mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

build: harden image build inputs

Browse Source
This commit is contained in:
marcopan
2026-08-04 16:33:39 +02:00
parent d42fdf4b71
commit e2264ee295
7 changed files with 52 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/core.Dockerfile
+8 -5
View File
@@ -4,8 +4,11 @@
ARG PI_VERSION=0.80.3
ARG IMAGE_VERSION=local
# ---- Pinned Node source for the runtime binary and npm ----
FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS node-runtime
# ---- Stage 0: locked Pi runtime ----
FROM node:22-bookworm AS pi-runtime-build
FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS pi-runtime-build
ARG PI_VERSION
WORKDIR /opt/pi-runtime
COPY docker/pi-runtime/package.json docker/pi-runtime/package-lock.json ./
@@ -13,7 +16,7 @@ RUN npm ci --omit=dev \
&& test "$(./node_modules/.bin/pi --version)" = "$PI_VERSION"
# ---- Stage 1: backend TypeScript -> dist ----
FROM node:22-bookworm AS backend-build
FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS backend-build
WORKDIR /src/backend
COPY backend/package*.json ./
RUN npm ci
@@ -21,7 +24,7 @@ COPY backend/ ./
RUN npm run build
# ---- Stage 2: runtime (Python 3.12 nativo + Node 22 copiato, stesso glibc bookworm) ----
FROM python:3.12-slim-bookworm AS runtime
FROM python:3.12-slim-bookworm@sha256:d50fb7611f86d04a3b0471b46d7557818d88983fc3136726336b2a4c657aa30b AS runtime
ARG PI_VERSION
ARG IMAGE_VERSION
LABEL org.opencontainers.image.title="thothii-core" \
@@ -36,8 +39,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& ln -s /usr/bin/fdfind /usr/local/bin/fd
# Node 22 + npm copiati dall'immagine ufficiale (stesso Debian bookworm → binario compatibile)
COPY --from=node:22-bookworm /usr/local/bin/node /usr/local/bin/node
COPY --from=node:22-bookworm /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
&& ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx