Dockerizeation2 - test - #1
Open
laouncle wants to merge 105 commits into
Open
Conversation
…I workflow for image build and testing
Ollama's install.sh requires zstd to extract its binary tarball. Without it the build fails with: ERROR: This version requires zstd for extraction.
- Export OLLAMA_VERSION and OLLAMA_NO_START=1 as ENV in Dockerfile so the Ollama installer respects the pinned version and skips systemd service configuration during Docker build - Add DEBIAN_FRONTEND=noninteractive to prevent interactive prompts - Fix stray comma in self-check.sh associative array declaration
…ke tests - Quote and sanitize log file path in start_service() to handle names with spaces (e.g. 'ollama serve') - Use --entrypoint bash in CI docker run commands to avoid triggering the full entrypoint (which starts services, clones repos, etc.) during smoke/integration tests
- Wrap tailscale install.sh in subshell with || echo to prevent build failure - Make tailscale check optional in smoke test (it's not critical for CI)
- Build job now always pushes to GHCR with ci-<run_id> temp tag - Smoke Test, Integration Test, Image Size Report all pull pre-built image - Added cleanup job to delete temp tag from GHCR after run completes - GHCR login enabled for PR builds (was only push before) - Estimated CI savings: ~9 minutes per run (13min → 4min)
…-check - Remove --entrypoint bash so the real entrypoint.sh runs (starts ollama, modelrelay, omniroute, hermes gateway, hermes dashboard) - Wait 30s for services to come up before running self-check - Remove '|| echo non-blocking' so port failures now fail the CI job - self-check.sh already exits code 2 on critical port failures (7352, 20128, 9119)
…erignore - Combined all heavy installs (ollama, hermes, omniroute, tailscale, mnemon, cline, claude) into a single RUN layer to reduce layer count - Added aggressive cleanup: apt-get clean, rm -rf /root/.npm /tmp/* /var/tmp/* - Added .dockerignore to exclude .git, .github, node_modules, .hermes, etc. - Reduced image layers from 15+ to ~3 (main install + COPYs + entrypoint) - Should prevent BuildKit crash during 'preparing layers for inline cache'
… cleanup The gh api user/packages endpoint requires a user PAT with read:packages scope — GITHUB_TOKEN (installation token) gets 403. Switch to the OCI Distribution API (ghcr.io/v2/...) which uses GHCR bearer tokens derived from GITHUB_TOKEN's packages:write scope, enabling manifest deletion by digest directly against the registry. - Get bearer token from ghcr.io/token with delete scope - Resolve tag to manifest digest via HEAD request - DELETE the manifest by digest - Graceful fallback if token or manifest unavailable
Fine-grained PATs (ghu_) and GITHUB_TOKEN both fail to delete GHCR
packages — the former returns 'UNSUPPORTED' on OCI DELETE, the latter
lacks the user/packages REST API scope. Classic PATs (ghp_) with
read:packages + write:packages are the only token type that supports
the GitHub REST API for package version deletion.
Changes:
- Use secrets.GHCR_CLEANUP_TOKEN (classic PAT) for auth
- Switch from OCI Distribution API to GitHub REST API
(GET/DELETE /user/packages/container/{pkg}/versions/{id})
- Add pagination support for repos with many package versions
- Graceful skip with setup instructions if secret is not configured
The user/packages REST API scopes to the authenticated user, so the package name should be 'hermes-codespace/devcontainer' not 'gitricko/hermes-codespace/devcontainer'. Without stripping the username prefix, the API returns 404.
- devcontainer.json: change from build.dockerfile to image: reference - CI workflow: add branch-based GHCR tags (branch-name, pr-N) - Fixes BuildKit crash on Codespaces runner (insufficient memory for inline cache)
- Use github.event_name == 'push' / 'pull_request' instead of numeric checks - devcontainer.json: use :pr-15 tag for Codespaces testing
The GHCR API deletes entire versions (not individual tags). When the cleanup deleted a version with :ci-* tag, it also removed :pr-15 and :sha tags on the same version. Now the cleanup checks for non-ci tags before deleting, preserving persistent tags like pr-*, latest, etc.
- Add FHS venv path detection (/usr/local/lib/hermes-agent/venv) with legacy fallback, matching entrypoint.sh logic - Guard ensurepip/pip install behind venv existence check - mkdir -p ~/.hermes/memories before writing USER.md
- devcontainer.json: add overrideCommand=false so ENTRYPOINT runs - entrypoint.sh/start-hermes.sh: add --skip-build flag to dashboard (web UI is pre-built in image or built lazily; skip avoids runtime npm)
- Changed COPY destination from /tmp/devcontainer-config/ to /usr/local/share/devcontainer-config/ - Codespaces mounts a host volume over /tmp which wipes baked-in files - Added !.devcontainer/*.md exception to .dockerignore to include .md config files - Updated entrypoint.sh and CI smoke test to use new path Fixes: cp: cannot stat '/tmp/devcontainer-config/CLAUDE.md': No such file or directory
Increased wait time for services to start from 30 to 60 seconds.
Replace 'whoami' command with echo of $USER in CI workflow.
Refactor Dockerfile to use Ollama binary from official image and remove direct installation steps.
… truth
- Move tool versions to workflow env vars (single source of truth)
- Pass versions to Dockerfile via --build-arg (no hardcoded duplication)
- Keep bare ARG declarations after 2nd FROM stage
- Cache scope uses hashFiles('.devcontainer/Dockerfile') for auto-bust
- Fixes CI failure: ARGs before FROM were empty in build stage
- Add node:24-slim builder stage for npm packages - Build ModelRelay, OmniRoute (with dep repair), Hermes Web UI in builder - COPY --from=node-builder only built outputs to final image - Remove redundant Web UI build from final stage - Estimated savings: ~300-500MB (npm build deps removed from final image)
The previous fix had two insteadOf rules, second overwrote first. npm uses ssh://git@github.com/ prefix (not git@github.com:). Also added ca-certificates for HTTPS verification. Tested locally: npm install github:gitricko/modelrelay works.
Build output lands at repo root level, not inside web/.
laouncle
force-pushed
the
dockerizeation2
branch
from
July 31, 2026 03:33
a4c5f61 to
664debf
Compare
…DME with new version badges
* feat: enhance Dockerfile to include TUI build for dashboard's embedded chat tab * dev * dev * dev * dev
* feat: add ACP adapter check to self-check script and CI workflow * dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.