mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Ruben Fiszel
7e649604db
* fix: make /usr/bin/coursier self-contained so java jobs work air-gapped Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: smoke-test the coursier assembly at build time Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
85 lines
4.2 KiB
Plaintext
85 lines
4.2 KiB
Plaintext
FROM alpine:3.14 AS oracledb-client
|
|
|
|
ARG TARGETPLATFORM
|
|
|
|
# Oracle DB Client for amd64
|
|
COPY --from=ghcr.io/oracle/oraclelinux9-instantclient:23 /usr/lib/oracle/23/client64/lib /opt/oracle/23/amd64/lib
|
|
|
|
# Oracle DB Client for arm64
|
|
RUN mkdir -p /opt/oracle/23/arm64 \
|
|
&& cd /opt/oracle/23/arm64 \
|
|
&& wget https://download.oracle.com/otn_software/linux/instantclient/2326100/instantclient-basiclite-linux.arm64-23.26.1.0.0.zip \
|
|
&& unzip instantclient-basiclite-linux.arm64-23.26.1.0.0.zip && rm instantclient-basiclite-linux.arm64-23.26.1.0.0.zip && mv instantclient* ./lib
|
|
|
|
RUN if [ "$TARGETPLATFORM" = "linux/arm64" ]; then \
|
|
mv /opt/oracle/23/arm64/lib /opt/oracle/23/lib; \
|
|
else \
|
|
mv /opt/oracle/23/amd64/lib /opt/oracle/23/lib; \
|
|
fi
|
|
|
|
FROM ghcr.io/windmill-labs/windmill-ee:dev
|
|
|
|
# Rust
|
|
COPY --from=rust:1.97.0 /usr/local/cargo /usr/local/cargo
|
|
COPY --from=rust:1.97.0 /usr/local/rustup /usr/local/rustup
|
|
RUN RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo /usr/local/cargo/bin/cargo install cargo-sweep --version ^0.7
|
|
|
|
# Ansible
|
|
# UV_PYTHON_INSTALL_DIR defaults to /tmp/windmill/cache/py_runtime, which is an
|
|
# ephemeral runtime cache (fresh volume/tmpfs, and pruned by the worker). Installing
|
|
# ansible there leaves its venv interpreter as a dangling symlink at runtime, so every
|
|
# ansible-* executable fails with ENOENT ("ansible-galaxy not found"). Pin the tool's
|
|
# interpreter to a persistent image path so the install stays self-contained.
|
|
RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
|
|
# dotnet SDK
|
|
RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
|
|
&& chmod +x dotnet-install.sh \
|
|
&& ./dotnet-install.sh --channel 9.0 --install-dir /usr/share/dotnet \
|
|
&& ln -s /usr/share/dotnet/dotnet /usr/bin/dotnet \
|
|
&& rm dotnet-install.sh
|
|
|
|
# Oracle DB Client
|
|
COPY --from=oracledb-client /opt/oracle/23/lib /opt/oracle/23/lib
|
|
# libaio1t64 only ships libaio.so.1t64; Oracle instantclient loads libaio.so.1, so add a compat symlink
|
|
RUN apt-get -y update && apt-get install -y libaio1t64 \
|
|
&& libaio="$(find /usr/lib -name 'libaio.so.1t64' -print -quit)" \
|
|
&& ln -s "$(basename "$libaio")" "$(dirname "$libaio")/libaio.so.1"
|
|
RUN echo /opt/oracle/23/lib > /etc/ld.so.conf.d/oracle-instantclient.conf && ldconfig
|
|
|
|
# Nushell
|
|
COPY --from=ghcr.io/nushell/nushell:0.101.0-bookworm /usr/bin/nu /usr/bin/nu
|
|
|
|
# Java
|
|
RUN apt-get -y update && apt-get install -y default-jdk
|
|
ARG COURSIER_VERSION=2.1.24
|
|
# The released coursier launcher downloads its own JARs from Maven Central on first run, so java
|
|
# jobs break on air-gapped networks; a build-time cache pre-warm cannot fix that because the cache
|
|
# the worker reads lives under WINDMILL_DIR, which deployments mount over. Hence a self-contained
|
|
# assembly, smoke-tested below: `about` must succeed and leave the cache it is given empty.
|
|
RUN curl -fLo /tmp/coursier-launcher https://github.com/coursier/coursier/releases/download/v${COURSIER_VERSION}/coursier \
|
|
&& COURSIER_CACHE=/tmp/coursier-build-cache /usr/bin/java -jar /tmp/coursier-launcher \
|
|
bootstrap io.get-coursier:coursier-cli_2.13:${COURSIER_VERSION} --assembly -o /usr/bin/coursier \
|
|
&& chmod +x /usr/bin/coursier \
|
|
&& mkdir -p /tmp/coursier-verify \
|
|
&& COURSIER_CACHE=/tmp/coursier-verify /usr/bin/java -jar /usr/bin/coursier about \
|
|
&& [ -z "$(ls -A /tmp/coursier-verify)" ] \
|
|
&& rm -rf /tmp/coursier-launcher /tmp/coursier-build-cache /tmp/coursier-verify /root/.cache/coursier
|
|
|
|
# Ruby
|
|
RUN apt-get install -y ruby ruby-bundler
|
|
|
|
# R
|
|
RUN apt-get install -y r-base-dev \
|
|
&& Rscript -e 'install.packages("renv", lib="/usr/lib/R/library", repos="https://cloud.r-project.org")'
|
|
|
|
# iptables
|
|
RUN apt-get install -y iptables
|
|
|
|
# Kerberos runtime
|
|
RUN apt-get install -y libsasl2-modules-gssapi-mit krb5-user
|
|
|
|
# Fix UV cache permissions for non-root user support (uid 1000, etc.)
|
|
# The uv tool install ansible command populates the UV cache with root-owned files
|
|
RUN chmod -R a+rw /tmp/windmill/cache/uv && \
|
|
find /tmp/windmill/cache/uv -type d -exec chmod 777 {} +
|