Public Access
jaap-janandClaude Opus 5
8a568117df
registry-docker.dodotech.cloud/dodotech/dodossh-api, built and pushed by a third ci job
that needs the first. Gating on the tests costs a few minutes on every main commit and buys
the only thing worth having here: an image is not an artefact somebody inspects before
using it, so a red commit must not be able to produce one. Pull requests build the image
and stop, which is where a broken Dockerfile should be found.
Tags are :sha-<short> on every build, :main on main, and for a v* tag :1.2.3, :1.2 and
:latest — the last two only when the version has no prerelease suffix, since v1.3.0-rc1
sorts above v1.2.9 and would otherwise walk :latest onto somebody's server. Only sha- is
immutable, and it is the one to pin a deployment to.
No docker/* actions. The build is single-architecture, so it needs the daemon this runner
already has for the Testcontainers suites and nothing else — no buildx, no QEMU, and no
third-party action whose SHA has to be audited and re-pinned. Step outputs and secrets
reach the shell through env rather than ${{ }} interpolation, because a git tag may contain
a semicolon and interpolation is textual substitution performed before the shell parses the
line.
The image is chiseled: no shell, no package manager, uid 1654. Affordable because
Directory.Build.props already sets InvariantGlobalization, so the ICU and tzdata a normal
base carries are exactly what this product decided not to use. The cost is stated in the
Dockerfile rather than hidden — there is no HEALTHCHECK, because there is nothing to run
one with, and /healthz/ready is anonymous precisely so the orchestrator can ask instead.
Nothing migrates the schema from inside the container either; readiness fails while a
migration is pending and names it, which is the design.
And the restore that all of this depends on did not work. 7a3a521 committed lock files
carrying a net10.0/android-arm64 section into fourteen projects — written there by the
Android head's -p:RuntimeIdentifier=android-arm64 packaging build, which restores the
shared projects with a RID and updates their lock files as a side effect. Any restore
without that RID then fails NU1004 in locked mode, which is every other build there is:
`dotnet restore DodoSSH.slnx --locked-mode` has been failing for eleven projects on a clean
checkout of main since that commit. The sections are removed here and nothing else changed
— deletions only, ILLink.Tasks stays at 10.0.10.
Verified: the solution restores in locked mode, the image builds, and it runs. /healthz/live
answers 200 and /healthz/ready answers 503 naming the database it cannot reach, from a
67 MB image as uid 1654, configured entirely through DODOSSH_-prefixed variables.
The Android head's own lock file still carries the RID and is untouched, because that job
restores it separately and is outside DodoSSH.slnx. Whether its packaging step re-dirties
these fourteen on every CI run is worth a look; it is the same mechanism.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
34 lines
1014 B
Plaintext
34 lines
1014 B
Plaintext
# The build context for src/DodoSSH.Api/Dockerfile is the repository root, because central
|
|
# package management puts Directory.Packages.props there. That makes this file matter more
|
|
# than it usually does: without it the context is the whole working tree, including every
|
|
# bin/ and obj/ directory and the Android head's build output.
|
|
#
|
|
# Excluding obj/ is not only about size. A host obj/ carries project.assets.json and the
|
|
# generated .nuget.g.props naming absolute host paths; copied into the image it overrides
|
|
# the restore that just ran inside it, and the failure surfaces as packages "not found"
|
|
# that are plainly present.
|
|
|
|
**/bin/
|
|
**/obj/
|
|
artifacts/
|
|
.git/
|
|
.github/
|
|
.gitea/
|
|
.idea/
|
|
.vs/
|
|
.vscode/
|
|
|
|
# No project outside the API's reference closure contributes to this image. Listing them
|
|
# keeps a context change from silently invalidating the COPY src/ layer on every commit to
|
|
# a head this image does not contain.
|
|
src/DodoSSH.Client.*/
|
|
tests/
|
|
docs/
|
|
deploy/
|
|
|
|
*.md
|
|
*.user
|
|
*.binlog
|
|
Dockerfile*
|
|
.dockerignore
|