bb0bca274c
Some checks failed
CI/CD / lint (push) Successful in 44s
CI/CD / typecheck (push) Successful in 1m21s
CI/CD / test (push) Successful in 1m11s
CI/CD / build (push) Successful in 1m28s
CI/CD / publish-rpm (push) Failing after 43s
CI/CD / publish-deb (push) Successful in 1m4s
The arm64 image build died at the iPXE compile: under podman multi-arch builds the stage runs once per TARGET platform, and the iPXE toolchain (gcc/perl build system) does not survive qemu-user emulation. The stage already cross-compiles both bin-x86_64-efi and bin-arm64-efi outputs in one pass, so it only ever needs to run natively on the build host — FROM --platform=$BUILDPLATFORM restores the arm64 image without qemu touching the iPXE build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V6HNx6cyr4J4CiMGCy1wkF
96 lines
3.3 KiB
Docker
96 lines
3.3 KiB
Docker
# Dockerfile.bastion -- PXE boot server (dnsmasq DHCP/TFTP + HTTP)
|
|
# Requires host networking and NET_ADMIN/NET_RAW capabilities.
|
|
|
|
# ── Stage 1: Build ───────────────────────────────────────────────
|
|
FROM node:22-alpine AS builder
|
|
|
|
RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config and package manifests first (layer cache)
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json tsconfig.json ./
|
|
COPY src/shared/package.json src/shared/tsconfig.json src/shared/
|
|
COPY src/bastion/package.json src/bastion/tsconfig.json src/bastion/
|
|
COPY src/cli/package.json src/cli/tsconfig.json src/cli/
|
|
COPY src/modules/package.json src/modules/tsconfig.json src/modules/
|
|
|
|
# Install all dependencies (dev included -- needed for build)
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source code
|
|
COPY src/shared/src/ src/shared/src/
|
|
COPY src/bastion/src/ src/bastion/src/
|
|
COPY src/cli/src/ src/cli/src/
|
|
COPY src/modules/src/ src/modules/src/
|
|
COPY src/modules/modules/ src/modules/modules/
|
|
|
|
# Build TypeScript
|
|
RUN pnpm build
|
|
|
|
# ── Stage 1b: Build iPXE snp.efi (uses UEFI SNP protocol for ISO boot) ──
|
|
# Pinned to the build platform: this stage cross-compiles BOTH arch outputs
|
|
# itself, and the iPXE toolchain does not survive qemu-user emulation.
|
|
FROM --platform=$BUILDPLATFORM fedora:43 AS ipxe-builder
|
|
|
|
RUN dnf install -y git gcc make perl-interpreter xz-devel gcc-aarch64-linux-gnu && dnf clean all
|
|
RUN git clone --depth=1 https://github.com/ipxe/ipxe.git /tmp/ipxe
|
|
RUN cd /tmp/ipxe/src && make bin-x86_64-efi/snp.efi && \
|
|
make CROSS_COMPILE=aarch64-linux-gnu- bin-arm64-efi/snp.efi
|
|
|
|
# ── Stage 2: Production runtime (Fedora -- needs dnsmasq) ───────
|
|
FROM fedora:43
|
|
|
|
RUN dnf install -y \
|
|
dnsmasq \
|
|
ipxe-bootimgs-x86 \
|
|
ipxe-bootimgs-aarch64 \
|
|
iproute \
|
|
curl \
|
|
openssh-clients \
|
|
nodejs \
|
|
npm \
|
|
xorriso \
|
|
mtools \
|
|
&& dnf clean all
|
|
|
|
# iPXE snp.efi built from source (Fedora only ships snponly, which can't
|
|
# boot from CD-ROM/USB -- it requires PXE chainloading)
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-x86_64-efi/snp.efi /usr/share/ipxe/ipxe-snp-x86_64.efi
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-arm64-efi/snp.efi /usr/share/ipxe/arm64-efi/ipxe-snp.efi
|
|
|
|
# Install pnpm
|
|
RUN npm install -g pnpm@9
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config and package manifests
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
|
|
COPY src/shared/package.json src/shared/
|
|
COPY src/bastion/package.json src/bastion/
|
|
COPY src/cli/package.json src/cli/
|
|
COPY src/modules/package.json src/modules/
|
|
|
|
# Install production dependencies
|
|
RUN pnpm install --frozen-lockfile --prod 2>/dev/null || pnpm install --prod
|
|
|
|
# Copy built output from builder
|
|
COPY --from=builder /app/src/shared/dist/ src/shared/dist/
|
|
COPY --from=builder /app/src/bastion/dist/ src/bastion/dist/
|
|
COPY --from=builder /app/src/cli/dist/ src/cli/dist/
|
|
COPY --from=builder /app/src/modules/dist/ src/modules/dist/
|
|
|
|
# Create data directories
|
|
RUN mkdir -p /data/state /data/tftp /data/http
|
|
|
|
ENV NODE_ENV=production
|
|
ENV BASTION_DIR=/data
|
|
ENV HTTP_PORT=8080
|
|
|
|
EXPOSE 8080/tcp
|
|
EXPOSE 67/udp
|
|
EXPOSE 69/udp
|
|
EXPOSE 4011/udp
|
|
|
|
ENTRYPOINT ["node", "src/cli/dist/index.js", "init", "bastion", "standalone", "start", "--foreground"]
|