| 1 | # Diffinery runner image (Cloudflare Containers, linux/amd64). |
| 2 | # Build context: containers/runner. Run `pnpm build` first so dist/agent.mjs exists. |
| 3 | # |
| 4 | # docker build --platform linux/amd64 -t diffinery-runner containers/runner |
| 5 | ARG BASE_IMAGE=ubuntu:24.04 |
| 6 | FROM ${BASE_IMAGE} |
| 7 | |
| 8 | ARG NODE_VERSION=22.22.0 |
| 9 | |
| 10 | ENV DEBIAN_FRONTEND=noninteractive \ |
| 11 | LANG=C.UTF-8 \ |
| 12 | LC_ALL=C.UTF-8 \ |
| 13 | DIFFINERY_WORK_ROOT=/workspace \ |
| 14 | RUNNER_TOOL_CACHE=/opt/hostedtoolcache \ |
| 15 | AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache \ |
| 16 | COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ |
| 17 | # What hosted ubuntu-24.04 runners report; setup-* actions key their caches on it. |
| 18 | ImageOS=ubuntu24 \ |
| 19 | ImageVersion=20250101.1 \ |
| 20 | # Ubuntu 24.04 marks the system Python as externally managed (PEP 668); |
| 21 | # CI scripts commonly `pip install` directly, so allow it like hosted runners do. |
| 22 | PIP_BREAK_SYSTEM_PACKAGES=1 |
| 23 | |
| 24 | # The -dev libraries are what ruby/setup-ruby's prebuilt Rubies link against (psych needs |
| 25 | # libyaml) and what gems' native extensions build with, as on hosted runners. Jobs run as root, |
| 26 | # and sudo is there (passwordless, as root) so `sudo apt-get install ...` works as on GitHub. |
| 27 | RUN apt-get update \ |
| 28 | && apt-get install -y --no-install-recommends \ |
| 29 | ca-certificates curl git git-lfs jq zip unzip xz-utils tar gzip zstd sudo \ |
| 30 | build-essential pkg-config openssh-client gnupg \ |
| 31 | python3 python3-pip python3-venv python-is-python3 \ |
| 32 | libyaml-dev libssl-dev libffi-dev zlib1g-dev libreadline-dev libgmp-dev \ |
| 33 | bubblewrap \ |
| 34 | && git config --system --add safe.directory '*' \ |
| 35 | && git lfs install --system --skip-repo \ |
| 36 | && apt-get clean \ |
| 37 | && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* |
| 38 | |
| 39 | # Node.js LTS from the official tarball (checksum-verified), with corepack shims for pnpm/yarn. |
| 40 | RUN set -eux; \ |
| 41 | cd /tmp; \ |
| 42 | file="node-v${NODE_VERSION}-linux-x64.tar.xz"; \ |
| 43 | curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/${file}"; \ |
| 44 | curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" | grep " ${file}\$" | sha256sum -c -; \ |
| 45 | tar -xJf "${file}" -C /usr/local --strip-components=1 --no-same-owner \ |
| 46 | --exclude='*/CHANGELOG.md' --exclude='*/README.md' --exclude='*/LICENSE' --exclude='*/include/*' --exclude='*/share/doc/*'; \ |
| 47 | rm -f "${file}"; \ |
| 48 | corepack enable; \ |
| 49 | corepack prepare pnpm@10.28.0 --activate; \ |
| 50 | corepack prepare yarn@1.22.22 --activate; \ |
| 51 | node --version; npm --version; pnpm --version; yarn --version; \ |
| 52 | npm cache clean --force; \ |
| 53 | rm -rf /root/.npm /tmp/* |
| 54 | |
| 55 | # nvm, as on hosted runners: login shells (`shell: bash -l {0}`) can `nvm install` other Node.js versions. |
| 56 | # A fixed tag, checked against its commit. |
| 57 | ARG NVM_VERSION=v0.40.7 |
| 58 | ARG NVM_COMMIT=f0b0c6bb0b281ceeb106c8cf9ab8fde141215092 |
| 59 | ENV NVM_DIR=/usr/local/nvm |
| 60 | RUN set -eux; \ |
| 61 | git clone -q --depth 1 --branch "${NVM_VERSION}" https://github.com/nvm-sh/nvm.git "${NVM_DIR}"; \ |
| 62 | test "$(git -C "${NVM_DIR}" rev-parse HEAD)" = "${NVM_COMMIT}"; \ |
| 63 | rm -rf "${NVM_DIR}/.git"; \ |
| 64 | printf '%s\n' 'export NVM_DIR=/usr/local/nvm' '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"' > /etc/profile.d/nvm.sh; \ |
| 65 | bash -lc 'nvm --version' |
| 66 | |
| 67 | # GitHub CLI (preinstalled on hosted runners; workflows call `gh` with GH_TOKEN). |
| 68 | RUN set -eux; \ |
| 69 | install -m 0755 -d /etc/apt/keyrings; \ |
| 70 | curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg; \ |
| 71 | echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list; \ |
| 72 | apt-get update; \ |
| 73 | apt-get install -y --no-install-recommends gh; \ |
| 74 | apt-get clean; \ |
| 75 | rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* |
| 76 | |
| 77 | # Docker Engine, started on first use by the /usr/local/bin/docker wrapper. Cloudflare |
| 78 | # Containers run it rootful with iptables, so bridge networks, service DNS, port |
| 79 | # publishing and builds all work like on GitHub's hosted runners. |
| 80 | RUN set -eux; \ |
| 81 | install -m 0755 -d /etc/apt/keyrings; \ |
| 82 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc; \ |
| 83 | echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list; \ |
| 84 | apt-get update; \ |
| 85 | apt-get install -y --no-install-recommends docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin iptables; \ |
| 86 | apt-get clean; \ |
| 87 | rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* |
| 88 | COPY image/daemon.json /etc/docker/daemon.json |
| 89 | COPY image/docker /usr/local/bin/docker |
| 90 | |
| 91 | RUN mkdir -p /workspace /opt/hostedtoolcache /opt/diffinery |
| 92 | # image-tag (written by scripts/runner-image.sh) names this image in each job's log and API. |
| 93 | COPY dist/agent.mjs dist/image-tag* /opt/diffinery/ |
| 94 | |
| 95 | WORKDIR /workspace |
| 96 | EXPOSE 8080 |
| 97 | ENTRYPOINT ["node", "/opt/diffinery/agent.mjs"] |