mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Opus 5
06fa55824d
Four compose services declared their own build against worker/Dockerfile, so buildkit shared the solve and then exported and unpacked the same image once per tag. Compose does not dedupe identical targets, measured on a three-service probe. Under the containerd snapshotter the unpack is a second full pass over every byte, as expensive as the export. The go module and build caches were baked into layers: `go install nuclei` made a 2.66GB layer for a 190MB binary, and /root/go/pkg/mod (3.4GB) plus /root/.cache/go-build (3.3GB) were half the 13.1GB image. - the tools build in a throwaway stage with --mount=type=cache on GOCACHE and GOMODCACHE; the runtime stage copies /out/bin alone - worker-default builds rengine-worker:latest; worker-beat, ct-stream and flower reference it. Building one of those alone now needs worker-default built first - the runtime stage drops the go toolchain, build-essential and libpcap-dev; uv sync needs no compiler. libpcap0.8t64 stays, naabu dlopens it for SYN so ldd shows nothing and the loss would only surface at scan time - -ldflags=-s trims the binaries 650MB -> 495MB - only shared/ and tools/ are copied, being file:// path deps; stages/, reports/, interest/, toolbox/, mcp/, connectors/ and binaries/ are mounted - the frontend fetches tech icons above COPY frontend/. ., so a source edit no longer re-runs the tarball download - .dockerignore excludes .git (271MB) and node_modules (320MB); COPY frontend/. . had been copying the host's node_modules over the npm ci result worker image 13.1GB -> 2.41GB, frontend 1.38GB -> 969MB worker export+unpack 453s across three tags -> 55s across one editing stages/ or reports/ now rebuilds nothing (1s), frontend/src 4s, shared/ 19s; cold build 475s -> 414s, still dominated by go compilation Tool versions diff identical against the old image, naabu SYN proven against a live listener, 8/8 services up, 853 tests green, ruff clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015fWjAbvFBdmsmVeMcwaaR9
34 lines
719 B
Docker
34 lines
719 B
Docker
FROM python:3.13-slim AS base
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONPATH=/app
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.12.13 /uv /usr/local/bin/uv
|
|
|
|
|
|
##################################################################
|
|
# Development
|
|
##################################################################
|
|
|
|
FROM base AS development
|
|
|
|
COPY shared /app/shared
|
|
COPY tools /app/tools
|
|
|
|
COPY api/pyproject.toml api/uv.lock* ./
|
|
|
|
RUN uv sync --no-install-project
|
|
|
|
EXPOSE 8000
|
|
|
|
COPY api/entrypoint.sh /app/entrypoint.sh
|
|
|
|
CMD ["/app/entrypoint.sh"]
|
|
|
|
|
|
# stages/, reports/, interest/, mcp/, connectors/, toolbox/ and binaries/ are mounted in
|
|
# dev; a prod stage must COPY them and keep PYTHONPATH=/app
|