setup-buildx-action@v3 | ||
with: | ||
driver-opts: image=moby/buildkit:master | ||
platforms: linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7 | ||
|
||
# Step 4: Set up QEMU (for multi-platform emulation) | ||
- name: Set up QEMU | ||
uses: docker/setup-qemu-action@v3 | ||
with: | ||
platforms: linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7 | ||
|
||
# Step 5: Build and Push Docker Image with multi-platform support (No cache) | ||
- name: Build and Push Docker Image (Multi-Arch) | ||
uses: docker/build-push-action@v4 | ||
with: | ||
context: . # Path to Dockerfile in repository | ||
push: true # Push image after build | ||
tags: noxcis/darkwire:terra-firma # Tag for all platforms | ||
platforms: linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7 # Platforms to build for | ||
no-cache: true # Disable caching to force a fresh build |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,35 +1,40 @@ | ||
FROM node:18-bullseye-slim | ||
# builder: Builder For Darkwore | ||
FROM --platform=$BUILDPLATFORM node:current-alpine AS builder | ||
|
||
USER node:node | ||
|
||
WORKDIR /home/node | ||
|
||
# Server environmental variables will be put into server/.env | ||
ENV MAILGUN_API_KEY=api-key \ | ||
MAILGUN_DOMAIN=darkwire.io \ | ||
[email protected] \ | ||
ABUSE_FROM_EMAIL_ADDRESS="Darkwire <[email protected]>" \ | ||
CLIENT_DIST_DIRECTORY='client/dist/'\ | ||
ROOM_HASH_SECRET='some-uuid'\ | ||
SITE_URL=https://darkwire.io \ | ||
STORE_BACKEND=memory | ||
|
||
# Client configuration will be put into client/.env | ||
ENV TZ=UTC \ | ||
VITE_API_HOST=localhost \ | ||
VITE_API_PROTOCOL=http \ | ||
VITE_API_PORT=3001 \ | ||
VITE_COMMIT_SHA=some_sha \ | ||
VITE_MAX_FILE_SIZE=4 | ||
VITE_COMMIT_SHA=terra-firma | ||
|
||
WORKDIR /opt/app | ||
COPY . . | ||
RUN npm install -g yarn@latest --force \ | ||
&& yarn install --flat --production --no-cache \ | ||
&& yarn build --no-cache \ | ||
&& rm -rf /opt/app/node_modules \ | ||
&& yarn cache clean \ | ||
&& yarn autoclean --force | ||
|
||
# final: Final Darkwire Image | ||
FROM alpine:latest | ||
|
||
WORKDIR /opt/app | ||
|
||
RUN apk add --no-cache nginx yarn openssl iptables | ||
COPY --from=builder /opt/app/client/dist /opt/app/client/dist | ||
COPY --from=builder /opt/app/server /opt/app/server | ||
COPY package.json /opt/app/package.json | ||
COPY default.conf /etc/nginx/http.d/ | ||
COPY start.sh /opt/app/start.sh | ||
|
||
|
||
COPY --chown=node:node . . | ||
RUN chmod +x /opt/app/start.sh | ||
|
||
RUN yarn && yarn build | ||
|
||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 CMD \ | ||
sh -c 'pgrep nginx > /dev/null && pgrep node > /dev/null' || exit 1 | ||
|
||
STOPSIGNAL SIGINT | ||
EXPOSE 3001 | ||
HEALTHCHECK --interval=30s --timeout=30s --start-period=10s --retries=3 \ | ||
CMD [ "curl", "-f", "${VITE_API_PROTOCOL}://localhost:${VITE_API_PORT}", "||", "exit", "1" ] | ||
CMD ["/opt/app/start.sh", "start" ] | ||
|
||
ENTRYPOINT [ "docker-entrypoint.sh" ] | ||
CMD ["yarn", "start"] | ||
STOPSIGNAL SIGTERM |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,4 @@ | ||
#!/bin/bash | ||
#!/bin/sh | ||
|
||
api_host=$API_HOST | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,5 @@ | ||
/* istanbul ignore file */ | ||
export const MAX_FILE_SIZE = import.meta.VITE_MAX_FILE_SIZE || 4; | ||
export const MAX_FILE_SIZE = import.meta.VITE_MAX_FILE_SIZE; | ||
export const COMMIT_SHA = import.meta.env.VITE_COMMIT_SHA; | ||
|
||
export default import.meta.env.NODE_ENV; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this change is unnecessary ;-)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Still haven't gotten around to configure my IDE, spends time time fighting docker engine.