cameleer/cameleer-server
1
0
Fork 0
Code Issues 45 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2e2d069530afd2cd437e3fc84b2aad996c4ed5eb
cameleer-server/cameleer-runtime-loader/README.md

24 lines
905 B
Markdown
Raw Normal View History

feat(loader): add cameleer-runtime-loader image (busybox + entrypoint) Init container that fetches the deployable JAR from a signed URL into the shared /app/jars/ volume before the main runtime container starts. Pairs with the controller (Task 7) and DockerRuntimeOrchestrator (Task 10). - Dockerfile: busybox:1.37-musl, non-root USER (UID 1000) - entrypoint.sh: POSIX sh, set -eu, required env vars (ARTIFACT_URL, ARTIFACT_EXPECTED_SIZE), wget with retries/timeout, size verification - README: build instructions and runtime contract Smoke-tested locally (docker build + happy-path fetch + size-mismatch). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 15:51:01 +02:00
# cameleer-runtime-loader
Init container that fetches the deployable JAR into a shared volume before the
main runtime container starts. Pairs with `DockerRuntimeOrchestrator` /
(future) K8s init-container deploys.
## Build
ci(loader): build & push cameleer-runtime-loader image only when its sources change The init-container image referenced by DockerRuntimeOrchestrator (`gitea.siegeln.net/cameleer/cameleer-runtime-loader:latest`) had no CI producer; it had to be built and pushed by hand. Replicates the cameleer-saas pattern (single docker job with multiple buildx push steps), but gates the loader build on a path-diff so unrelated commits don't rebuild and re-tag a sidecar that didn't change. - build job: fetch-depth=0 + Detect runtime-loader changes step that diffs `${{ github.event.before }}..${{ github.sha }}` for paths under cameleer-runtime-loader/. Falls back to `changed=true` when no prior commit is reachable (first push to a branch). - docker job: new `Build and push runtime-loader` step gated on `needs.build.outputs.loader_changed == 'true'`. Tags with sha and latest/branch-<slug>, --provenance=false for Gitea, no buildcache (image is alpine + script). - Cleanup loops in docker and cleanup-branch jobs include the new package. - Rules and loader README updated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 23:13:25 +02:00
CI (`.gitea/workflows/ci.yml`, `docker` job) builds and pushes this image
automatically on pushes that change anything under `cameleer-runtime-loader/`.
Manual build for local testing:
feat(loader): add cameleer-runtime-loader image (busybox + entrypoint) Init container that fetches the deployable JAR from a signed URL into the shared /app/jars/ volume before the main runtime container starts. Pairs with the controller (Task 7) and DockerRuntimeOrchestrator (Task 10). - Dockerfile: busybox:1.37-musl, non-root USER (UID 1000) - entrypoint.sh: POSIX sh, set -eu, required env vars (ARTIFACT_URL, ARTIFACT_EXPECTED_SIZE), wget with retries/timeout, size verification - README: build instructions and runtime contract Smoke-tested locally (docker build + happy-path fetch + size-mismatch). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 15:51:01 +02:00
docker build -t gitea.siegeln.net/cameleer/cameleer-runtime-loader:<tag> .
docker push gitea.siegeln.net/cameleer/cameleer-runtime-loader:<tag>
## Contract
- Env: `ARTIFACT_URL` (signed download URL), `ARTIFACT_EXPECTED_SIZE` (bytes).
- Volume: writes `/app/jars/app.jar`.
- Exit 0 on success; non-zero on fetch/size failure.
- Runs as UID 1000 (loader user), drops all caps, read-only rootfs except `/app/jars`.
See `docs/superpowers/plans/2026-04-27-init-container-jar-fetch.md`.
Reference in New Issue Copy Permalink