mirror of
https://github.com/coder/coder.git
synced 2026-11-01 21:13:14 +08:00
Thomas KosiewskiandClaude Opus 4.7
51836e681e
Splits the dogfood image into two artifacts: - `ghcr.io/coder/oss-dogfood-base:<distro>-<base-sha>`: Ubuntu base with apt packages, chrome, rustup, brew, gh, and the mise binary. The base-sha is a cache key over `Dockerfile.base` and `files/`, so commits that don't touch those inputs reuse the previous build. - `codercom/oss-dogfood:<final-sha>-<distro>` and rolling tags (`:22.04`, `:26.04`, `:latest`, `:<branch>`): produced by `mise oci build` on top of the base, with one content-addressed OCI layer per mise tool. The rolling tag scheme is unchanged, so the workspace template doesn't need updating. Single-tool version bumps now invalidate only that tool's OCI layer, so workspaces re-pull just what changed instead of the entire 5-6 GB image on every recreate. Also: - Drops the build-time `pnpm dlx playwright@1.47.0 install --with-deps chromium` step (~400 MB) and the equivalent `playwright-driver.browsers` install from `flake.nix`. `@playwright/mcp` (used by the claude-code and codex MCP servers in `dogfood/coder/main.tf`) does NOT auto-install browsers, so the existing `install-deps` `coder_script` now runs two installs on workspace start: `pnpm exec playwright install chromium` for the site's pinned `@playwright/test`, and `npx --package=@playwright/mcp@latest playwright-core install --no-shell chromium` so the MCP servers find their matching browser revision. Browser revisions coexist under `~/.cache/ms-playwright/chromium-<rev>/`, which lives on the home volume so both downloads happen once per workspace recreate and persist across restarts. Net effect: same MCP behavior as before, +~1-2 min on first workspace start. Nix devshell users running site e2e tests locally now need `pnpm exec playwright install` once (instead of getting browsers via nixpkgs). - Bumps the pinned mise binary to v2026.5.12 (matching main after #25521) and adds top-level `min_version = "2026.5.12"` to `mise.toml` so every consumer (devs, CI, the embedded mise inside the dogfood image, mise oci builds) fails fast on an older mise. - Adds bison, flex, libicu-dev, libreadline-dev, uuid-dev, and zlib1g-dev to both Ubuntu base images for source-build use cases (e.g., building Postgres from source). - Replaces skopeo with crane as the registry client `mise oci push` shells out to: crane is added to `mise.toml`, the workflow drops its `apt-get install skopeo` and forces `--tool crane`, and the local wrapper image stops bundling skopeo. One source of truth for tool versions, no apt drift, smaller wrapper image, and workspace users get a registry client on PATH for free via mise oci's tool layers. - Removes `nix.hash`/`mise.hash` and their Makefile rules. The registry digest already captures every effective change since CI rebuilds when any baked-in input moves; the per-file `filesha1()` entries in `pull_triggers` are redundant. Supersedes #25400 (the `mise.hash` pull trigger landed there in `2b612abe7b`; this PR removes it as part of the broader simplification). > [!NOTE] > `mise oci build` is experimental and requires `MISE_EXPERIMENTAL=1` (set at job level in the workflow). The local-only `scripts/dogfood/mise-oci-wrapper.sh` builds a tiny `coderdev/mise-oci-wrapper:<version>` Debian image with curl-installed mise on first invocation (cached by version tag thereafter); we don't reuse `jdxcode/mise:latest` because that tag lags upstream GitHub releases by days and would defeat the `min_version` enforcement above. > [!NOTE] > `compute-base-sha.sh` and `compute-final-sha.sh` are cache keys, not strict content addresses: the base Dockerfile still pulls dynamic resources at build time (gh/buildx `releases/latest`, chrome `stable_current_amd64.deb`, apt mirror state). Two runs with identical checked-in files can produce slightly different bytes, which is acceptable here because the cache-hit savings on irrelevant commits outweigh that drift. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Thomas Kosiewski <tk@coder.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
3.0 KiB
Makefile
82 lines
3.0 KiB
Makefile
# Use the branch name to differentiate test builds from actual pulled images,
|
|
# replacing forward slashes with hyphens, as forward slashes are not valid in
|
|
# tag names.
|
|
build_tag ?= $(shell git rev-parse --abbrev-ref HEAD | sed "s/\\//-/")
|
|
|
|
# The base Dockerfile consumes the repo root as build context so it can
|
|
# reach the distro-specific files/ tree and configure-chrome-flags.sh
|
|
# under dogfood/coder/ubuntu-<release>/.
|
|
REPO_ROOT := $(shell git rev-parse --show-toplevel)
|
|
|
|
# Pick a container runtime. On macOS we prefer Apple's `container` CLI
|
|
# when present (it produces a Linux VM-backed amd64 image without
|
|
# Docker Desktop); otherwise fall back to docker. Linux always uses
|
|
# docker.
|
|
OS := $(shell uname -s)
|
|
ifeq ($(OS),Darwin)
|
|
CONTAINER_RUNTIME ?= $(shell command -v container >/dev/null 2>&1 && echo container || echo docker)
|
|
else
|
|
CONTAINER_RUNTIME ?= docker
|
|
endif
|
|
|
|
# Apple's `container` defaults to the host arch; the dogfood image is
|
|
# amd64-only, so pin it.
|
|
ifeq ($(CONTAINER_RUNTIME),container)
|
|
PLATFORM_ARG := --platform linux/amd64
|
|
else
|
|
PLATFORM_ARG :=
|
|
endif
|
|
|
|
ifeq ($(OS),Linux)
|
|
# `mise oci build` packages already-installed tools; the install
|
|
# has to run first. The macOS wrapper does this inside the
|
|
# container; on Linux we chain it here.
|
|
MISE_OCI := mise install --yes && MISE_EXPERIMENTAL=1 mise oci
|
|
else
|
|
MISE_OCI := CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) $(REPO_ROOT)/scripts/dogfood/mise-oci-wrapper.sh
|
|
endif
|
|
|
|
.PHONY: build build-ubuntu-22.04 build-ubuntu-26.04 \
|
|
build-base-ubuntu-22.04 build-base-ubuntu-26.04 \
|
|
update-keys update-keys-ubuntu-22.04 update-keys-ubuntu-26.04
|
|
|
|
build: build-ubuntu-22.04 build-ubuntu-26.04
|
|
|
|
# Caveat: `build-ubuntu-*` requires the base image to be pullable from a
|
|
# registry that `mise oci`'s HTTPS client can reach (ghcr.io, a local
|
|
# `registry:2` sidecar, etc.). `--from coderdev/oss-dogfood-base:*-local`
|
|
# only resolves when a registry mirror is set up alongside; without it,
|
|
# `mise oci build` fails because the wrapper container cannot see the
|
|
# host's local image store. The `build-base-ubuntu-*` targets on their
|
|
# own work end to end without any registry. See
|
|
# scripts/dogfood/mise-oci-wrapper.sh for the full story.
|
|
build-base-ubuntu-22.04:
|
|
$(CONTAINER_RUNTIME) build $(PLATFORM_ARG) \
|
|
-f "$(REPO_ROOT)/dogfood/coder/ubuntu-22.04/Dockerfile.base" \
|
|
-t "coderdev/oss-dogfood-base:22.04-local" \
|
|
"$(REPO_ROOT)"
|
|
|
|
build-base-ubuntu-26.04:
|
|
$(CONTAINER_RUNTIME) build $(PLATFORM_ARG) \
|
|
-f "$(REPO_ROOT)/dogfood/coder/ubuntu-26.04/Dockerfile.base" \
|
|
-t "coderdev/oss-dogfood-base:26.04-local" \
|
|
"$(REPO_ROOT)"
|
|
|
|
build-ubuntu-22.04: build-base-ubuntu-22.04
|
|
$(MISE_OCI) build \
|
|
--from "coderdev/oss-dogfood-base:22.04-local" \
|
|
--tag "codercom/oss-dogfood:22.04-$(build_tag)"
|
|
|
|
build-ubuntu-26.04: build-base-ubuntu-26.04
|
|
$(MISE_OCI) build \
|
|
--from "coderdev/oss-dogfood-base:26.04-local" \
|
|
--tag "codercom/oss-dogfood:26.04-$(build_tag)"
|
|
|
|
update-keys: update-keys-ubuntu-22.04 update-keys-ubuntu-26.04
|
|
|
|
update-keys-ubuntu-22.04:
|
|
./ubuntu-22.04/update-keys.sh
|
|
|
|
update-keys-ubuntu-26.04:
|
|
./ubuntu-26.04/update-keys.sh
|