mirror of
https://github.com/element-hq/synapse.git
synced 2026-05-17 22:55:32 +00:00
Olivier 'reivilibre
5c05b45abb
Download the MAS CLI binary in a multi-stage Dockerfile-workers build step and copy it into the final image. Add COPY directives to the Complement Dockerfile for MAS supervisord configs and the registration shim so they are available at container build time.
106 lines
4.7 KiB
Plaintext
106 lines
4.7 KiB
Plaintext
# syntax=docker/dockerfile:1-labs
|
|
|
|
ARG SYNAPSE_VERSION=latest
|
|
ARG FROM=matrixdotorg/synapse:$SYNAPSE_VERSION
|
|
ARG DEBIAN_VERSION=trixie
|
|
ARG PYTHON_VERSION=3.13
|
|
ARG REDIS_VERSION=7.2
|
|
|
|
# first of all, we create a base image with dependencies which we can copy into the
|
|
# target image. For repeated rebuilds, this is much faster than apt installing
|
|
# each time.
|
|
|
|
FROM ghcr.io/astral-sh/uv:python${PYTHON_VERSION}-${DEBIAN_VERSION} AS deps_base
|
|
|
|
ARG DEBIAN_VERSION
|
|
ARG REDIS_VERSION
|
|
|
|
# Tell apt to keep downloaded package files, as we're using cache mounts.
|
|
RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
|
|
|
|
# The upstream redis-server deb has fewer dynamic libraries than Debian's package which makes it easier to copy later on
|
|
RUN \
|
|
curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg && \
|
|
chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg && \
|
|
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb ${DEBIAN_VERSION} main" | tee /etc/apt/sources.list.d/redis.list
|
|
|
|
RUN \
|
|
--mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
apt-get update -qq && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
|
|
nginx-light \
|
|
redis-server="6:${REDIS_VERSION}.*" redis-tools="6:${REDIS_VERSION}.*" \
|
|
# libicu is required by postgres, see `docker/complement/Dockerfile`
|
|
libicu76
|
|
|
|
RUN \
|
|
# remove default page
|
|
rm /etc/nginx/sites-enabled/default && \
|
|
# have nginx log to stderr/out
|
|
ln -sf /dev/stdout /var/log/nginx/access.log && \
|
|
ln -sf /dev/stderr /var/log/nginx/error.log
|
|
|
|
# --link-mode=copy silences a warning as uv isn't able to do hardlinks between its cache
|
|
# (mounted as --mount=type=cache) and the target directory.
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv pip install --link-mode=copy --prefix="/uv/usr/local" supervisor~=4.2
|
|
|
|
RUN mkdir -p /uv/etc/supervisor/conf.d
|
|
|
|
# Download MAS CLI binary
|
|
FROM docker.io/library/debian:trixie AS mas_cli
|
|
RUN apt-get update -qq && apt-get install -yqq --no-install-recommends ca-certificates curl
|
|
ARG TARGETARCH
|
|
RUN mkdir -p /mas && \
|
|
if [ "$TARGETARCH" = "amd64" ]; then arch="x86_64"; elif [ "$TARGETARCH" = "arm64" ]; then arch="aarch64"; else arch="$TARGETARCH"; fi && \
|
|
curl -sL "https://github.com/element-hq/matrix-authentication-service/releases/latest/download/mas-cli-${arch}-linux.tar.gz" \
|
|
| tar xzC /mas
|
|
|
|
# now build the final image, based on the the regular Synapse docker image
|
|
FROM $FROM
|
|
|
|
# Copy over dependencies
|
|
COPY --from=deps_base --parents /usr/lib/*-linux-gnu/libicu* /
|
|
COPY --from=deps_base /usr/bin/redis-server /usr/local/bin
|
|
COPY --from=deps_base /uv /
|
|
COPY --from=deps_base /usr/sbin/nginx /usr/sbin
|
|
COPY --from=deps_base /usr/share/nginx /usr/share/nginx
|
|
COPY --from=deps_base /usr/lib/nginx /usr/lib/nginx
|
|
COPY --from=deps_base /etc/nginx /etc/nginx
|
|
COPY --from=deps_base /var/log/nginx /var/log/nginx
|
|
# chown to allow non-root user to write to http-*-temp-path dirs
|
|
COPY --from=deps_base --chown=www-data:root /var/lib/nginx /var/lib/nginx
|
|
|
|
# Copy MAS CLI (used when MAS=1 in Complement)
|
|
COPY --from=mas_cli /mas /mas
|
|
RUN chmod +x /mas/mas-cli
|
|
|
|
# Copy Synapse worker, nginx and supervisord configuration template files
|
|
COPY ./docker/conf-workers/* /conf/
|
|
|
|
# Copy a script to prefix log lines with the supervisor program name
|
|
COPY ./docker/prefix-log /usr/local/bin/
|
|
|
|
# Expose nginx listener port
|
|
EXPOSE 8080/tcp
|
|
# Metrics for workers are on ports starting from 19091 but since these are dynamic
|
|
# we don't expose them by default (metrics must be enabled with
|
|
# SYNAPSE_ENABLE_METRICS=1)
|
|
#
|
|
# Instead, we expose a single port used for Prometheus HTTP service discovery
|
|
# (`http://<synapse_container>:9469/metrics/service_discovery`) and proxy all of the
|
|
# workers' metrics endpoints through that
|
|
# (`http://<synapse_container>:9469/metrics/worker/<worker_name>`).
|
|
EXPOSE 9469/tcp
|
|
|
|
# A script to read environment variables and create the necessary
|
|
# files to run the desired worker configuration. Will start supervisord.
|
|
COPY ./docker/configure_workers_and_start.py /configure_workers_and_start.py
|
|
ENTRYPOINT ["/configure_workers_and_start.py"]
|
|
|
|
# Replace the healthcheck with one which checks *all* the workers. The script
|
|
# is generated by configure_workers_and_start.py.
|
|
HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
|
|
CMD ["/healthcheck.sh"]
|