james.maesandClaude Sonnet 5.5
e19feb01a8
Both Dockerfiles copied 0.1.0-SNAPSHOT jars that the reactor no longer produces
(version is ${revision}), so neither built a released version. They now resolve the
released qbit-document-renderer and qqq-remote-renderer-transport (and their runtime
libraries) at an exact, required RENDERER_VERSION / TRANSPORT_VERSION from the
QRun-IO Gitea Maven registry and Maven Central, refusing SNAPSHOT and local
(*forge*) versions. The reviewed hardening is unchanged: digest-pinned
BUILD_IMAGE/JAVA_IMAGE, non-root 65532, read-only-root friendly, Zint built from
vendor/. The reactor build context is no longer needed.
Adds IMAGE-PUBLISH.md (repeatable build/scan/publish steps and the 1.0.0 pins) and
image-pins.sh (prints the gg-forge-cd classpath and SHA256 pins from a published
image). Images for 1.0.0 were built, smoke-tested over mTLS and published to GHCR
under gg-engineering by hand; no workflow publishes images.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
24 lines
1.5 KiB
Docker
24 lines
1.5 KiB
Docker
# Build only on an operator-approved, immutable existing renderer image (RENDERER_IMAGE, the engine image from
|
|
# renderer/Dockerfile). This file does not build the engine or confer isolation qualification.
|
|
# The service is the RELEASED transport artifact, resolved at the exact TRANSPORT_VERSION from the QRun-IO Gitea Maven
|
|
# registry and Maven Central (no SNAPSHOT, no local build, no default). BUILD_IMAGE must be an immutable digest.
|
|
# docker build --build-arg BUILD_IMAGE=... --build-arg RENDERER_IMAGE=... --build-arg TRANSPORT_VERSION=1.0.0 bridges/remote-renderer/
|
|
ARG BUILD_IMAGE
|
|
ARG RENDERER_IMAGE
|
|
FROM ${BUILD_IMAGE} AS release
|
|
ARG TRANSPORT_VERSION
|
|
WORKDIR /release
|
|
COPY release-image/pom.xml ./pom.xml
|
|
RUN test -n "${TRANSPORT_VERSION}" && case "${TRANSPORT_VERSION}" in *SNAPSHOT*|*forge*) echo "TRANSPORT_VERSION must be a released version" >&2; exit 1;; esac \
|
|
&& mvn -B -Dtransport.version="${TRANSPORT_VERSION}" -Dmaven.repo.local=/release/.m2 package \
|
|
&& mv "target/lib/qqq-remote-renderer-transport-${TRANSPORT_VERSION}.jar" target/service.jar \
|
|
&& test -f target/service.jar && ls target/lib
|
|
|
|
FROM ${RENDERER_IMAGE}
|
|
COPY --from=release /release/target/service.jar /remote/service.jar
|
|
COPY --from=release /release/target/lib/ /remote/lib/
|
|
COPY LICENSE NOTICE /usr/share/doc/qqq-remote-renderer/
|
|
USER 65532:65532
|
|
EXPOSE 18445
|
|
ENTRYPOINT ["java", "-Xmx384m", "-XX:ActiveProcessorCount=1", "-XX:+ExitOnOutOfMemoryError", "-cp", "/remote/service.jar:/remote/lib/*", "com.kingsrook.renderer.remote.RendererServiceMain", "/run/qqq-renderer/config.json"]
|