Sterister
3c69995097
Some checks failed
Test / test (push) Has been cancelled
BuildKit gives each RUN a 1024 soft file-descriptor limit against a ~1M hard limit, and bun extracts tarballs in parallel — a large enough package exhausts the descriptors and the install dies with "Fail extracting tarball". It only shows up inside a build, because `docker run` inherits a far higher limit, which makes it look like a flaky registry. This bit Nova's deploy (on mermaid) and was fixed there; shade-server has the identical pattern and escaped only because its layers were cached, so it would have failed on the next cache-less build. Fixing it at the source too, so a vendor sync cannot silently drop it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
61 lines
2.2 KiB
Docker
61 lines
2.2 KiB
Docker
# ─── Build stage ────────────────────────────────────────────
|
|
FROM oven/bun:1 AS builder
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy workspace root config
|
|
COPY package.json bun.lock tsconfig.json ./
|
|
|
|
# Copy all packages the server + observer + dashboard need
|
|
COPY packages ./packages
|
|
|
|
# BuildKit gives each RUN a 1024 soft file-descriptor limit while the hard
|
|
# limit is ~1M. bun extracts tarballs in parallel, so a large package can
|
|
# exhaust the descriptors and the install dies with "Fail extracting tarball"
|
|
# — reproducible in a build, invisible outside one because `docker run`
|
|
# inherits a far higher limit. Raise the soft limit to what the host allows.
|
|
RUN ulimit -n "$(ulimit -Hn)" && bun install --frozen-lockfile
|
|
|
|
# Build the dashboard SPA → dist/, then copy to observer's dist/
|
|
RUN ulimit -n "$(ulimit -Hn)" && cd packages/shade-dashboard && bun run build
|
|
|
|
# ─── Production stage ───────────────────────────────────────
|
|
FROM oven/bun:1-alpine
|
|
|
|
LABEL org.opencontainers.image.title="Shade Prekey Server"
|
|
LABEL org.opencontainers.image.description="E2EE prekey distribution server with live observer (Signal Protocol)"
|
|
LABEL org.opencontainers.image.source="https://gt.zyon.no/Stian/Shade"
|
|
LABEL org.opencontainers.image.licenses="MIT"
|
|
LABEL org.opencontainers.image.vendor="Stian"
|
|
|
|
# curl for healthcheck
|
|
RUN apk add --no-cache curl
|
|
|
|
# Non-root user
|
|
RUN addgroup -S shade && adduser -S shade -G shade
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder --chown=shade:shade /build /app
|
|
|
|
# Persistent data directory (SQLite file or any sidecar state)
|
|
RUN mkdir -p /data && chown shade:shade /data
|
|
VOLUME ["/data"]
|
|
|
|
USER shade
|
|
|
|
EXPOSE 3900
|
|
|
|
# Defaults — override via `docker run -e`
|
|
ENV SHADE_PREKEY_DB_PATH=/data/shade-prekeys.db
|
|
ENV SHADE_INBOX_DB_PATH=/data/shade-inbox.db
|
|
ENV PORT=3900
|
|
ENV SHADE_LOG_LEVEL=info
|
|
ENV SHADE_STALE_DAYS=30
|
|
ENV SHADE_CLEANUP_INTERVAL_HOURS=24
|
|
ENV SHADE_INBOX_PRUNE_INTERVAL_MINUTES=5
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://localhost:${PORT}/health || exit 1
|
|
|
|
CMD ["bun", "run", "packages/shade-server/src/standalone.ts"]
|