mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 00:02:23 +00:00
Ruben Fiszel
fefa8e438d
Swap the final-stage nsjail dependencies (libprotobuf-dev, libnl-route-3-dev) for their runtime-only counterparts (libprotobuf32, libnl-route-3-200, libnl-3-200) across the root Dockerfile, DockerfileSlim, and DockerfileSlimEe. nsjail is already compiled in the build stage, so the final image only needs the runtime shared libraries. This shrinks the images and reduces CVE scan noise from unused dev packages. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
112 lines
3.9 KiB
Plaintext
112 lines
3.9 KiB
Plaintext
ARG DEBIAN_IMAGE=debian:bookworm-slim
|
|
|
|
FROM debian:bookworm-slim AS nsjail
|
|
|
|
WORKDIR /nsjail
|
|
|
|
RUN apt-get -y update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
bison=2:3.8.* \
|
|
ca-certificates \
|
|
flex=2.6.* \
|
|
g++=4:12.2.* \
|
|
gcc=4:12.2.* \
|
|
git=1:2.39.* \
|
|
libprotobuf-dev=3.21.* \
|
|
libnl-route-3-dev=3.7.* \
|
|
make=4.3-4.1 \
|
|
pkg-config=1.8.* \
|
|
protobuf-compiler=3.21.* \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN git clone -b master --single-branch https://github.com/google/nsjail.git . && git checkout dccf911fd2659e7b08ce9507c25b2b38ec2c5800
|
|
RUN make
|
|
|
|
FROM ${DEBIAN_IMAGE}
|
|
|
|
ARG APP=/usr/src/app
|
|
ARG LATEST_STABLE_PY=3.12.12
|
|
|
|
# UV configuration
|
|
ENV UV_CACHE_DIR=/tmp/windmill/cache/uv
|
|
ENV UV_PYTHON_INSTALL_DIR=/tmp/windmill/cache/py_runtime
|
|
ENV UV_PYTHON_PREFERENCE=only-managed
|
|
RUN mkdir -p /usr/local/uv
|
|
ENV UV_TOOL_BIN_DIR=/usr/local/bin
|
|
ENV UV_TOOL_DIR=/usr/local/uv
|
|
ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
|
|
|
|
# Install system dependencies
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30 libgcrypt20 \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install latest PostgreSQL client (pg_dump) from official PostgreSQL apt repository
|
|
RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor -o /usr/share/keyrings/postgresql-archive-keyring.gpg \
|
|
&& echo "deb [signed-by=/usr/share/keyrings/postgresql-archive-keyring.gpg] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends postgresql-client \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV TZ=Etc/UTC
|
|
|
|
# Install UV
|
|
RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.9.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
|
|
|
|
# Preinstall python runtime to temp location (will copy with world-writable perms later)
|
|
RUN UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install $LATEST_STABLE_PY
|
|
|
|
# Copy to final location with world-writable permissions for arbitrary UID support
|
|
RUN mkdir -p /tmp/windmill/cache && \
|
|
cp -r /tmp/build_cache/* /tmp/windmill/cache/ && \
|
|
chmod -R a+rw /tmp/windmill/cache && \
|
|
rm -rf /tmp/build_cache && \
|
|
mkdir -p -m 777 /tmp/windmill/cache/uv
|
|
|
|
COPY --from=oven/bun:1.3.10 /usr/local/bin/bun /usr/bin/bun
|
|
|
|
# Install windmill CLI (node symlink needed for bun install)
|
|
RUN ln -s /usr/bin/bun /usr/bin/node \
|
|
&& bun install -g windmill-cli \
|
|
&& ln -s $(bun pm bin -g)/wmill /usr/bin/wmill
|
|
|
|
# Install Claude Code CLI (used by claude sandbox scripts)
|
|
# Copy to /usr/bin/claude so it's accessible inside nsjail sandbox (which mounts /usr but not /root)
|
|
RUN curl -fsSL https://claude.ai/install.sh | bash \
|
|
&& cp /root/.local/share/claude/versions/* /usr/bin/claude
|
|
|
|
# add the docker client to call docker from a worker if enabled
|
|
COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/
|
|
|
|
# nsjail runtime deps and binary
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \
|
|
&& apt-get clean && rm -rf /var/lib/apt/lists/*
|
|
COPY --from=nsjail /nsjail/nsjail /bin/nsjail
|
|
|
|
WORKDIR ${APP}
|
|
|
|
COPY --from=ghcr.io/windmill-labs/windmill:dev --chmod=755 ${APP}/windmill ${APP}/windmill
|
|
|
|
RUN ln -s ${APP}/windmill /usr/local/bin/windmill
|
|
|
|
COPY ./frontend/src/lib/hubPaths.json ${APP}/hubPaths.json
|
|
|
|
RUN windmill cache ${APP}/hubPaths.json
|
|
|
|
RUN rm ${APP}/hubPaths.json
|
|
|
|
RUN windmill cache-rt
|
|
|
|
# Create directories and make world-accessible for arbitrary UID support
|
|
RUN mkdir -p -m 777 /tmp/windmill/logs /tmp/windmill/search /tmp/.cache && \
|
|
chmod 777 /tmp/.cache && \
|
|
find ${APP} /tmp/windmill -type d -exec chmod 777 {} +
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["windmill"]
|