cd36825ad4
Some checks failed
CI/CD / lint (push) Successful in 1m15s
CI/CD / typecheck (push) Successful in 1m18s
CI/CD / test (push) Successful in 2m20s
CI/CD / build (push) Successful in 2m31s
CI/CD / publish-rpm (push) Failing after 28s
CI/CD / publish-deb (push) Successful in 26s
snponly.efi rides the firmware's NII/UNDI stack, and on some NICs that stack cannot receive unicast frames: DHCP (broadcast) succeeds, then every ARP reply is lost and the boot.ipxe HTTP fetch times out. Observed on thebeast's onboard NIC 2026-10-19 -- tcpdump on labmaster showed it answering every ARP request within microseconds while iPXE re-asked for ten seconds and gave up. The full build probes native NIC drivers first and falls back to snp/nii, so hardware that worked before is unaffected. The data dir is a persistent volume, so copy-if-missing would have kept serving the old snponly binary forever; image-shipped binaries now replace on content change (copyIfChanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DceLLgGmyS7zTGLaLNjQBd
105 lines
4.0 KiB
Docker
105 lines
4.0 KiB
Docker
# Dockerfile.bastion -- PXE boot server (dnsmasq DHCP/TFTP + HTTP)
|
|
# Requires host networking and NET_ADMIN/NET_RAW capabilities.
|
|
|
|
# ── Stage 1: Build ───────────────────────────────────────────────
|
|
FROM node:22-alpine AS builder
|
|
|
|
RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config and package manifests first (layer cache)
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json tsconfig.json ./
|
|
COPY src/shared/package.json src/shared/tsconfig.json src/shared/
|
|
COPY src/bastion/package.json src/bastion/tsconfig.json src/bastion/
|
|
COPY src/cli/package.json src/cli/tsconfig.json src/cli/
|
|
COPY src/modules/package.json src/modules/tsconfig.json src/modules/
|
|
|
|
# Install all dependencies (dev included -- needed for build)
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy source code
|
|
COPY src/shared/src/ src/shared/src/
|
|
COPY src/bastion/src/ src/bastion/src/
|
|
COPY src/cli/src/ src/cli/src/
|
|
COPY src/modules/src/ src/modules/src/
|
|
COPY src/modules/modules/ src/modules/modules/
|
|
|
|
# Build TypeScript
|
|
RUN pnpm build
|
|
|
|
# ── Stage 1b: Build iPXE snp.efi (uses UEFI SNP protocol for ISO boot) ──
|
|
# Pinned to the build platform: this stage cross-compiles BOTH arch outputs
|
|
# itself, and the iPXE toolchain does not survive qemu-user emulation.
|
|
FROM --platform=$BUILDPLATFORM fedora:43 AS ipxe-builder
|
|
|
|
RUN dnf install -y git gcc make perl-interpreter xz-devel gcc-aarch64-linux-gnu && dnf clean all
|
|
RUN git clone --depth=1 https://github.com/ipxe/ipxe.git /tmp/ipxe
|
|
RUN cd /tmp/ipxe/src && make bin-x86_64-efi/snp.efi bin-x86_64-efi/ipxe.efi && \
|
|
make CROSS_COMPILE=aarch64-linux-gnu- bin-arm64-efi/snp.efi
|
|
|
|
# ── Stage 2: Production runtime (Fedora -- needs dnsmasq) ───────
|
|
FROM fedora:43
|
|
|
|
RUN dnf install -y \
|
|
dnsmasq \
|
|
ipxe-bootimgs-x86 \
|
|
ipxe-bootimgs-aarch64 \
|
|
iproute \
|
|
curl \
|
|
openssh-clients \
|
|
nodejs \
|
|
npm \
|
|
xorriso \
|
|
mtools \
|
|
&& dnf clean all
|
|
|
|
# iPXE snp.efi built from source (Fedora only ships snponly, which can't
|
|
# boot from CD-ROM/USB -- it requires PXE chainloading)
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-x86_64-efi/snp.efi /usr/share/ipxe/ipxe-snp-x86_64.efi
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-arm64-efi/snp.efi /usr/share/ipxe/arm64-efi/ipxe-snp.efi
|
|
# Full iPXE build (native NIC drivers + snp + nii fallback), served as the
|
|
# default UEFI x86_64 PXE binary. snponly rides the firmware's NII/UNDI stack,
|
|
# and on some NICs that stack cannot RECEIVE UNICAST frames: DHCP (broadcast)
|
|
# works, then every ARP reply is lost and HTTP times out. Observed on
|
|
# thebeast's onboard NIC 2026-10-19 (tcpdump: labmaster answered every ARP
|
|
# request within microseconds, iPXE kept re-asking). A native driver bypasses
|
|
# the firmware stack entirely; NICs without one still fall back to snp/nii,
|
|
# so machines that worked before are unaffected.
|
|
COPY --from=ipxe-builder /tmp/ipxe/src/bin-x86_64-efi/ipxe.efi /usr/share/ipxe/ipxe-full-x86_64.efi
|
|
|
|
# Install pnpm
|
|
RUN npm install -g pnpm@9
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace config and package manifests
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
|
|
COPY src/shared/package.json src/shared/
|
|
COPY src/bastion/package.json src/bastion/
|
|
COPY src/cli/package.json src/cli/
|
|
COPY src/modules/package.json src/modules/
|
|
|
|
# Install production dependencies
|
|
RUN pnpm install --frozen-lockfile --prod 2>/dev/null || pnpm install --prod
|
|
|
|
# Copy built output from builder
|
|
COPY --from=builder /app/src/shared/dist/ src/shared/dist/
|
|
COPY --from=builder /app/src/bastion/dist/ src/bastion/dist/
|
|
COPY --from=builder /app/src/cli/dist/ src/cli/dist/
|
|
COPY --from=builder /app/src/modules/dist/ src/modules/dist/
|
|
|
|
# Create data directories
|
|
RUN mkdir -p /data/state /data/tftp /data/http
|
|
|
|
ENV NODE_ENV=production
|
|
ENV BASTION_DIR=/data
|
|
ENV HTTP_PORT=8080
|
|
|
|
EXPOSE 8080/tcp
|
|
EXPOSE 67/udp
|
|
EXPOSE 69/udp
|
|
EXPOSE 4011/udp
|
|
|
|
ENTRYPOINT ["node", "src/cli/dist/index.js", "init", "bastion", "standalone", "start", "--foreground"]
|