eae7b4ed7a
- fc-dns: add OnePasswordItem CRD for DNS API keys + NetworkPolicy for Phase 0 auth hardening; bump dns-web image tag - fc-landing: rewrite landing HTML to remove CDN dependencies (air-gap safe); add preview.html standalone preview - github-runner: add TOOLCACHE_ARCH to install-ruby-toolcache.sh for arm64 support; add Dockerfile.arm64 for arm64 ARC runner image - docs/gx10-tenant-landing: per-user Deployment+IngressRoute manifests (andrew/dustin/erik/fit/matt) + CUTOVER-RUNBOOK.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
2.7 KiB
Docker
64 lines
2.7 KiB
Docker
FROM myoung34/github-runner:latest
|
|
|
|
# arm64 variant of the FlowerCore self-hosted runner image.
|
|
# Built/maintained alongside the amd64 Dockerfile. The ONLY substantive
|
|
# difference from the amd64 image is that the Actions/Ruby tool-cache arch
|
|
# label is "arm64" instead of the amd64 "x64". Ruby itself is still compiled
|
|
# from source via ruby-build, so it is naturally arm64 on an aarch64 host.
|
|
|
|
ARG RUBY_VERSION=3.3.11
|
|
ARG RUBY_MINOR=3.3
|
|
ARG RUBY_BUILD_VERSION=v20260326
|
|
ARG RUNNER_UID=1001
|
|
ARG RUNNER_GID=1001
|
|
# arm64 tool-cache arch label (was x64 on amd64). ruby/setup-ruby@v1 on a
|
|
# self-hosted aarch64 Linux runner discovers Ruby under _tool/Ruby/<ver>/arm64.
|
|
ARG TOOLCACHE_ARCH=arm64
|
|
|
|
ENV RUNNER_TOOL_CACHE=/home/runner/_tool
|
|
ENV RUNNER_RUBY_TOOLCACHE=/opt/runner-toolcache
|
|
ENV PATH="/home/runner/_tool/Ruby/${RUBY_MINOR}/${TOOLCACHE_ARCH}/bin:/opt/runner-toolcache/Ruby/${RUBY_MINOR}/${TOOLCACHE_ARCH}/bin:${PATH}"
|
|
|
|
USER root
|
|
|
|
# Bake the IAmWorkin step-ca root CA into the system trust store. Without
|
|
# this, .NET HttpClient calls from CI tests against *.iamworkin.lan
|
|
# (e.g. https://selenium.iamworkin.lan/session) fail with `PartialChain`
|
|
# because the runner image's default Ubuntu trust bundle doesn't include
|
|
# our internal Root CA. update-ca-certificates regenerates
|
|
# /etc/ssl/certs/ca-certificates.crt, which OpenSSL + .NET on Linux read
|
|
# automatically — no SSL_CERT_FILE env var needed.
|
|
COPY step-ca-root.crt /usr/local/share/ca-certificates/iamworkin-step-ca-root.crt
|
|
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
autoconf \
|
|
bison \
|
|
build-essential \
|
|
ca-certificates \
|
|
curl \
|
|
libdb-dev \
|
|
libffi-dev \
|
|
libgdbm-dev \
|
|
libgmp-dev \
|
|
libncurses-dev \
|
|
libreadline-dev \
|
|
libssl-dev \
|
|
libyaml-dev \
|
|
patch \
|
|
pkg-config \
|
|
uuid-dev \
|
|
zlib1g-dev \
|
|
&& update-ca-certificates \
|
|
&& curl -fsSL "https://github.com/rbenv/ruby-build/archive/refs/tags/${RUBY_BUILD_VERSION}.tar.gz" -o /tmp/ruby-build.tar.gz \
|
|
&& mkdir -p /tmp/ruby-build \
|
|
&& tar -xzf /tmp/ruby-build.tar.gz --strip-components=1 -C /tmp/ruby-build \
|
|
&& /tmp/ruby-build/install.sh \
|
|
&& rm -rf /tmp/ruby-build /tmp/ruby-build.tar.gz /var/lib/apt/lists/*
|
|
|
|
COPY install-ruby-toolcache.sh /usr/local/bin/install-ruby-toolcache.sh
|
|
|
|
RUN chmod +x /usr/local/bin/install-ruby-toolcache.sh \
|
|
&& RUBY_VERSION="${RUBY_VERSION}" RUBY_MINOR="${RUBY_MINOR}" TOOLCACHE_ARCH="${TOOLCACHE_ARCH}" TOOLCACHE_ROOT="${RUNNER_RUBY_TOOLCACHE}" RUNNER_UID="${RUNNER_UID}" RUNNER_GID="${RUNNER_GID}" /usr/local/bin/install-ruby-toolcache.sh \
|
|
&& ruby -v
|