149da9b763
* feat: make nsjail available in all standard images (CE) Include nsjail binary and runtime deps in the main Dockerfile and DockerfileSlim so sandboxing is available out of the box. Flip DISABLE_NSJAIL default to false so nsjail is enabled by default. Remove DockerfileNsjail (now redundant) and the build_ee_nsjail CI job, pointing publish_ecr_s3 at the base EE image instead. Add iptables to DockerfileFullEe to preserve the functionality from the removed nsjail image. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * revert: keep DISABLE_NSJAIL default as true Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: pin publish_ecr_s3 to exact commit hash Add type=sha tag to build_ee so it pushes a commit-pinned image tag. Restore git hash lookup in publish_ecr_s3 to reference the exact image for that commit, avoiding race conditions with the mutable dev tag. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: publish_ecr_s3 depends on build_ee_full, uses release tag Only publish to S3 on tag releases, extracting static frontend from the ee-full image using the semver tag. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: remove stale windmill-ee-nsjail references, add nsjail to EE slim The windmill-ee-nsjail image is no longer published since DockerfileNsjail was deleted. Update all references to use the base EE image (which now includes nsjail), remove redundant nsjail deps from DockerfileExtra, and add nsjail build to DockerfileSlimEe for consistency with CE slim. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
65 lines
1.9 KiB
Docker
65 lines
1.9 KiB
Docker
# Dockerfile for Windmill DAP Debug Service
|
|
#
|
|
# This containerizes the unified debug service with support for:
|
|
# - TypeScript/Bun debugging
|
|
# - Python debugging
|
|
# - Automatic dependency installation via windmill CLI
|
|
# - Optional nsjail sandboxing
|
|
#
|
|
# Build:
|
|
# docker build -t windmill-debugger .
|
|
#
|
|
# Run:
|
|
# docker run -p 5679:5679 windmill-debugger
|
|
#
|
|
# With nsjail enabled:
|
|
# docker run -p 5679:5679 --privileged windmill-debugger --nsjail
|
|
|
|
# Stage 1: Get nsjail and windmill from the official windmill EE image
|
|
FROM ghcr.io/windmill-labs/windmill-ee:main AS windmill-source
|
|
|
|
# Stage 2: Build the debug service
|
|
FROM oven/bun:1 AS runtime
|
|
|
|
# Install Python and required system dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 \
|
|
python3-pip \
|
|
python3-venv \
|
|
libprotobuf-dev \
|
|
libnl-route-3-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Python dependencies for the debug server
|
|
RUN pip3 install --break-system-packages websockets debugpy
|
|
|
|
# Copy nsjail binary and its dependencies from windmill image
|
|
COPY --from=windmill-source /bin/nsjail /bin/nsjail
|
|
COPY --from=windmill-source /etc/nsjail/ /etc/nsjail/
|
|
|
|
# Copy windmill binary for prepare-deps functionality
|
|
COPY --from=windmill-source /usr/src/app/windmill /usr/local/bin/windmill
|
|
|
|
# Create app directory
|
|
WORKDIR /app
|
|
|
|
# Copy the debug service files
|
|
COPY dap_debug_service.ts .
|
|
COPY dap_websocket_server_bun.ts .
|
|
COPY dap_websocket_server.py .
|
|
|
|
# Expose the default port
|
|
EXPOSE 5679
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD curl -f http://localhost:5679/health || exit 1
|
|
|
|
# Default environment variables
|
|
ENV HOST=0.0.0.0
|
|
ENV PORT=5679
|
|
|
|
# Run the unified debug service with windmill path for autoinstall
|
|
ENTRYPOINT ["bun", "run", "dap_debug_service.ts", "--windmill", "/usr/local/bin/windmill"]
|
|
CMD ["--host", "0.0.0.0", "--port", "5679"]
|