Keystone/docker-compose.yml at main · HomericIntelligence/Keystone · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
version: '3.8'

services:
  # Build and run tests
  test:
    build:
      context: .
      target: test
    image: keystone:${GIT_COMMIT}-test
    container_name: keystone-test-${GIT_COMMIT}
    environment:
      - GIT_COMMIT=${GIT_COMMIT}
      - BUILD_UID=${BUILD_UID}
      - BUILD_GID=${BUILD_GID}

  # Production deployment
  production:
    build:
      context: .
      target: production
    image: keystone:${GIT_COMMIT}-production
    container_name: keystone-prod-${GIT_COMMIT}
    ports:
      - "8080:8080"  # Health check
      - "9090:9090"  # Metrics
      - "50051:50051"  # gRPC (future)
    environment:
      - WORKER_COUNT=4
      - LOG_LEVEL=info
      - HEALTH_CHECK_PORT=8080
      - METRICS_PORT=9090
      - GIT_COMMIT=${GIT_COMMIT}
      - BUILD_UID=${BUILD_UID}
      - BUILD_GID=${BUILD_GID}

  # Development environment with mounted source
  dev:
    build:
      context: .
      target: development
      args:
        BUILD_UID: "${BUILD_UID}"
        BUILD_GID: "${BUILD_GID}"
    image: keystone-dev:latest
    container_name: keystone-dev
    # Rootless-Podman bind-mount ownership: without keep-id, the default
    # rootless userns maps the in-container `user:` uid to a host *subuid*
    # (e.g. 1001 -> 101000). Anything the container writes under the mounted
    # workspace (build/conan-deps from `make deps`, etc.) is then owned by that
    # foreign subuid on the host, so the host runner can no longer create
    # build/x86.coverage.debug (coverage job, Makefile:79 "Permission denied")
    # and an in-container cmake configure can no longer recreate build/
    # (lint job, "Unable to (re)create the private pkgRedirects directory").
    # keep-id maps the host runner uid 1:1 into the container, giving the host
    # and the in-container build user shared ownership of the bind mount.
    userns_mode: "keep-id"
    user: "${BUILD_UID}:${BUILD_GID}"  # Run as host user
    volumes:
      - .:/workspace:Z
    working_dir: /workspace
    stdin_open: true
    tty: true
    command: /bin/bash
    cap_add:
      - SYS_PTRACE
    security_opt:
      - seccomp:unconfined
    environment:
      - HOME=/workspace/.docker-home  # Avoid permission issues with $HOME
      - GIT_COMMIT=${GIT_COMMIT}
      - BUILD_UID=${BUILD_UID}
      - BUILD_GID=${BUILD_GID}

  # Build only (for CI/CD)
  build:
    build:
      context: .
      target: builder
    image: keystone-builder:${GIT_COMMIT}-latest
    container_name: keystone-build-${GIT_COMMIT}
    # See the `dev` service: keep-id maps the host runner uid 1:1 into the
    # container so bind-mounted build artifacts stay writable from both sides
    # under rootless Podman.
    userns_mode: "keep-id"
    volumes:
      - .:/workspace:Z
    environment:
      - GIT_COMMIT=${GIT_COMMIT}
      - BUILD_UID=${BUILD_UID}
      - BUILD_GID=${BUILD_GID}
    command: >
      bash -c "cd build/debug && cmake -G Ninja ../.. && ninja"