mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
76a83387d9
Move the backend JDK to its latest maintenance build within Java 26 and refresh the dependency versions pinned by hand in the development and production images. - Backend: Zulu JDK 26.0.2 to 26.0.2.1. The jlink module list keeps jdk.management, so the prometheus process metrics stay exported. - Node.js 24.22.1 in .nvmrc, the development image tarball and the two plugins deploy workflows that pin it. - pnpm 12.15.0 in the four Dockerfiles, the 34 packageManager fields and the eleven lockfiles. - Development tools: clj-kondo 2026.10.20, Babashka 1.13.226, Pixi 0.83.0, GitHub CLI 2.103.0, AWS CLI 2.38.5 and uv 0.13.5. - Infra services: RustFS 1.0.3, Mailpit v1.32.0, and Valkey pinned to 8.1.10 instead of the floating 8.1 tag. Fix SERENA_UPDATE_VERSION in the compose file. A value there makes the start script reinstall that Serena release on every start, overriding the one baked into the image; it was replacing 1.7.0 with 1.6.1. The hardened base image updates are left to Renovate. Closes #12599 AI-assisted-by: deepseek-v4.1-flash Signed-off-by: Andrey Antukh <niwi@niwi.nz>
119 lines
3.7 KiB
Docker
119 lines
3.7 KiB
Docker
FROM dhi.io/debian-base:trixie-debian13-dev@sha256:9b025768946856e44f9775005eb199f2e1820484ea27bb5c8bcbb187b80464dc AS build
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV LANG='C.UTF-8' \
|
|
LC_ALL='C.UTF-8' \
|
|
JAVA_HOME="/opt/jdk" \
|
|
DEBIAN_FRONTEND=noninteractive \
|
|
TZ=Etc/UTC
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
binutils \
|
|
ca-certificates \
|
|
curl \
|
|
gzip \
|
|
; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# NOTE: jdk.management is required by the prometheus client hotspot
|
|
# exports. Without it the OS MXBean is sun.management.BaseOperatingSystemImpl,
|
|
# which has no getOpenFileDescriptorCount, getMaxFileDescriptorCount nor
|
|
# getProcessCpuTime, so process_open_fds, process_max_fds and
|
|
# process_cpu_seconds_total silently disappear from /metrics.
|
|
RUN set -eux; \
|
|
ARCH="$(dpkg --print-architecture)"; \
|
|
case "${ARCH}" in \
|
|
aarch64|arm64) \
|
|
ESUM='8ff07320636ef5b30f0d7e16687932df52255c3ef3ffd920a6aae3723511ce7f'; \
|
|
BINARY_URL='https://cdn.azul.com/zulu/bin/zulu26.32.203-ca-jdk26.0.2.1-linux_aarch64.tar.gz'; \
|
|
;; \
|
|
amd64|x86_64) \
|
|
ESUM='c6b810ca659e3293205444f47ac4af163396fd6d025c51fd5f767e628b2ceede'; \
|
|
BINARY_URL='https://cdn.azul.com/zulu/bin/zulu26.32.203-ca-jdk26.0.2.1-linux_x64.tar.gz'; \
|
|
;; \
|
|
*) \
|
|
echo "Unsupported arch: ${ARCH}"; \
|
|
exit 1; \
|
|
;; \
|
|
esac; \
|
|
curl -LfsSo /tmp/openjdk.tar.gz ${BINARY_URL}; \
|
|
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
|
|
mkdir -p /opt/jdk; \
|
|
cd /opt/jdk; \
|
|
tar -xf /tmp/openjdk.tar.gz --strip-components=1; \
|
|
rm -rf /tmp/openjdk.tar.gz; \
|
|
/opt/jdk/bin/jlink \
|
|
--no-header-files \
|
|
--no-man-pages \
|
|
--strip-debug \
|
|
--add-modules java.base,jdk.net,jdk.management,jdk.management.agent,java.se,jdk.compiler,jdk.javadoc,jdk.attach,jdk.unsupported,jdk.jfr,jdk.jcmd \
|
|
--output /opt/jre;
|
|
|
|
|
|
FROM dhi.io/debian-base:trixie-debian13-dev@sha256:9b025768946856e44f9775005eb199f2e1820484ea27bb5c8bcbb187b80464dc AS image
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV LANG='C.UTF-8' \
|
|
LC_ALL='C.UTF-8' \
|
|
JAVA_HOME="/opt/jre" \
|
|
PATH=/opt/jre/bin:/opt/imagick/bin:$PATH \
|
|
DEBIAN_FRONTEND=noninteractive \
|
|
TZ=Etc/UTC \
|
|
LD_LIBRARY_PATH=/opt/imagick/lib/deps
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy --no-install-recommends install passwd; \
|
|
useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
ca-certificates \
|
|
curl \
|
|
fontconfig \
|
|
fontforge \
|
|
libfontconfig1 \
|
|
libfreetype6 \
|
|
libglib2.0-0 \
|
|
libgomp1 \
|
|
libheif1 \
|
|
libjpeg62-turbo \
|
|
liblcms2-2 \
|
|
libopenjp2-7 \
|
|
libpng16-16 \
|
|
librsvg2-2 \
|
|
libtiff6 \
|
|
libwebp7 \
|
|
libwebpdemux2 \
|
|
libwebpmux3 \
|
|
libxml2 \
|
|
libzip5 \
|
|
libzstd1 \
|
|
python3 \
|
|
python3-tabulate \
|
|
tzdata \
|
|
woff-tools \
|
|
woff2 \
|
|
; \
|
|
find tmp/usr/share/zoneinfo/* -type d ! -name 'Etc' |xargs rm -rf; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib /var/cache; \
|
|
rm -rf /usr/include; \
|
|
mkdir -p /opt/data/assets; \
|
|
mkdir -p /opt/penpot; \
|
|
chown -R penpot:penpot /opt/penpot; \
|
|
chown -R penpot:penpot /opt/data;
|
|
|
|
COPY --from=build /opt/jre /opt/jre
|
|
COPY --from=penpotapp/imagemagick:7.1.2-32 /opt/imagick /opt/imagick
|
|
|
|
COPY files/imagemagick-policy.xml /opt/imagick/etc/ImageMagick-7/policy.xml
|
|
|
|
ARG BUNDLE_PATH="./bundle-backend/"
|
|
COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/backend/
|
|
|
|
USER penpot:penpot
|
|
WORKDIR /opt/penpot/backend
|
|
CMD ["/bin/bash", "run.sh"]
|