Repository navigation
feat(docker): add Dockerfile + .dockerignore for dev isolation - #121
Merged
Merged
Conversation
…r-dev-isolation) Adds a multi-stage Dockerfile that builds both workspace binaries and a .dockerignore that keeps target/ (4.2G) and .git/ out of the build context. - builder: rust:1.95-bookworm + protobuf-compiler/pkg-config/libssl-dev (native deps the prost/openssl build needs); cargo build --release --locked with BuildKit cache mounts on the cargo registry + target dir so source-only changes don't recompile the ~950-dep tree. - runtime: debian:bookworm-slim, ca-certificates + libssl3, unprivileged uid 10001; pawan-api is the default entrypoint, pawan CLI via --entrypoint. Verified on the rewritten main (de893a9): - docker build -> rc=0; image pawan:docker-dev = 200MB. - docker run --entrypoint pawan ... --version -> 'pawan 0.5.23' (rc=0). - docker run (default entrypoint pawan-api) -> binds port 3300 in-container. - container runs as uid=10001(pawan), not root. - context probe: 14MB context vs 4.2G target/ => .dockerignore excludes it. Owner directive docker-dev-isolation (rev c5b4251).
The adopted draft pinned rust:1.95-bookworm. rust-1-99-only is the fleet standard and pawan's CI runs 1.99; shipping an image built on 1.95 would diverge from the toolchain CI verifies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a multi-stage
Dockerfileand a.dockerignoreso pawan can be built and run as a container — part of the owner-directed docker-dev-isolation workstream (rev c5b4251): every code repo gets a Dockerfile + container for parallel multi-agent work isolation, until skywalkers is ready.Design
rust:1.95-bookworm): installsprotobuf-compiler,pkg-config,libssl-dev,ca-certificates(the native deps the prost/openssl build needs), thencargo build --release --locked -p pawan-api -p pawan.--lockedkeeps the build honest against the committedCargo.lock(same guarantee as CI's--locked)./usr/local/cargo/registry,/usr/local/cargo/git, and/build/targetpersist the dependency tree across builds, so a source-only change does not recompile the ~950-dependency workspace. Requires BuildKit (DOCKER_BUILDKIT=1, default in current Docker).debian:bookworm-slim):ca-certificates+libssl3only, unprivilegeduid 10001.pawan-api(the service) is the default entrypoint; thepawanCLI is available via--entrypoint pawan..dockerignoreexcludestarget/,.git/,.omp/, and.env*— verified to cut the build context from 4.2 GB to 14 MB.Verified (on rewritten main de893a9)
DOCKER_BUILDKIT=1 docker build -t pawan:docker-dev .→ rc=0; image = 200 MB.docker run --rm --entrypoint pawan pawan:docker-dev --version→pawan 0.5.23(rc=0).docker run --rm pawan:docker-dev(defaultpawan-api) → boots,pawan-api listening on port 3300in-container.id→uid=10001(pawan).COPY . /into scratch yields 14 MB withtarget/absent →.dockerignoreworks.Notes