added 260907 version of worker toolkit
This commit is contained in:
166
worker-toolkit-flaredown/explore/.devcontainer/Dockerfile
Normal file
166
worker-toolkit-flaredown/explore/.devcontainer/Dockerfile
Normal file
@@ -0,0 +1,166 @@
|
||||
# Explore container for flaredown — rubyforgood chronic-illness symptom tracker.
|
||||
# github.com/rubyforgood/Flaredown (GPL-3), pinned upstream at 5f859e8d. Polyglot, multi-service:
|
||||
# - backend/ Rails 7.1 API, Ruby 3.2.3. Mongoid 8.1 on MongoDB (primary store) + Postgres
|
||||
# (small relational slice) + Redis + Sidekiq.
|
||||
# - frontend/ Ember.js client, Node 14.21.3 (npm 7).
|
||||
# Adapted for live-mount: the source repo is bind-mounted at /workspace/repo; deps + DB set up
|
||||
# by post-create.sh, and the three datastores are started by post-start.sh.
|
||||
#
|
||||
# Deliberate version choice: docker-compose pins MongoDB 4.4.9, which is EOL and ships no
|
||||
# arm64 / Debian-bookworm packages. Mongoid 8.1.3 + the mongo ruby driver 2.20.1 support
|
||||
# servers up to 7.0, so we run MongoDB 7.0 (native amd64 + aarch64, no emulation) instead of
|
||||
# fighting a dead 4.4 build. Same wire protocol; the app is version-agnostic here.
|
||||
FROM ruby:3.2.3
|
||||
|
||||
# System deps: Postgres + libpq (the pg gem), Redis (Sidekiq), plus build tooling. python3
|
||||
# (bookworm ships 3.11 ≥ 3.10, which the reduced-toolset str_replace_editor needs). xz/curl/
|
||||
# gnupg for the Node + Mongo downloads. libyaml for psych.
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
postgresql postgresql-client libpq-dev \
|
||||
redis-server \
|
||||
build-essential pkg-config libyaml-dev \
|
||||
python3 \
|
||||
git sudo curl ca-certificates gnupg xz-utils procps \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# MongoDB 7.0 server binary (mongod) from the official tarball, arch-aware. The ubuntu2204
|
||||
# build (glibc 2.35) runs fine on bookworm (glibc 2.36). Only mongod is needed — Mongoid
|
||||
# connects over the wire; no mongosh required (post-start probes the port directly).
|
||||
RUN set -eux; \
|
||||
arch="$(dpkg --print-architecture)"; \
|
||||
case "$arch" in \
|
||||
amd64) marm=x86_64;; \
|
||||
arm64) marm=aarch64;; \
|
||||
*) echo "unsupported arch: $arch" >&2; exit 1;; \
|
||||
esac; \
|
||||
ver=7.0.14; \
|
||||
curl -fsSL "https://fastdl.mongodb.org/linux/mongodb-linux-${marm}-ubuntu2204-${ver}.tgz" -o /tmp/mongo.tgz; \
|
||||
tar -xzf /tmp/mongo.tgz -C /tmp; \
|
||||
cp /tmp/mongodb-linux-${marm}-ubuntu2204-${ver}/bin/mongod /usr/local/bin/; \
|
||||
rm -rf /tmp/mongo.tgz /tmp/mongodb-linux-*; \
|
||||
mongod --version | head -1
|
||||
|
||||
# Node via nvm: 18 (default — toolkit tooling: create-snapshot hooks, `node -e` reads of
|
||||
# toolkit.json) + 14 (the Ember app; frontend/.nvmrc = v14.21.3). Symlink v18 to /usr/local/bin
|
||||
# so the toolkit's own node always resolves; run-app switches PATH to v14 for the client.
|
||||
# The frontend's .npmrc sets engine-strict=true and its package.json requires npm 6.x, so pin
|
||||
# npm 6 in the v14 line (nvm's 14.21.3 otherwise bundles npm 7, which fails engine-strict). The
|
||||
# v18.* glob (not `nvm version`) avoids sourcing nvm.sh under Docker's /bin/sh (dash), bash-only.
|
||||
ENV NVM_DIR=/usr/local/nvm
|
||||
RUN mkdir -p "$NVM_DIR" \
|
||||
&& curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash \
|
||||
&& bash -c '. "$NVM_DIR/nvm.sh" \
|
||||
&& nvm install 18 \
|
||||
&& nvm install 14.21.3 && nvm use 14.21.3 && npm install -g npm@6.14.18 \
|
||||
&& nvm alias default 18' \
|
||||
&& for b in node npm npx; do ln -sf "$NVM_DIR"/versions/node/v18.*/bin/"$b" /usr/local/bin/"$b"; done \
|
||||
&& node --version
|
||||
|
||||
# phantomjs stub. The Ember client depends on phantomjs-prebuilt@2.1.16, which has NO arm64
|
||||
# binary and is EOL everywhere — its install script aborts `npm install` on Apple-Silicon
|
||||
# hosts. A stub on PATH that reports the expected version makes the install script treat
|
||||
# PhantomJS as "already installed" and skip the (impossible) download, so `npm install`
|
||||
# completes and `ember build`/`ember serve` (what run-app uses) work. `ember test` runs on
|
||||
# headless Chrome at this pin, wired up after the Playwright block below.
|
||||
RUN printf '#!/bin/bash\n[ "$1" = "--version" ] && { echo "2.1.1"; exit 0; }\nexit 0\n' > /usr/local/bin/phantomjs \
|
||||
&& chmod +x /usr/local/bin/phantomjs
|
||||
|
||||
# Match backend/Gemfile.lock "BUNDLED WITH 2.5.6".
|
||||
RUN gem install bundler -v 2.5.6
|
||||
|
||||
# Postgres trust auth: backend/config/database.yml connects as PG_DATABASE_USERNAME (default
|
||||
# postgres). OVERWRITE pg_hba.conf (Debian's default `local all all peer` is first-match, so
|
||||
# an appended trust rule never applies).
|
||||
RUN PG_VERSION=$(ls /etc/postgresql) \
|
||||
&& printf 'local all all trust\nhost all all 127.0.0.1/32 trust\nhost all all ::1/128 trust\nhost all all 0.0.0.0/0 trust\n' > "/etc/postgresql/${PG_VERSION}/main/pg_hba.conf" \
|
||||
&& echo "listen_addresses='*'" >> "/etc/postgresql/${PG_VERSION}/main/postgresql.conf"
|
||||
|
||||
USER root
|
||||
|
||||
# --- Playwright + Chromium, for driving the app in a real browser -------------
|
||||
# Self-contained under /opt — the member's own runtime is untouched.
|
||||
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright
|
||||
RUN apt-get update -qq \
|
||||
&& apt-get install -y -qq --no-install-recommends \
|
||||
xz-utils \
|
||||
libxcomposite1 \
|
||||
libxdamage1 \
|
||||
libxfixes3 \
|
||||
libxrandr2 \
|
||||
libasound2 \
|
||||
libatk1.0-0 \
|
||||
libatk-bridge2.0-0 \
|
||||
libatspi2.0-0 \
|
||||
libcups2 \
|
||||
libdbus-1-3 \
|
||||
libgbm1 \
|
||||
libnspr4 \
|
||||
libnss3 \
|
||||
libxkbcommon0 \
|
||||
libpango-1.0-0 \
|
||||
libcairo2 \
|
||||
libxshmfence1 \
|
||||
libx11-xcb1 \
|
||||
libxcb-dri3-0 \
|
||||
libdrm2 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
RUN set -eux; \
|
||||
arch="$(dpkg --print-architecture)"; \
|
||||
case "$arch" in amd64) nodearch=x64;; arm64) nodearch=arm64;; *) echo "unsupported arch: $arch" >&2; exit 1;; esac; \
|
||||
curl -fsSL "https://nodejs.org/dist/v20.19.5/node-v20.19.5-linux-${nodearch}.tar.xz" -o /tmp/pw-node.tar.xz; \
|
||||
mkdir -p /opt/pw-node; \
|
||||
tar -xJf /tmp/pw-node.tar.xz -C /opt/pw-node --strip-components=1; \
|
||||
rm /tmp/pw-node.tar.xz; \
|
||||
export npm_config_prefix=/opt/pw-node PATH="/opt/pw-node/bin:$PATH"; \
|
||||
/opt/pw-node/bin/npm install -g playwright@1.56.0; \
|
||||
test -d /opt/pw-node/lib/node_modules/playwright; \
|
||||
/opt/pw-node/bin/node /opt/pw-node/lib/node_modules/playwright/cli.js install chromium
|
||||
|
||||
# `pw <script.js>` runs Node with `require("playwright")` resolvable (CommonJS).
|
||||
RUN printf '#!/bin/sh\nNODE_PATH=/opt/pw-node/lib/node_modules exec /opt/pw-node/bin/node "$@"\n' > /usr/local/bin/pw \
|
||||
&& chmod +x /usr/local/bin/pw
|
||||
|
||||
# Fail the build if Chromium cannot start.
|
||||
RUN printf 'const{chromium}=require("playwright");(async()=>{const b=await chromium.launch();const p=await b.newPage();await p.setContent("<h1 id=t>ok</h1>");if(await p.textContent("#t")!=="ok")throw new Error("bad render");await b.close();console.log("chromium OK");})()\n' > /tmp/pw-check.js \
|
||||
&& pw /tmp/pw-check.js \
|
||||
&& rm -f /tmp/pw-check.js
|
||||
# `ember test` resolves its browser via CHROME_BIN, falling back to `google-chrome` on PATH
|
||||
# (frontend/testem.js). Point both at the Chromium Playwright just installed. The glob is
|
||||
# resolved at build time so a Playwright bump can't strand a hardcoded chromium-<build> path.
|
||||
RUN set -eux; \
|
||||
chrome="$(echo /opt/ms-playwright/chromium-*/chrome-linux/chrome)"; \
|
||||
test -x "$chrome"; \
|
||||
printf '#!/bin/bash\nexec %s --no-sandbox --disable-dev-shm-usage "$@"\n' "$chrome" \
|
||||
> /usr/local/bin/google-chrome; \
|
||||
chmod +x /usr/local/bin/google-chrome; \
|
||||
google-chrome --version
|
||||
ENV CHROME_BIN=/usr/local/bin/google-chrome
|
||||
|
||||
ENV IS_SANDBOX=1
|
||||
RUN mkdir -p /root/.claude && \
|
||||
echo '{"permissions":{"deny":["WebFetch","WebSearch"]}}' > /root/.claude/settings.json
|
||||
|
||||
# Startup for a direct `docker run` (the devcontainer path uses post-start.sh instead, which
|
||||
# starts the same services). Bring up Postgres + Redis + MongoDB, then hand off.
|
||||
RUN cat > /usr/local/bin/start-services.sh <<'EOF'
|
||||
#!/bin/bash
|
||||
set -e
|
||||
service postgresql start || true
|
||||
service redis-server start >/dev/null 2>&1 || redis-server --daemonize yes >/dev/null 2>&1 || true
|
||||
mkdir -p /data/db
|
||||
mongod --dbpath /data/db --bind_ip 127.0.0.1 --fork --logpath /tmp/mongod.log >/dev/null 2>&1 || true
|
||||
until pg_isready -h localhost -p 5432 -U postgres >/dev/null 2>&1; do sleep 0.5; done
|
||||
exec "$@"
|
||||
EOF
|
||||
RUN chmod +x /usr/local/bin/start-services.sh
|
||||
|
||||
WORKDIR /workspace/repo
|
||||
# Resolver for the DNS jail (.devcontainer/dns-jail-container.sh, applied by
|
||||
# post-start.sh); if this does not land, Explore just runs unjailed.
|
||||
RUN (command -v apk >/dev/null 2>&1 && apk add --no-cache dnsmasq bind-tools) \
|
||||
|| (apt-get update && apt-get install -y --no-install-recommends dnsmasq-base dnsutils \
|
||||
&& rm -rf /var/lib/apt/lists/*) \
|
||||
|| true
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/start-services.sh"]
|
||||
CMD ["sleep", "infinity"]
|
||||
Reference in New Issue
Block a user