I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
development
| 1 | # Guest image for GitHub Actions jobs that run in a microVM. It holds the pinned Actions runner |
| 2 | # and the tools most workflows call. The runner starts from a just-in-time configuration that |
| 3 | # arrives with the job, takes one job and exits, so the image holds no credentials and no |
| 4 | # registration state. |
| 5 | # |
| 6 | # Two targets share one base: |
| 7 | # |
| 8 | # actions-runner runner, git, node, pnpm, jq, gh (the default) |
| 9 | # actions-runner-qa the above plus browsers, a virtual display and tauri-driver |
| 10 | # |
| 11 | # docker build --target actions-runner -t actions-runner packaging/actions-runner |
| 12 | # docker build --target actions-runner-qa -t actions-runner-qa packaging/actions-runner |
| 13 | # |
| 14 | # The image has to boot systemd: the microVM's init and its guest agent are units. See README.md |
| 15 | # for turning the image into a root filesystem. |
| 16 | |
| 17 | ARG BASE=ubuntu:24.04 |
| 18 | |
| 19 | # tauri-driver is cargo-only; build it here and copy the binary so the guest has no Rust. |
| 20 | FROM rust:1-bookworm AS tauri-driver |
| 21 | RUN cargo install tauri-driver --locked --root /out |
| 22 | |
| 23 | FROM ${BASE} AS actions-runner |
| 24 | |
| 25 | LABEL org.opencontainers.image.source=https://github.com/getsigit/sigit \ |
| 26 | org.opencontainers.image.description="Guest image for GitHub Actions jobs in a microVM" |
| 27 | |
| 28 | ARG RUNNER_VERSION=2.338.2 |
| 29 | # sha256 of actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz, from the release notes. |
| 30 | ARG RUNNER_SHA256=baebf204307bac6193480852732f0aba2ae97b6c5597c244f4d5558390147c40 |
| 31 | ARG NODE_VERSION=24.12.0 |
| 32 | # sha256 of node-v${NODE_VERSION}-linux-x64.tar.xz, from SHASUMS256.txt in the same dist directory. |
| 33 | ARG NODE_SHA256=bdebee276e58d0ef5448f3d5ac12c67daa963dd5e0a9bb621a53d1cefbc852fd |
| 34 | ARG PNPM_VERSION=10.34.9 |
| 35 | |
| 36 | ENV DEBIAN_FRONTEND=noninteractive |
| 37 | |
| 38 | # Init, the packages the guest agent and the host tooling need (python3, git, CA certificates, |
| 39 | # zlib), and the usual build tools. |
| 40 | RUN apt-get update \ |
| 41 | && apt-get install -y --no-install-recommends \ |
| 42 | systemd systemd-sysv dbus iproute2 \ |
| 43 | ca-certificates zlib1g python3 git curl jq unzip xz-utils zstd \ |
| 44 | build-essential pkg-config libssl-dev openssh-client sudo \ |
| 45 | && rm -rf /var/lib/apt/lists/* |
| 46 | |
| 47 | # The GitHub CLI, from its apt repository. |
| 48 | RUN install -d -m 0755 /etc/apt/keyrings \ |
| 49 | && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \ |
| 50 | -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \ |
| 51 | && echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \ |
| 52 | > /etc/apt/sources.list.d/github-cli.list \ |
| 53 | && apt-get update \ |
| 54 | && apt-get install -y --no-install-recommends gh \ |
| 55 | && rm -rf /var/lib/apt/lists/* |
| 56 | |
| 57 | # Node from nodejs.org, checked against its published digest, then pnpm at an exact version. |
| 58 | RUN set -eu; \ |
| 59 | curl -fsSL --retry 2 -o /tmp/node.tar.xz \ |
| 60 | "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"; \ |
| 61 | echo "${NODE_SHA256} /tmp/node.tar.xz" | sha256sum -c -; \ |
| 62 | tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1; \ |
| 63 | rm /tmp/node.tar.xz; \ |
| 64 | npm install -g "pnpm@${PNPM_VERSION}" |
| 65 | |
| 66 | # The Actions runner, checked against the published digest, with its system dependencies. The |
| 67 | # runner refuses to start as root unless RUNNER_ALLOW_RUNASROOT is set; the host sets it, since |
| 68 | # the guest has a single user and the VM lives for one job. |
| 69 | RUN set -eu; \ |
| 70 | mkdir -p /opt/actions-runner; \ |
| 71 | curl -fsSL --retry 2 -o /tmp/runner.tar.gz \ |
| 72 | "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz"; \ |
| 73 | echo "${RUNNER_SHA256} /tmp/runner.tar.gz" | sha256sum -c -; \ |
| 74 | tar -xzf /tmp/runner.tar.gz -C /opt/actions-runner; \ |
| 75 | rm /tmp/runner.tar.gz; \ |
| 76 | /opt/actions-runner/bin/installdependencies.sh; \ |
| 77 | rm -rf /var/lib/apt/lists/*; \ |
| 78 | test -x /opt/actions-runner/run.sh |
| 79 | |
| 80 | WORKDIR /workspace |
| 81 | |
| 82 | FROM actions-runner AS actions-runner-qa |
| 83 | |
| 84 | LABEL org.opencontainers.image.description="Guest image for GitHub Actions jobs in a microVM, with browsers" |
| 85 | |
| 86 | # Must match the consumer's @playwright/test. A job's `playwright install` is a no-op when it |
| 87 | # does and a browser download when it doesn't, and visual baselines are only stable against the |
| 88 | # browsers they were recorded with. |
| 89 | ARG PLAYWRIGHT_VERSION=1.64.1 |
| 90 | |
| 91 | ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright |
| 92 | |
| 93 | # Tauri runtime on Linux (AppImage under tauri-driver) and a virtual display. |
| 94 | RUN apt-get update \ |
| 95 | && apt-get install -y --no-install-recommends \ |
| 96 | xvfb libwebkit2gtk-4.1-0 webkit2gtk-driver bubblewrap \ |
| 97 | && rm -rf /var/lib/apt/lists/* |
| 98 | |
| 99 | # Browsers and their system libraries and fonts, at the pinned Playwright version. |
| 100 | RUN npx -y "playwright@${PLAYWRIGHT_VERSION}" install --with-deps chromium webkit \ |
| 101 | && chmod -R a+rX /ms-playwright \ |
| 102 | && rm -rf /var/lib/apt/lists/* |
| 103 | |
| 104 | COPY --from=tauri-driver /out/bin/tauri-driver /usr/local/bin/tauri-driver |