| 1 | # Diffinery runner image (Cloudflare Containers, linux/amd64). |
| 2 | # Build context: containers/runner. Run `pnpm build` first so dist/agent.mjs exists. |
| 3 | # |
| 4 | # docker build --platform linux/amd64 -t diffinery-runner containers/runner |
| 5 | ARG BASE_IMAGE=ubuntu:24.04 |
| 6 | FROM ${BASE_IMAGE} |
| 7 | |
| 8 | ARG NODE_VERSION=22.22.0 |
| 9 | |
| 10 | ENV DEBIAN_FRONTEND=noninteractive \ |
| 11 | LANG=C.UTF-8 \ |
| 12 | LC_ALL=C.UTF-8 \ |
| 13 | DIFFINERY_WORK_ROOT=/workspace \ |
| 14 | RUNNER_TOOL_CACHE=/opt/hostedtoolcache \ |
| 15 | AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache \ |
| 16 | COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \ |
| 17 | # Ubuntu 24.04 marks the system Python as externally managed (PEP 668); |
| 18 | # CI scripts commonly `pip install` directly, so allow it like hosted runners do. |
| 19 | PIP_BREAK_SYSTEM_PACKAGES=1 |
| 20 | |
| 21 | RUN apt-get update \ |
| 22 | && apt-get install -y --no-install-recommends \ |
| 23 | ca-certificates curl git git-lfs jq zip unzip xz-utils tar gzip \ |
| 24 | build-essential pkg-config openssh-client gnupg \ |
| 25 | python3 python3-pip python3-venv python-is-python3 \ |
| 26 | && git config --system --add safe.directory '*' \ |
| 27 | && git lfs install --system --skip-repo \ |
| 28 | && apt-get clean \ |
| 29 | && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* |
| 30 | |
| 31 | # Node.js LTS from the official tarball (checksum-verified), with corepack shims for pnpm/yarn. |
| 32 | RUN set -eux; \ |
| 33 | cd /tmp; \ |
| 34 | file="node-v${NODE_VERSION}-linux-x64.tar.xz"; \ |
| 35 | curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/${file}"; \ |
| 36 | curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" | grep " ${file}\$" | sha256sum -c -; \ |
| 37 | tar -xJf "${file}" -C /usr/local --strip-components=1 --no-same-owner \ |
| 38 | --exclude='*/CHANGELOG.md' --exclude='*/README.md' --exclude='*/LICENSE' --exclude='*/include/*' --exclude='*/share/doc/*'; \ |
| 39 | rm -f "${file}"; \ |
| 40 | corepack enable; \ |
| 41 | corepack prepare pnpm@10.28.0 --activate; \ |
| 42 | corepack prepare yarn@1.22.22 --activate; \ |
| 43 | node --version; npm --version; pnpm --version; yarn --version; \ |
| 44 | npm cache clean --force; \ |
| 45 | rm -rf /root/.npm /tmp/* |
| 46 | |
| 47 | # Docker Engine, started on first use by the /usr/local/bin/docker wrapper. Cloudflare |
| 48 | # Containers run it rootful with iptables, so bridge networks, service DNS, port |
| 49 | # publishing and builds all work like on GitHub's hosted runners. |
| 50 | RUN set -eux; \ |
| 51 | install -m 0755 -d /etc/apt/keyrings; \ |
| 52 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc; \ |
| 53 | echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list; \ |
| 54 | apt-get update; \ |
| 55 | apt-get install -y --no-install-recommends docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin iptables; \ |
| 56 | apt-get clean; \ |
| 57 | rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* |
| 58 | COPY image/daemon.json /etc/docker/daemon.json |
| 59 | COPY image/docker /usr/local/bin/docker |
| 60 | |
| 61 | RUN mkdir -p /workspace /opt/hostedtoolcache /opt/diffinery |
| 62 | COPY dist/agent.mjs /opt/diffinery/agent.mjs |
| 63 | |
| 64 | WORKDIR /workspace |
| 65 | EXPOSE 8080 |
| 66 | ENTRYPOINT ["node", "/opt/diffinery/agent.mjs"] |