Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/docker-build-dev.yml
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,9 @@ jobs:
type=semver,pattern={{major}}.{{minor}}
type=raw,value=latest,enable={{is_default_branch}}

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

Expand All @@ -51,6 +54,7 @@ jobs:
context: .
file: ./excalidraw-complete.Dockerfile
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.IMAGE_NAME }}:buildcache
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
4 changes: 4 additions & 0 deletions .github/workflows/docker-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@ jobs:
type=semver,pattern={{major}}.{{minor}}
type=raw,value=latest,enable={{is_default_branch}}

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

Expand All @@ -53,6 +56,7 @@ jobs:
context: .
file: ./excalidraw-complete.Dockerfile
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.IMAGE_NAME }}:buildcache
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
10 changes: 6 additions & 4 deletions excalidraw-complete.Dockerfile
Original file line number Diff line number Diff line change
@@ -1,15 +1,17 @@
# 前端构建阶段
FROM node:18 AS frontend-builder
FROM --platform=$BUILDPLATFORM node:18 AS frontend-builder
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For better reproducibility and to keep image layers consistent, it's recommended to use a specific version and variant for the base image. Using an Alpine-based image like node:18-alpine would also align with the other stages that use Alpine, potentially reducing the overall build size and complexity.

FROM --platform=$BUILDPLATFORM node:18-alpine AS frontend-builder

WORKDIR /app
# 复制 excalidraw 子模块
COPY excalidraw/ ./excalidraw/
# 构建前端
RUN cd excalidraw && npm install -g pnpm && pnpm install && cd excalidraw-app && DISABLE_VITE_CHECKER=true pnpm build:app:docker

# 后端构建阶段
FROM golang:alpine AS backend-builder
FROM --platform=$BUILDPLATFORM golang:alpine AS backend-builder
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To ensure consistent and reproducible builds, it's best to pin the Go image to a specific version rather than using a broad tag like alpine. Your go.mod file specifies toolchain go1.24.4, so using a matching image version is advisable.

FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS backend-builder

RUN apk update && apk add --no-cache git
WORKDIR /app
ARG TARGETOS
ARG TARGETARCH
# 复制 Go 模块文件
COPY go.mod go.sum ./
RUN go mod download
Expand All @@ -18,10 +20,10 @@ COPY . .
# 复制前端构建文件到正确位置,以便 Go embed 可以找到
COPY --from=frontend-builder /app/excalidraw/excalidraw-app/build ./frontend/
# 构建 Go 应用
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main .
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-s -w" -o main .

# 最终运行镜像
FROM alpine:latest
FROM --platform=$TARGETPLATFORM alpine:latest
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Using the latest tag for a base image in a production Dockerfile is risky because it can pull in breaking changes unexpectedly, making your builds non-reproducible. It's a strong best practice to pin to a specific version tag, for example alpine:3.20.

FROM --platform=$TARGETPLATFORM alpine:3.20

RUN apk --no-cache add ca-certificates
WORKDIR /root/
# 复制后端二进制文件(已包含嵌入的前端文件)
Expand Down