blob: b8b5599d872c2aa0aed9072ca2a0f5726ba7f9bb (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
# -- <worker_dependencies> --
FROM docker:dind AS worker_dependencies
# -- </worker_dependencies> --
# -- <ci_worker> --
FROM img.liz.coffee/emprespresso/ci_base:release AS worker
ENV PIPELINE_PATH=/app/worker/dist/scripts
RUN chmod +x /app/worker/dist/scripts/*
RUN mkdir -p /var/lib/laminar/cfg
RUN cp -r /app/worker/jobs /var/lib/laminar/cfg
# see: https://github.com/nodejs/docker-node/blame/89b29ef06b421598ec007605a2604ede0348b298/22/bullseye-slim/Dockerfile#L3-L4
RUN chown -R node:node /var/lib/laminar
# laminar runs as `node`, which reaches the host's docker socket only through
# a group whose GID matches the socket's group ON THE HOST. Group names don't
# carry across the container boundary; only the number does. If this GID is
# wrong the worker gets "permission denied" on the socket, and the tempting
# fix - chmod 777 on the host socket - hands root on the host to every process
# and container there, not just CI.
#
# Set this to the output of `getent group docker | cut -d: -f3` on the host
# running the worker (liz.coffee: 988). Override with --build-arg DOCKER_GID=.
# (Coolify drops --group-add from custom docker options, so it can't be
# supplied at runtime there.)
ARG DOCKER_GID="988"
RUN groupadd -g ${DOCKER_GID} docker
RUN usermod -a -d /var/lib/laminar -G docker node
COPY --from=worker_dependencies /usr/local/bin/docker /usr/local/bin/
USER node
WORKDIR /var/lib/laminar
EXPOSE 8080
CMD [ "/usr/sbin/laminard" ]
# -- </ci_worker> --
|
