mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
123 lines
4.8 KiB
Docker
123 lines
4.8 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Shared OpenShell image build graph.
|
|
#
|
|
# Targets:
|
|
# gateway Final gateway image
|
|
# supervisor Final supervisor image (Ubuntu base, supervisor binary)
|
|
#
|
|
# Rust binaries are built natively before the image build and staged at:
|
|
# deploy/docker/.build/prebuilt-binaries/<arch>/openshell-{gateway,sandbox}
|
|
#
|
|
# For local dev (Skaffold), pass --build-arg BUILD_FROM_SOURCE=1 to compile
|
|
# binaries inside Docker instead. BuildKit only executes the selected binary
|
|
# staging stage, so missing prebuilt files do not cause a build failure.
|
|
|
|
# Controls binary source: 0 = prebuilt (release), 1 = compile in Docker (local dev).
|
|
# Must be declared here (global scope) so it can be used in FROM instructions below.
|
|
ARG BUILD_FROM_SOURCE=0
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Optional in-Docker Rust build (BUILD_FROM_SOURCE=1, local dev only)
|
|
# ---------------------------------------------------------------------------
|
|
FROM rust:1.95.0-slim-bookworm AS rust-builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
cmake \
|
|
pkg-config \
|
|
libssl-dev \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates/ crates/
|
|
COPY proto/ proto/
|
|
COPY providers/ providers/
|
|
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/build/target \
|
|
cargo build --release \
|
|
--features "openshell-core/dev-settings" \
|
|
--bin openshell-gateway \
|
|
--bin openshell-sandbox \
|
|
&& mkdir -p /build/out \
|
|
&& install -m 0755 target/release/openshell-gateway /build/out/openshell-gateway \
|
|
&& install -m 0755 target/release/openshell-sandbox /build/out/openshell-sandbox
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Per-arch binary stages
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Prebuilt path (release default, BUILD_FROM_SOURCE=0)
|
|
FROM scratch AS gateway-binary-0
|
|
ARG TARGETARCH
|
|
# --chmod=755 preserves the executable bit through actions/upload-artifact +
|
|
# download-artifact, which strip exec perms during the roundtrip.
|
|
COPY --chmod=755 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-gateway /build/out/openshell-gateway
|
|
|
|
# Source-built path (local dev, BUILD_FROM_SOURCE=1)
|
|
FROM rust-builder AS gateway-binary-1
|
|
|
|
FROM gateway-binary-${BUILD_FROM_SOURCE} AS gateway-binary
|
|
|
|
# Prebuilt path (release default, BUILD_FROM_SOURCE=0)
|
|
FROM scratch AS supervisor-binary-0
|
|
ARG TARGETARCH
|
|
# --chmod=755 preserves the executable bit through actions/upload-artifact +
|
|
# download-artifact, which strip exec perms during the roundtrip.
|
|
COPY --chmod=755 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-sandbox /build/out/openshell-sandbox
|
|
|
|
# Source-built path (local dev, BUILD_FROM_SOURCE=1)
|
|
FROM rust-builder AS supervisor-binary-1
|
|
|
|
FROM supervisor-binary-${BUILD_FROM_SOURCE} AS supervisor-binary
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Final gateway image
|
|
# ---------------------------------------------------------------------------
|
|
FROM nvcr.io/nvidia/base/ubuntu:noble-20251013 AS gateway
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates && \
|
|
apt-get install -y --only-upgrade gpgv && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN useradd --create-home --user-group openshell
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=gateway-binary /build/out/openshell-gateway /usr/local/bin/
|
|
|
|
RUN mkdir -p /build/crates/openshell-server
|
|
COPY --chmod=755 crates/openshell-server/migrations /build/crates/openshell-server/migrations
|
|
|
|
USER openshell
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["openshell-gateway"]
|
|
CMD ["--bind-address", "0.0.0.0", "--port", "8080"]
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Final supervisor image
|
|
# ---------------------------------------------------------------------------
|
|
# Supervisor image based on the same NVIDIA Ubuntu base used by the gateway.
|
|
#
|
|
# Used by:
|
|
# - Docker driver: binary is extracted from the image and run inside the
|
|
# agent container.
|
|
# - Podman driver: image is mounted as an OCI volume at /opt/openshell/bin.
|
|
# - Kubernetes driver: image runs as an init container that invokes the
|
|
# binary's `copy-self` subcommand to seed an emptyDir volume.
|
|
#
|
|
# An Ubuntu base provides glibc and the dynamic loader needed to exec the
|
|
# dynamically linked binary. `FROM scratch` would be smaller but cannot run
|
|
# the binary, breaking the Kubernetes init-container path.
|
|
FROM nvcr.io/nvidia/base/ubuntu:noble-20251013 AS supervisor
|
|
COPY --from=supervisor-binary /build/out/openshell-sandbox /openshell-sandbox
|