mirror of
https://github.com/Screenly/Anthias.git
synced 2026-06-10 09:08:09 -04:00
5e00c8ba25
* refactor(docker): drop celery image, restore base apt layer dedup
- Delete Dockerfile.celery.j2; compose now runs celery on the
anthias-server image with a `command:` override.
- Make viewer extend Dockerfile.base.j2 (mirroring test); drop 17
packages duplicated between viewer and base_apt_dependencies, plus
4 within-list duplicates.
- Move `# syntax=docker/dockerfile:1.4` to line 1 of every rendered
Dockerfile. It previously lived in uv-builder.j2 line 1 and got
bumped mid-file for server by the bun-builder prelude, silently
disabling the 1.4 frontend and breaking cache-key parity with
viewer — the actual blocker for layer dedup.
- Collapse CI matrix from (board × service) to (board) so all
services for a board build on the same runner with the same
buildkit cache, producing byte-identical apt layer digests at the
registry.
- Add ENV DJANGO_SETTINGS_MODULE to the server image so the merged
image runs both server and celery CMDs.
- Update all five compose templates (prod, balena prod, balena dev,
dev, test) to redirect anthias-celery at the server image with a
command: override. dev compose pins an explicit `image:` tag so
both services share the locally-built SHA.
- Remove old anthias-celery / srly-ose-celery containers in
upgrade_containers.sh so the recreated container can take the name.
Verified end-to-end on x86: server and viewer apt layers share a
single digest; SHARED SIZE jumps from 132 MB to 1.216 GB; merged
image runs both workloads in compose (celery task round-trips
through Redis to SUCCESS).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* perf(docker): cache buildkit layers in GHCR registry across CI runs
Add a --cache-backend / $BUILDX_CACHE_BACKEND option to
tools.image_builder with two modes:
- `local` (default): writes to /tmp/.buildx-cache/<board>/.
Unchanged from before; right for local dev.
- `registry`: pushes BuildKit cache to
ghcr.io/screenly/anthias-<service>:buildcache-<board>. Reuses the
GHCR login already done by docker-build.yaml, no extra tokens or
third-party actions needed.
Wire CI to use registry mode on push events (master) so subsequent
runs of the same board pull cached layers — the ~825 MB extracted
apt install per service goes from ~3 min cold to a few seconds
warm. workflow_dispatch on a non-master branch falls back to local
mode (effectively no-cache) so manual runs can't pollute the master
cache.
Drop the old actions/cache@v5 step that mirrored
/tmp/.buildx-cache/<board> through actions/cache — registry cache
is per-step rather than one big tarball, so it survives the GitHub
Actions cache 10 GB-per-repo eviction better.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(image-builder): move local cache out of /tmp to user XDG cache dir
SonarCloud python:S5443 flagged the previous /tmp/.buildx-cache/
default as a security hotspot — `/tmp` is world-writable, so on a
multi-user host another account could in principle tamper with the
buildkit cache. Switch to $XDG_CACHE_HOME/anthias-buildx/<board>/
(default ~/.cache/anthias-buildx/), which is per-user by default
and follows XDG Base Directory convention.
CI is unaffected: docker-build.yaml uses --cache-backend=registry
on push events, which pushes cache to GHCR and never touches the
local path. Local dev users with stale state in
/tmp/.buildx-cache/<board>/ can rm it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(docker): correct cache-backend comments to match real behavior
Two doc fixes per Copilot review on #2776:
- tools/image_builder/__main__.py: the cache-backend rationale
block still referenced /tmp/.buildx-cache/<board>; update to
$XDG_CACHE_HOME/anthias-buildx/<board> so it matches the
implementation moved in 529a50e0.
- .github/workflows/docker-build.yaml: the env comment claimed
pull-request builds read from the registry cache, but this
workflow has no pull_request trigger — non-push runs are
workflow_dispatch, which both falls through to local cache and
skips `docker login ghcr.io`, so it has no GHCR auth at all.
Rewrite the comment around the push / workflow_dispatch split
the code actually implements.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(docker): address Copilot review on registry cache + test compose
- tools/image_builder/__main__.py: comment in the registry-cache
branch said the cache namespace was "picked from the build's tag
list", but the implementation hardcodes
ghcr.io/screenly/anthias-{service}. Rewrite the comment to
describe what the code actually does and call out the hardcode
so a future namespaces refactor doesn't silently break cache.
- docker-compose.test.yml: anthias-celery had its own `build:`
block pointing at Dockerfile.test, claiming "reuses the test
image" — but compose builds two separate images per service
even with identical context, defeating the dedup intent. Mirror
the docker-compose.dev.yml pattern: pin anthias-test to an
explicit `image: anthias-test:dev` tag and have anthias-celery
reference the same tag with no `build:`. Also bind-mount the
source into celery so it picks up code changes (matches
anthias-test's existing volume).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(image-builder): read-only registry cache without --push
Per Copilot review: --cache-backend=registry previously tried to
push cache to ghcr.io/... regardless of --push, so a local invocation
without GHCR auth would fail mid-build with a confusing registry
error. Split the behavior:
- Reads (cache_from) are always set when registry mode is active —
the anthias-* GHCR packages are public, so warm-starting off CI's
cache without auth works and helps local dev.
- Writes (cache_to) only happen when --push is also set, since
that's when the workflow has authenticated to GHCR. Without
--push, log a yellow warning and skip cache_to.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(docker): set DJANGO_SETTINGS_MODULE in test image for celery worker
Per Copilot review on #2776 (suppressed-due-to-low-confidence note,
but the bug is real): docker-compose.test.yml runs the celery
worker from anthias-test:dev. celery_tasks.py calls django.setup()
at module import time, which needs DJANGO_SETTINGS_MODULE in the
environment. The pre-refactor Dockerfile.celery.j2 set it
explicitly; this PR moved that ENV to Dockerfile.server.j2 only,
so the production celery (running on the server image) is fine but
the test celery would have crashed with ImproperlyConfigured.
Set the same ENV in Dockerfile.test.j2. Server and test images
both ship a usable Django environment for any process that imports
anthias_django.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
# vim: ft=yaml.docker-compose
|
|
|
|
services:
|
|
anthias-server:
|
|
# Explicit image tag so anthias-celery below can reference the same
|
|
# built image without a duplicate `build:` block (which would
|
|
# produce a separate, byte-identical-but-distinct image tag).
|
|
image: anthias-server:dev
|
|
build:
|
|
context: .
|
|
dockerfile: docker/Dockerfile.server
|
|
ports:
|
|
- 8000:8080
|
|
environment:
|
|
- HOME=/data
|
|
- LISTEN=0.0.0.0
|
|
- CELERY_BROKER_URL=redis://redis:6379/0
|
|
- CELERY_RESULT_BACKEND=redis://redis:6379/0
|
|
- ENVIRONMENT=development
|
|
depends_on:
|
|
- redis
|
|
restart: always
|
|
volumes:
|
|
- anthias-data:/data
|
|
- ./:/usr/src/app/
|
|
|
|
anthias-celery:
|
|
# Reuses anthias-server:dev via the explicit image tag above.
|
|
# Compose builds anthias-server first (it owns the build:) and
|
|
# this service inherits the same image, only overriding CMD.
|
|
image: anthias-server:dev
|
|
depends_on:
|
|
anthias-server:
|
|
condition: service_started
|
|
redis:
|
|
condition: service_started
|
|
command: >
|
|
celery -A celery_tasks.celery worker -B -n worker@anthias
|
|
--loglevel=info --schedule /tmp/celerybeat-schedule
|
|
environment:
|
|
- HOME=/data
|
|
- CELERY_BROKER_URL=redis://redis:6379/0
|
|
- CELERY_RESULT_BACKEND=redis://redis:6379/0
|
|
- ENVIRONMENT=development
|
|
restart: always
|
|
volumes:
|
|
- anthias-data:/data
|
|
- ./:/usr/src/app/
|
|
|
|
redis:
|
|
platform: "linux/amd64"
|
|
image: redis:alpine
|
|
|
|
volumes:
|
|
anthias-data:
|
|
redis-data:
|