mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
0d66cbaca1
- Enhanced Dockerfile with updated image labels and source. - Revised README to reflect changes in DSH Web architecture and deployment instructions. - Added Kubernetes sandbox template for DSH Web with security context and environment variables. - Updated .env.sample and CODEOWNERS for consistency. - Introduced multi-arch Docker build workflow for improved CI/CD.
107 lines
3.3 KiB
Docker
107 lines
3.3 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
ARG NODE_BUILD_IMAGE=docker.io/node:24-trixie
|
|
ARG NODE_RUNTIME_IMAGE=docker.io/node:24-trixie-slim
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build stage
|
|
# ---------------------------------------------------------------------------
|
|
FROM ${NODE_BUILD_IMAGE} AS build
|
|
|
|
ARG DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git
|
|
ARG DSH_VERSION=dsh-v0.2.1-rc.2
|
|
ARG PNPM_VERSION=11.28.5
|
|
|
|
ENV CI=true \
|
|
NODE_OPTIONS=--max-old-space-size=4096
|
|
|
|
RUN corepack enable \
|
|
&& corepack prepare "pnpm@${PNPM_VERSION}" --activate
|
|
|
|
WORKDIR /src
|
|
|
|
RUN git clone --depth 1 --branch "${DSH_VERSION}" "${DSH_REPO}" .
|
|
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
RUN pnpm run build
|
|
|
|
# ── Package the CLI with pnpm pack ───────────────────────────────────────
|
|
RUN mkdir -p /opt/dsh \
|
|
&& pnpm --filter @deepseek-ai/dsh pack \
|
|
--pack-destination /opt \
|
|
--config.ignore-scripts=true \
|
|
&& mv /opt/deepseek-ai-dsh-*.tgz /opt/dsh.tgz \
|
|
&& tar -xzf /opt/dsh.tgz -C /opt/dsh --strip-components=1 \
|
|
&& rm /opt/dsh.tgz
|
|
|
|
# ── Production install with npm ──────────────────────────────────────────
|
|
RUN cd /opt/dsh \
|
|
&& npm install --omit=dev --no-audit --no-fund \
|
|
&& test -f lib/bin.js \
|
|
&& node lib/bin.js web --help >/dev/null
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Runtime stage
|
|
# ---------------------------------------------------------------------------
|
|
FROM ${NODE_RUNTIME_IMAGE} AS runtime
|
|
|
|
ARG DSH_VERSION
|
|
|
|
LABEL org.opencontainers.image.title="DeepSeek Harness Web packaged by SREDevOps.org" \
|
|
org.opencontainers.image.version="${DSH_VERSION}" \
|
|
org.opencontainers.image.source="https://github.com/sredevopsorg/deepseek-kubernetes-sandbox"
|
|
|
|
ENV NODE_ENV=production \
|
|
HOME=/home/node \
|
|
DSH_HOME=/home/node/.dsh \
|
|
DSH_PORT=3080 \
|
|
PATH="/app/node_modules/.bin:${PATH}"
|
|
|
|
# git/ripgrep are useful for DSH agent tools; tini handles signals.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
git \
|
|
ripgrep \
|
|
tini \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& install -d -o node -g node -m 0755 /workspace "${DSH_HOME}"
|
|
|
|
COPY --from=build --chown=node:node /opt/dsh /app
|
|
|
|
COPY <<'EOF' /usr/local/bin/dsh-entrypoint
|
|
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${DSH_PORT:=3080}"
|
|
: "${DSH_HOST:=}"
|
|
DSH_PUBLIC_URL="${DSH_PUBLIC_URL-http://localhost:${DSH_PORT}}"
|
|
|
|
# DSH rejects wildcard hosts. Pick the container/pod's first non-loopback IPv4.
|
|
if [ -z "$DSH_HOST" ]; then
|
|
DSH_HOST="$(node -e 'const os=require("os"); const ifaces=Object.values(os.networkInterfaces()).flat(); const addr=ifaces.find(v=>v&&v.family==="IPv4"&&!v.internal); if(!addr){process.exit(1)} process.stdout.write(addr.address)')"
|
|
fi
|
|
|
|
if [ -n "$DSH_PUBLIC_URL" ]; then
|
|
set -- --public-url "$DSH_PUBLIC_URL" "$@"
|
|
fi
|
|
|
|
exec node /app/lib/bin.js web \
|
|
--no-open \
|
|
--host "$DSH_HOST" \
|
|
--port "$DSH_PORT" \
|
|
--trusted-host localhost \
|
|
--trusted-host 127.0.0.1 \
|
|
"$@"
|
|
EOF
|
|
|
|
RUN chmod 0755 /usr/local/bin/dsh-entrypoint
|
|
|
|
WORKDIR /workspace
|
|
USER node
|
|
|
|
EXPOSE 3080
|
|
VOLUME ["/home/node/.dsh"]
|
|
STOPSIGNAL SIGTERM
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dsh-entrypoint"] |