c5db5aa39e
Split the build pipeline: one compile-services job builds all 8 service binaries with PVC-backed sccache, saves as artifacts. Then 9 Kaniko jobs just package pre-built binaries into slim runtime images (~30s each). Before: 9 parallel Kaniko jobs each doing full cargo build --release (~20min each, no sccache, 9x duplicated dep compilation) After: 1 compile job with sccache (~5min cached) + 9 package jobs (~30s) - Add compile stage between test and build - Add Dockerfile.runtime (minimal debian + pre-built binary) - Add Dockerfile.web-gateway-runtime (Node dashboard + pre-built binary) - Keep Dockerfile.training via Kaniko (needs CUDA dev image for H100) - Remove all SCCACHE_BUCKET build-args from service builds - Use dir:// context for Kaniko (only sends build-out/ dir, not full repo) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
32 lines
936 B
Docker
32 lines
936 B
Docker
# Minimal runtime image for pre-built Rust service binaries
|
|
# Binaries are compiled in CI (with PVC sccache) and passed via build context
|
|
# Usage: docker build --build-arg SERVICE=trading_service -f Dockerfile.runtime .
|
|
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
libssl3 \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install grpc_health_probe for Kubernetes health checks
|
|
RUN curl -fsSL https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.25/grpc_health_probe-linux-amd64 \
|
|
-o /usr/local/bin/grpc_health_probe \
|
|
&& chmod +x /usr/local/bin/grpc_health_probe
|
|
|
|
RUN groupadd -g 1000 foxhunt \
|
|
&& useradd -u 1000 -g foxhunt -m -s /bin/false foxhunt
|
|
|
|
ARG SERVICE
|
|
ENV SERVICE=${SERVICE}
|
|
|
|
WORKDIR /app
|
|
|
|
COPY ${SERVICE} ./${SERVICE}
|
|
RUN chmod +x ./${SERVICE}
|
|
|
|
USER foxhunt
|
|
|
|
ENTRYPOINT ["/bin/sh", "-c", "exec /app/${SERVICE}"]
|