Joseph McQueen
4f9ebdb5fb
The previous packager (scripts/packageDectRelayAgent.js) shipped a
source-only bundle and expected the DC host to build the image with
`docker compose up --build`. That fails hard in corporate DCs with
TLS-intercepted egress: Alpine's apk fetch of dl-cdn.alpinelinux.org
can't verify the intercepted certificate ("apk: TLS: server
certificate not trusted"), and npm install would fail the same way
if apk had succeeded.
New approach: build the image ONCE on the dev machine (where TLS
works), save it as a gzipped tarball, and ship a ZIP whose install
step is `docker load` + `docker compose up -d`. Zero network calls
inside the DC container, ever.
Bundling (dev-machine):
- dect-relay-agent/bundle.sh: build → docker save → gzip → zip.
Auto-derives version from package.json, records git sha + dirty
flag + build date into image labels. Cross-arch friendly
(--platform=linux/amd64 by default; --platform linux/arm64 for
ARM DCs). Output: dect-relay-agent-bundle-<YYYYMMDD-HHMMSS>.zip
at repo root (typically 40-60MB).
- dect-relay-agent/Dockerfile: multi-stage node:20-alpine build.
No apk add. No runtime npm install. Non-root `node` user (uid
1000). Node handles SIGTERM natively via index.js handlers, so
no tini/dumb-init needed. Designed to build from the REPO ROOT
(not the agent folder) because the agent imports shared modules
from ../integrations/cisco-dect and ../utils.
- dect-relay-agent/Dockerfile.dockerignore: per-Dockerfile ignore
(BuildKit ≥ 23.0) with a whitelist that keeps the build context
to ~50KB. Older Docker daemons fall through to the repo-root
.dockerignore, which already excludes secrets — nothing sensitive
can leak either way.
- package.json: `npm run package:relay` now invokes bundle.sh.
Runtime (DC-host):
- dect-relay-agent/docker-compose.yml: pins IMAGE_TAG from .env
(install.sh writes it there — never falls back to :latest), reads
the rest of the config via env_file, restart: unless-stopped,
host networking (needed to reach 10.x/8 without userland proxy
translation, and the agent doesn't listen on anything). Hardened:
read_only: true rootfs with a 16MB /tmp tmpfs, cap_drop: ALL,
no-new-privileges, log rotation at 10MB × 5 files.
- dect-relay-agent/install.sh: preflight (docker + compose present,
daemon reachable, bundle files intact), docker load, pin loaded
tag into .env, validate .env has the three required values not
still set to placeholder strings, docker compose up -d, tail last
40 log lines. Idempotent — safe to re-run on upgrades.
Cleanup:
- scripts/packageDectRelayAgent.js: deleted (superseded).
- .gitignore: drops the scripts/* + !packageDectRelayAgent.js dance
since we no longer need to whitelist that one file; add pattern
for the datestamped bundle zips + staging dirs at repo root.
- dect-relay-agent/README.md: replaces the deploy section with the
new dev-machine-build → DC-host-load workflow, plus a
troubleshooting section keyed on the exact error messages seen
during the failed in-DC build (TLS cert not trusted, docker perm
denied, DIGEST_401).
Verified: all 113 existing tests still pass. Docker build itself
requires a Docker daemon (dev machine) so can't be exercised in
this sandbox — the bash scripts pass `bash -n` syntax checks.
30 lines
1.1 KiB
Docker
30 lines
1.1 KiB
Docker
# Per-Dockerfile ignore, picked up by BuildKit ≥ 23.0 when this
|
|
# Dockerfile is used (see https://docs.docker.com/build/concepts/context/#filename-and-location).
|
|
# For older Docker daemons, the repo-root /.dockerignore is used
|
|
# instead (it already excludes node_modules, .env*, logs/, etc., so
|
|
# nothing sensitive would leak — this file is a size/speed win, not
|
|
# a security requirement).
|
|
#
|
|
# The build context is the REPO ROOT. We whitelist only the paths
|
|
# the Dockerfile actually COPYs. That keeps the transferred context
|
|
# tiny (a few dozen KB instead of the whole repo) and makes builds
|
|
# noticeably faster on slow disks / VPN uplinks.
|
|
|
|
*
|
|
|
|
# ─── Whitelist (paths the Dockerfile needs) ─────────────────────────
|
|
!dect-relay-agent/package.json
|
|
!dect-relay-agent/index.js
|
|
!integrations/cisco-dect/**
|
|
!utils/httpDigestAuth.js
|
|
|
|
# ─── Never-ship, even inside whitelisted trees ──────────────────────
|
|
**/node_modules
|
|
**/.env
|
|
**/.env.*
|
|
!**/.env.example
|
|
**/*.log
|
|
**/logs
|
|
**/.git
|
|
**/.DS_Store
|
|
**/coverage
|