opsx
396df57c9c
1. -trimpath（抹除源码绝对路径）
- Dockerfile: go build 加 -trimpath
- run.sh: 两处 go build 加 -trimpath
效果：二进制内 /app/backend/ 绝对路径命中 66 → 0（module 相对路径 sql-platform/ 仍保留，
那是 Go 的正常行为，-trimpath 只去绝对前缀）
2. 镜像
- kubernetes/deployment.yaml: opsxsql:latest → lghost/opsxsql:latest
- kubernetes/install.sh: 默认 IMAGE 改 lghost/opsxsql:latest
- 已构建并推送：lghost/opsxsql:latest (digest 70562a408cae, 25.2MB)
3. K8s 部署验证（namespace: sql）
- Deployment opsxsql 1/1 Running，0 重启
- Pod: opsxsql-695444d6b9-chrzp (node 172.19.0.161)
- Service opsxsql.sql.svc.cluster.local:80
- PVC opsxsql-data Bound 10Gi (cbs)
- Secret opsxsql-secrets 自动生成（SECRET_KEY / JWT_SECRET）
- /health → {"backend":"go","status":"ok","version":"0.4.0"}
- 首页正常，seed 完成（26 条审核规则 + LDAP 默认配置）
部署命令：bash kubernetes/install.sh
92 lines
3.4 KiB
Docker
92 lines
3.4 KiB
Docker
# ============================================================
|
||
# opsxsql - 单镜像多阶段构建(参照 opsx-loki)
|
||
# 前端 dist + Go 后端 + gh-ost 合并为一个 alpine 运行时镜像
|
||
# 非 root 用户运行;/health 健康检查;数据落 /app/data 卷
|
||
# ============================================================
|
||
|
||
# ---------------------------------------------------------------
|
||
# Stage 1: 前端构建(Node)
|
||
# ---------------------------------------------------------------
|
||
FROM node:20-alpine AS frontend-builder
|
||
WORKDIR /app/frontend
|
||
COPY frontend/package*.json ./
|
||
RUN npm ci --ignore-scripts && npm cache clean --force
|
||
COPY frontend/ ./
|
||
RUN npm run build
|
||
|
||
# ---------------------------------------------------------------
|
||
# Stage 2: 后端构建(Go,CGO 因 mattn/go-sqlite3 必开)
|
||
# ---------------------------------------------------------------
|
||
FROM golang:1.26-alpine AS backend-builder
|
||
RUN apk add --no-cache git gcc musl-dev
|
||
ENV GOTOOLCHAIN=local
|
||
WORKDIR /app/backend
|
||
COPY backend/go.* ./
|
||
RUN go mod download
|
||
COPY backend/ ./
|
||
RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/opsxsql ./cmd/server/
|
||
|
||
# ---------------------------------------------------------------
|
||
# Stage 3: gh-ost 在线变更工具(静态二进制,按架构取包)
|
||
#
|
||
# 注意：GitHub release 的实际 asset 名不是 gh-ost-linux-<arch>，而是：
|
||
# amd64: gh-ost （裸二进制，18MB）
|
||
# arm64: gh-ost-binary-linux-arm64-<ts>.tar.gz（tar 包）
|
||
# ---------------------------------------------------------------
|
||
FROM alpine:3.20 AS ghost
|
||
ARG TARGETARCH
|
||
ARG GH_OST_VER=v1.1.9
|
||
ARG GH_OST_ARM64_ASSET=gh-ost-binary-linux-arm64-20260501022029.tar.gz
|
||
RUN mkdir -p /out && \
|
||
apk add --no-cache curl tar && \
|
||
case "${TARGETARCH}" in \
|
||
arm64) \
|
||
curl -fsSL -o /tmp/gh.tgz \
|
||
"https://github.com/github/gh-ost/releases/download/${GH_OST_VER}/${GH_OST_ARM64_ASSET}" && \
|
||
tar -xzf /tmp/gh.tgz -C /tmp && \
|
||
mv /tmp/gh-ost-binary-linux-arm64-* /out/gh-ost ;; \
|
||
*) \
|
||
curl -fsSL -o /out/gh-ost \
|
||
"https://github.com/github/gh-ost/releases/download/${GH_OST_VER}/gh-ost" ;; \
|
||
esac && \
|
||
chmod +x /out/gh-ost && \
|
||
ls -lh /out/gh-ost
|
||
|
||
# ---------------------------------------------------------------
|
||
# Stage 4: 运行时镜像
|
||
# ---------------------------------------------------------------
|
||
FROM alpine:3.20
|
||
RUN apk --no-cache add ca-certificates tzdata wget sqlite && \
|
||
rm -rf /tmp/* /var/cache/apk/*
|
||
|
||
# 非 root 用户
|
||
RUN addgroup -g 1000 opsxsql && \
|
||
adduser -u 1000 -G opsxsql -s /bin/sh -D opsxsql
|
||
|
||
WORKDIR /app
|
||
COPY --from=backend-builder --chown=opsxsql:opsxsql /out/opsxsql ./opsxsql
|
||
COPY --from=ghost --chown=opsxsql:opsxsql /out/gh-ost /usr/local/bin/gh-ost
|
||
COPY --from=frontend-builder --chown=opsxsql:opsxsql /app/frontend/dist ./dist
|
||
|
||
RUN mkdir -p /app/data && chown -R opsxsql:opsxsql /app/data && \
|
||
chmod +x ./opsxsql
|
||
|
||
ENV DIST_DIR=/app/dist \
|
||
DB_PATH=/app/data/sqlite3.db \
|
||
PORT=9000 \
|
||
DEBUG=false \
|
||
GH_OST_PATH=/usr/local/bin/gh-ost \
|
||
HOME=/home/opsxsql
|
||
|
||
COPY --chown=opsxsql:opsxsql docker-entrypoint.sh /usr/local/bin/
|
||
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
||
|
||
USER opsxsql
|
||
EXPOSE 9000
|
||
VOLUME ["/app/data"]
|
||
|
||
HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=15s \
|
||
CMD wget --no-verbose --tries=1 --spider http://localhost:9000/health || exit 1
|
||
|
||
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|