conductor

Dockerfile.worker (2388B)

---

 # deploy/Dockerfile.worker - the worker
 #
 # Build from the repository root:
 #   docker build -f deploy/Dockerfile.worker -t finwo/conductor-worker .
 #
 # Alpine rather than the official node image, for the same reason as the
 # conductor: node is not published for riscv64, and Alpine 3.23 has both
 # node 24 and a docker client on every architecture we publish for. That
 # also means the docker client comes from the package manager rather than
 # a tarball off download.docker.com, which has no riscv64 build at all.
 #
 # The worker runs each job in its own container, so it needs a docker
 # socket. It does not run a daemon of its own: the containers it starts
 # are siblings on the host, not children.
 #
 # It shares nothing else with them. A job's tree is unpacked into its
 # container over the docker API rather than bind mounted from here, and
 # the results are read back the same way, so no directory has to mean the
 # same thing on both sides and this image needs no volumes at all.
 
 ARG ALPINE_VERSION=3.23
 
 FROM alpine:${ALPINE_VERSION} AS deps
 
 RUN apk add --no-cache nodejs npm
 
 WORKDIR /app
 
 # The worker source needs no npm packages at all. yaml is installed only so
 # the configuration file may be YAML as well as JSON; nothing breaks
 # without it.
 RUN npm install --omit=dev --no-audit --no-fund yaml \
     && npm cache clean --force
 
 FROM alpine:${ALPINE_VERSION}
 
 # docker-cli to drive the host daemon, and node to run the agent. No git,
 # because the worker never touches a repository, and no tar, because
 # docker does the unpacking on the far side of the socket.
 RUN apk add --no-cache ca-certificates docker-cli nodejs
 
 WORKDIR /app
 
 # The source is ES modules, and node reparses every file with a warning
 # unless the package says so.
 RUN printf '{\n  "name": "conductor-worker",\n  "private": true,\n  "type": "module"\n}\n' > package.json
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY src/worker/ ./src/worker/
 
 # Deliberately no CONDUCTOR_WORKER_CONFIG: the worker is configurable by
 # environment alone, and naming a file that is not mounted would make it
 # refuse to start. A config mounted at /etc/conductor/worker.json is picked
 # up on its own.
 ENV NODE_ENV=production
 
 # Runs as root because the docker socket is usually root owned. The jobs
 # themselves are isolated by being containers, not by this user.
 ENTRYPOINT ["node", "src/worker/agent.js"]