Will Anderson
116 lines
3.9 KiB
Docker
116 lines
3.9 KiB
Docker
FROM data.forgejo.org/forgejo/runner:11 AS runner-bin
|
|
|
|
FROM ubuntu:24.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
COPY --from=runner-bin /bin/forgejo-runner /usr/local/bin/act_runner
|
|
|
|
# Core system tools + C build deps needed by El compiler and other CI jobs
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
wget \
|
|
git \
|
|
gnupg \
|
|
lsb-release \
|
|
unzip \
|
|
zip \
|
|
xz-utils \
|
|
tar \
|
|
rsync \
|
|
file \
|
|
jq \
|
|
openssh-client \
|
|
make \
|
|
build-essential \
|
|
pkg-config \
|
|
software-properties-common \
|
|
zstd \
|
|
sudo \
|
|
libcurl4-openssl-dev \
|
|
libssl-dev \
|
|
libsqlite3-dev \
|
|
libpq-dev \
|
|
libffi-dev \
|
|
zlib1g-dev \
|
|
dpkg-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Allow any user to run sudo without a password (CI containers need apt-get etc.)
|
|
RUN echo "ALL ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
|
|
|
|
# Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
|
|
RUN NODE_VERSION=20.19.1 \
|
|
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
|
|
| tar -xJ -C /usr/local --strip-components=1 \
|
|
&& node --version \
|
|
&& npm --version \
|
|
&& npm install -g yarn
|
|
|
|
# Python 3 + pip + venv
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 \
|
|
python3-pip \
|
|
python3-venv \
|
|
python3-dev \
|
|
&& ln -sf /usr/bin/python3 /usr/local/bin/python \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Ruby + Bundler
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ruby \
|
|
ruby-dev \
|
|
ruby-bundler \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Go 1.22
|
|
RUN curl -fsSL https://go.dev/dl/go1.22.10.linux-amd64.tar.gz | tar -C /usr/local -xz
|
|
ENV PATH="/usr/local/go/bin:${PATH}"
|
|
|
|
# Docker CLI (socket mounted from host)
|
|
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable" \
|
|
> /etc/apt/sources.list.d/docker.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends docker-ce-cli \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# kubectl
|
|
RUN curl -fsSL "https://dl.k8s.io/release/$(curl -Ls https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
|
-o /usr/local/bin/kubectl \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
# Helm
|
|
RUN curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
|
|
|
# yq
|
|
RUN wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
|
|
&& chmod +x /usr/local/bin/yq
|
|
|
|
# GitHub CLI
|
|
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
|
|
| dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
|
|
> /etc/apt/sources.list.d/github-cli.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends gh \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Cloudflare Access bootstrap for git clones to git.neuralplatform.ai.
|
|
# This script is sourced by bash in build containers via BASH_ENV (set by
|
|
# act_runner's container.env in deployment.yaml) so it runs before every
|
|
# step. It configures git insteadOf + CF Access extraHeaders from
|
|
# CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET env vars.
|
|
#
|
|
# We deliberately don't set ENTRYPOINT / CMD here — act_runner spawns
|
|
# build containers with its own entrypoint to keep them alive between
|
|
# steps, and overriding it breaks job execution.
|
|
|
|
# SSH-based git clone init script.
|
|
# Sourced before every CI step via BASH_ENV (set in deployment.yaml).
|
|
# Writes GITEA_SSH_PRIVATE_KEY to ~/.ssh/gitea_key and rewrites HTTPS
|
|
# Gitea URLs to SSH so actions/checkout and git clone both use SSH auth.
|
|
COPY git-ssh-init.sh /usr/local/bin/git-ssh-init.sh
|
|
RUN chmod +x /usr/local/bin/git-ssh-init.sh
|