68b6aa8313
Full migration off Scaleway Container Registry to internal GitLab registry backed by MinIO S3. All 4 images (ci-builder, ci-builder-cpu, foxhunt-runtime, foxhunt-training-runtime) rebuilt in internal registry. Registry & images: - All image refs → gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ - imagePullSecrets: scw-registry → gitlab-registry - Kaniko build template: two-step DAG (git-clone → kaniko-build) with shared PVC - Kaniko layer cache enabled at root/foxhunt/cache - AWS_ACCESS_KEY_ID: $SCW_ACCESS_KEY → $MINIO_ACCESS_KEY in .gitlab-ci.yml Network policies: - ci-pipeline: add HTTP/80, registry/5000, webservice/8181 egress rules DNS & Tailscale proxy cleanup: - Remove ci, prometheus, monitor DNS records (no longer exposed) - Rename s3 → minio DNS record - Remove Argo UI, Prometheus, monitor nginx server blocks - Remove argo-htpasswd volume mount - Tailscale proxy nodeSelector: infra → platform Terraform cleanup: - Delete infra/modules/registry/ (SCW CR namespace) - Delete infra/modules/object-storage/ (SCW S3 buckets) - Delete infra/modules/secrets/ (SCW secrets) - Delete corresponding live configs - TF state backend: S3 → GitLab HTTP Argo workflows: - Add events/ (GitLab push eventsource + ci-pipeline sensor) - ci-pipeline + training templates: SCW → internal registry - Delete obsolete compile-training-template.yaml Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
106 lines
3.5 KiB
Docker
106 lines
3.5 KiB
Docker
# Foxhunt devcontainer — extends CI builder with interactive dev tooling
|
|
# Built by CI, pushed to GitLab registry as devcontainer:latest
|
|
# See: docs/plans/2026-02-25-devcontainer-design.md
|
|
|
|
ARG CI_BUILDER_IMAGE=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/ci-builder:latest
|
|
FROM ${CI_BUILDER_IMAGE}
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Dev tooling: Node.js 22 (Claude Code), Python 3, shell tools
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 \
|
|
python3-pip \
|
|
python3-venv \
|
|
zsh \
|
|
sudo \
|
|
openssh-server \
|
|
git-lfs \
|
|
jq \
|
|
ripgrep \
|
|
fd-find \
|
|
htop \
|
|
less \
|
|
vim \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node.js 22 LTS (Claude Code runtime)
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
|
&& apt-get install -y nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Claude Code CLI
|
|
RUN npm install -g @anthropic-ai/claude-code
|
|
|
|
# kubectl
|
|
RUN curl -fsSL "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
|
-o /usr/local/bin/kubectl \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
# helm
|
|
RUN curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
|
|
|
# scw CLI (Scaleway)
|
|
RUN curl -fsSL https://github.com/scaleway/scaleway-cli/releases/latest/download/scaleway-cli_linux_amd64 \
|
|
-o /usr/local/bin/scw \
|
|
&& chmod +x /usr/local/bin/scw
|
|
|
|
# glab (GitLab CLI)
|
|
RUN curl -fsSL "https://gitlab.com/gitlab-org/cli/-/releases/permalink/latest/downloads/glab_linux_amd64.deb" \
|
|
-o /tmp/glab.deb \
|
|
&& dpkg -i /tmp/glab.deb \
|
|
&& rm /tmp/glab.deb
|
|
|
|
# terraform
|
|
RUN curl -fsSL https://releases.hashicorp.com/terraform/1.11.2/terraform_1.11.2_linux_amd64.zip \
|
|
-o /tmp/terraform.zip \
|
|
&& unzip -o /tmp/terraform.zip -d /usr/local/bin \
|
|
&& rm /tmp/terraform.zip
|
|
|
|
# terragrunt
|
|
RUN curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v0.72.6/terragrunt_linux_amd64 \
|
|
-o /usr/local/bin/terragrunt \
|
|
&& chmod +x /usr/local/bin/terragrunt
|
|
|
|
# yq (YAML processor)
|
|
RUN curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
|
|
-o /usr/local/bin/yq \
|
|
&& chmod +x /usr/local/bin/yq
|
|
|
|
# Non-root dev user with sudo
|
|
RUN groupadd -g 1000 dev \
|
|
&& useradd -m -u 1000 -g dev -s /bin/zsh dev \
|
|
&& echo "dev ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/dev
|
|
|
|
# Install oh-my-zsh for dev user
|
|
RUN su - dev -c 'sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended'
|
|
|
|
# Move Rust toolchain to shared location so dev user can access it
|
|
# (CI builder installs to /root/.cargo and /root/.rustup)
|
|
RUN cp -a /root/.cargo /opt/cargo \
|
|
&& cp -a /root/.rustup /opt/rustup \
|
|
&& chown -R dev:dev /opt/cargo /opt/rustup
|
|
|
|
# Environment for dev user
|
|
ENV CARGO_HOME=/home/dev/.cargo
|
|
ENV RUSTUP_HOME=/opt/rustup
|
|
ENV PATH="/home/dev/.cargo/bin:/opt/rustup/bin:/opt/cargo/bin:${PATH}"
|
|
ENV SQLX_OFFLINE=true
|
|
ENV CUDA_COMPUTE_CAP=90
|
|
|
|
# sccache local disk cache (PVC-backed home dir)
|
|
ENV SCCACHE_DIR=/home/dev/.cache/sccache
|
|
ENV RUSTC_WRAPPER=/usr/local/bin/sccache
|
|
|
|
# First-run init script: copies cargo bins to home if not already present
|
|
COPY .devcontainer/init-home.sh /usr/local/bin/init-home.sh
|
|
RUN chmod +x /usr/local/bin/init-home.sh
|
|
|
|
USER dev
|
|
WORKDIR /workspace
|
|
|
|
# Verify key tools
|
|
RUN rustc --version && cargo --version && node --version && claude --version \
|
|
&& kubectl version --client 2>/dev/null && helm version --short \
|
|
&& terraform --version && terragrunt --version && scw version && glab --version
|