36 lines
1.4 KiB
Docker
36 lines
1.4 KiB
Docker
# w4c-workflows — one image, two entrypoints:
|
|
# - api : control plane (default entrypoint)
|
|
# - worker : per-tenant execution worker (override command with ["--worker"])
|
|
#
|
|
# The worker sandbox needs node, python and esbuild at runtime. The C# executor
|
|
# (Roslyn) ships inside the published app as a NuGet package — no SDK needed in
|
|
# the runtime image. Build on the SDK image and copy the app into the runtime.
|
|
FROM mcr.microsoft.com/dotnet/sdk:11.0-preview AS build
|
|
WORKDIR /src
|
|
COPY *.csproj .
|
|
RUN dotnet restore
|
|
COPY . .
|
|
RUN dotnet publish -c Release -o /app
|
|
|
|
FROM mcr.microsoft.com/dotnet/aspnet:11.0-preview
|
|
WORKDIR /app
|
|
COPY --from=build /app .
|
|
|
|
# Worker sandbox runtimes: python3 + node + esbuild. The api image does not
|
|
# strictly need them, but keeping them makes the image a true drop-in worker.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends python3 nodejs npm ca-certificates git \
|
|
&& npm install -g esbuild \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Run as an unprivileged user (defense-in-depth: the container is the sandbox
|
|
# boundary and subprocess/Roslyn execute as this user). /tmp stays world-writable
|
|
# for the TypeScript executor's esbuild bundle; the workflow code checkout is
|
|
# mounted read-only (see compose) and only read, never written.
|
|
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin appuser
|
|
USER appuser
|
|
|
|
EXPOSE 5259
|
|
ENV ASPNETCORE_URLS=http://+:5259
|
|
ENTRYPOINT ["dotnet", "w4c-workflows-api.dll"]
|