flyemoji
659c8e5e9f
deploy/bootstrap.sh now resolves the newest published GitHub release, downloads
the binary CI built for that tag, and builds a thin image around it. Compiling
on the target host becomes the fallback and the opt-in, not the default.
The panel is not a separate artifact. The Dockerfile copies panel/dist into
internal/panel/static before the go build, so the control plane — panel and
backend — ships as ONE file. The release channel therefore downloads exactly
one asset, felis-linux-<arch>, and needs no registry, no Go toolchain and no
checkout on the host.
The Minecraft game stack (limbo, lobby, the Velocity plugin) is still always
built locally. game_stack_source now keys on HAVE_PREBUILT_BINARY — the same
flag build_image uses — so on any prebuilt path it unpacks the tar embedded in
that binary instead of trusting a checkout an earlier install left behind.
Trusting the checkout would build the plugin from an old commit against a
freshly downloaded control plane: a silent version skew across the plugin/API
boundary.
Channels:
(default) newest published release, downloaded
FELIS_VERSION_BOOTSTRAP=dev clone main and compile
FELIS_REF=<ref> pins the tree, forces the source path
The download is best-effort. A tag whose assets are not uploaded yet, an
architecture with no published asset, or an asset that fails validation each
warn and fall back to compiling THE SAME TAG from source — never a different
commit.
The ref is resolved right after install_base, the first point curl exists and
well before docker and k3s, so a missing FELIS_GITHUB_TOKEN or an unpublished
release costs the operator seconds instead of a k3s install they then have to
unwind. It is skipped on exactly the paths that never consume the result: the
TUI, which rebuilds the binary it is already running, and FELIS_SKIP_FETCH,
which builds whatever is staged. Resolving anyway would set FELIS_VERSION to
the newest tag and stamp a staged tree as that release.
The asset is staged next to HOST_BIN rather than in TMPDIR. Validation EXECUTES
it, and /tmp is noexec on CIS-hardened images, where the exec dies 126, the
check reads it as a bad asset, and every such host silently falls back to the
full on-host compile this path exists to avoid. It also keeps a private-repo
artifact out of a world-readable 1777 directory.
git_auth, which supplies the token to git for a private-repo clone, passes an EMPTY
credential.helper before the inline one. credential.helper is multi-valued: a bare
`-c credential.helper=...` APPENDS to whatever the host has configured rather than
replacing it, and an empty value is git's documented list reset. Without it, on a host
with a persistent helper (Git for Windows ships `manager` at SYSTEM scope) two things
go wrong. Git runs `credential approve` automatically after a successful clone and
feeds every helper in the list, so a `store` helper writes the PAT to
~/.git-credentials in cleartext — the token outlives the install, in a file bootstrap
never created and never cleans up. And because the inline helper is LAST, a
pre-existing helper answers `fill` first, so a stale cached credential can win and the
clone authenticates as the wrong account — surfacing as exactly the 404-on-private-repo
the surrounding code works hard to explain. Reproduced both against a real clone, and
confirmed the reset closes both.
internal/panel parses the new stamp. The dev channel now emits "<tag>+g<sha>", which
matched neither describeSuffix ("-N-g<sha>") nor releaseTag, so a dev build fell through
to the default case and the version badge rendered the entire stamp as the release with
no commit. A devSuffix case handles it; the git-describe case stays for hand-rolled
`-ldflags "-X main.version=$(git describe)"` builds. Table test covers both forms plus
the release, dirty and unstamped cases.
CRD application no longer branches on the install path: it is always
`felis bootstrap-assets crd`. That output is byte-identical to deploy/crd/ —
bootstrap_asset.go embeds that very file — and needs no checkout, so one source
replaces a branch whose two arms had to be kept in agreement by hand.
Dockerfile gains a FELIS_VERSION build arg wired into -X main.version, declared
after `go mod download` so a version bump does not invalidate that layer. Both
build stages are pinned to $BUILDPLATFORM so a multi-platform buildx run never
emulates them: the panel's output is architecture-independent and the Go stage
cross-compiles via TARGETARCH. The final stage stays on the target platform and
is COPY-only, which BuildKit performs without QEMU.
.github/workflows/release.yml publishes on a vX.Y.Z tag: vet, tests, then one
buildx run producing both architectures through the repo Dockerfile. Not a bare
`go build` — internal/panel/static holds a tracked placeholder index.html so the
//go:embed compiles without node, which means a direct build succeeds and
quietly ships a release whose panel is that placeholder.
The stamp is asserted end to end, because it fails silently: an unstamped binary
reports "dev", which the updater refuses to compare, disabling update reporting
for every install built from that release. The arm64 artifact is checked by ELF
machine type rather than by running it — runners have binfmt registered, so
executing an amd64 binary misnamed arm64 would succeed.
Prerelease tags are flagged explicitly. The trigger glob is v*, gh does not read
semver out of a tag name, and an RC published as a full release becomes
/releases/latest — the single endpoint the default channel installs from and
`felis update` polls.
No SHA256SUMS. A checksum fetched over the same TLS session, with the same
credential, from the same host as the binary adds no trust root; signing is the
real answer and is a separate decision.
Not verified: the download -> validate -> image -> k3s path has never run on a
host against a real published release, because no tag exists yet. The shell
logic around it is verified out of tree; the network and exec behaviour is not.
66 lines
3.5 KiB
Docker
66 lines
3.5 KiB
Docker
# Felis control-plane image.
|
|
#
|
|
# Builds the panel, then the single multi-call `felis` binary (api / operator /
|
|
# migrate / reaper / restore / manifests / setup) as a static, CGO-free
|
|
# executable and ships it on a distroless base. Two contracts the rendered
|
|
# Deployments depend on:
|
|
#
|
|
# 1. The binary lives at /usr/local/bin/felis, and rendered Kubernetes
|
|
# workloads invoke that absolute path rather than relying on PATH lookup.
|
|
# 2. The image is meant to be imported into a local containerd (k3s ctr import)
|
|
# and referenced by a NON-:latest tag (e.g. felis:demo). k8s then resolves
|
|
# the default IfNotPresent pull policy against the imported image instead of
|
|
# trying to pull it from a registry that does not exist yet.
|
|
#
|
|
# deploy/bootstrap.sh also extracts this same binary onto the host (docker cp)
|
|
# so `felis migrate up` and the `felis setup` TUI run with the identical build.
|
|
|
|
# Both BUILD stages are pinned to the BUILDPLATFORM so a multi-platform buildx run never
|
|
# emulates them: the panel's output is plain JS and identical on every architecture, and the
|
|
# Go stage cross-compiles natively via TARGETARCH below. Under QEMU an `npm ci` alone costs
|
|
# minutes. The FINAL stage is deliberately NOT pinned — it must stay on the target platform
|
|
# or the published arm64 image would carry amd64 layers. It contains only COPY, which
|
|
# BuildKit performs itself, so it needs no QEMU either; adding a RUN there would.
|
|
FROM --platform=$BUILDPLATFORM node:22-bookworm AS panel
|
|
WORKDIR /panel
|
|
COPY panel/package*.json ./
|
|
RUN npm ci
|
|
COPY panel/ ./
|
|
RUN npm run build
|
|
|
|
FROM --platform=$BUILDPLATFORM golang:1.26 AS build
|
|
WORKDIR /src
|
|
ARG TARGETOS=linux
|
|
ARG TARGETARCH
|
|
# Prime the module cache first so source-only edits do not re-download deps.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
COPY --from=panel /panel/dist ./internal/panel/static
|
|
# Declared HERE, not beside TARGETOS above: changing it invalidates every layer that
|
|
# follows, and the go mod download layer must survive a version bump.
|
|
#
|
|
# The stamp is what makes `felis version` and `felis update` mean anything — unstamped,
|
|
# main.version stays "dev" and the updater refuses to compare rather than treating it as
|
|
# 0.0.0. deploy/bootstrap.sh computes the value per channel; see the FELIS_VERSION_BOOTSTRAP
|
|
# block there for why the dev channel uses "+" build metadata and not `git describe`.
|
|
#
|
|
# The ${TARGETARCH:-...} fallback is a trap now that this stage is pinned to BUILDPLATFORM:
|
|
# `go env GOARCH` reports the BUILDER's architecture, so an empty TARGETARCH (a legacy
|
|
# `docker build`, or a setup-buildx step that quietly did not take) produces a working amd64
|
|
# binary that gets published under the arm64 name. .github/workflows/release.yml asserts the
|
|
# ELF machine type with file(1) for exactly this reason — an exec-based check cannot catch it,
|
|
# because CI runners have binfmt/QEMU registered and will happily run the wrong one.
|
|
ARG FELIS_VERSION=dev
|
|
RUN CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="${TARGETARCH:-$(go env GOARCH)}" \
|
|
go build -trimpath -ldflags="-s -w -X main.version=${FELIS_VERSION}" -o /out/felis ./cmd/felis
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
ENV PATH=/usr/local/bin:/usr/bin:/bin
|
|
COPY --chmod=0755 --from=build /out/felis /usr/local/bin/felis
|
|
# distroless "nonroot" is uid 65532; the rendered PodSecurityContext pins
|
|
# runAsUser 1000 at deploy time, and a static binary needs no /etc/passwd entry,
|
|
# so either uid runs the same binary from a read-only root filesystem.
|
|
USER 65532:65532
|
|
ENTRYPOINT ["/usr/local/bin/felis"]
|