From 63b352b5e271ce289210697efa3aa990ba9b51f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Verstraeten?= Date: Wed, 5 Aug 2026 20:36:26 +0000 Subject: [PATCH] Remove obsolete MoQ Dockerfile and update build workflows to streamline image creation --- .github/workflows/moq-build.yml | 32 ---- .github/workflows/pr-build.yml | 4 +- .github/workflows/release-bump.yml | 2 +- .github/workflows/release-create.yml | 2 +- Dockerfile | 27 ++-- Dockerfile.arm64 | 147 ------------------ Dockerfile.moq | 74 --------- README.md | 17 +- ...ncrypted_0-0-0-0_-1_20373.mp4.primary.json | 1 - 9 files changed, 26 insertions(+), 280 deletions(-) delete mode 100644 .github/workflows/moq-build.yml delete mode 100644 Dockerfile.arm64 delete mode 100644 Dockerfile.moq delete mode 100644 machinery/data/tus/1785961483_3-259_encrypted_0-0-0-0_-1_20373.mp4.primary.json diff --git a/.github/workflows/moq-build.yml b/.github/workflows/moq-build.yml deleted file mode 100644 index 6d5307d..0000000 --- a/.github/workflows/moq-build.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: Build MoQ image - -on: - pull_request: - paths: - - Dockerfile.moq - - machinery/** - - ui/** - - .github/workflows/moq-build.yml - workflow_dispatch: - -jobs: - build: - name: MoQ (${{ matrix.architecture }}) - runs-on: ${{ matrix.runner }} - strategy: - matrix: - include: - - architecture: amd64 - runner: ubuntu-24.04 - - architecture: arm64 - runner: ubuntu-24.04-arm - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Build image - run: docker build --file Dockerfile.moq --tag agent-moq:${{ matrix.architecture }} . - - - name: Verify binary - run: docker run --rm agent-moq:${{ matrix.architecture }} ./main -action version \ No newline at end of file diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 8ef3c9c..7cf66ca 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -16,10 +16,8 @@ jobs: include: - architecture: amd64 runner: ubuntu-24.04 - dockerfile: Dockerfile - architecture: arm64 runner: ubuntu-24.04-arm - dockerfile: Dockerfile.arm64 steps: - name: Checkout uses: actions/checkout@v3 @@ -34,7 +32,7 @@ jobs: length: 7 - name: Run Build run: | - docker build -t ${{ matrix.architecture }} -f ${{ matrix.dockerfile }} . + docker build -t ${{ matrix.architecture }} . CID=$(docker create ${{matrix.architecture}}) docker cp ${CID}:/home/agent ./output-${{matrix.architecture}} docker rm ${CID} diff --git a/.github/workflows/release-bump.yml b/.github/workflows/release-bump.yml index b3677d3..6b282dd 100644 --- a/.github/workflows/release-bump.yml +++ b/.github/workflows/release-bump.yml @@ -108,7 +108,7 @@ jobs: length: 7 - name: Run Build run: | - docker build --provenance=false --build-arg VERSION=${{ needs.bump-release.outputs.tag }} -t ${{matrix.architecture}} -f Dockerfile.arm64 . + docker build --provenance=false --build-arg VERSION=${{ needs.bump-release.outputs.tag }} -t ${{matrix.architecture}} . CID=$(docker create ${{matrix.architecture}}) docker cp ${CID}:/home/agent ./output-${{matrix.architecture}} docker rm ${CID} diff --git a/.github/workflows/release-create.yml b/.github/workflows/release-create.yml index d765fac..4e4b0b7 100644 --- a/.github/workflows/release-create.yml +++ b/.github/workflows/release-create.yml @@ -71,7 +71,7 @@ jobs: length: 7 - name: Run Build run: | - docker build --provenance=false --build-arg VERSION=${{github.event.inputs.tag || github.ref_name}} -t ${{matrix.architecture}} -f Dockerfile.arm64 . + docker build --provenance=false --build-arg VERSION=${{github.event.inputs.tag || github.ref_name}} -t ${{matrix.architecture}} . CID=$(docker create ${{matrix.architecture}}) docker cp ${CID}:/home/agent ./output-${{matrix.architecture}} docker rm ${CID} diff --git a/Dockerfile b/Dockerfile index ddb8d72..8186227 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,13 +1,15 @@ -ARG BASE_IMAGE_VERSION=amd64-ddbe40e +ARG GO_IMAGE=golang:1.24-trixie +ARG RUNTIME_IMAGE=debian:trixie-slim ARG VERSION=0.0.0 -FROM kerberos/base:${BASE_IMAGE_VERSION} AS build-machinery +FROM ${GO_IMAGE} AS build-machinery LABEL AUTHOR=uug.ai # Re-declare VERSION inside this stage so the value passed via # `--build-arg VERSION=...` (e.g. the release tag) is available below. # ARGs declared before the first FROM are not visible inside build stages. ARG VERSION +ARG TARGETARCH ENV GOROOT=/usr/local/go ENV GOPATH=/go @@ -17,9 +19,10 @@ ENV GOSUMDB=off ########################################## # Installing some additional dependencies. -RUN apt-get upgrade -y && apt-get update && apt-get install -y --fix-missing --no-install-recommends \ +RUN apt-get update && apt-get install -y --fix-missing --no-install-recommends \ git build-essential cmake pkg-config unzip libgtk2.0-dev \ - curl ca-certificates libcurl4-openssl-dev libssl-dev libjpeg62-turbo-dev && \ + curl ca-certificates libavcodec-dev libavutil-dev libcurl4-openssl-dev \ + libssl-dev libjpeg62-turbo-dev libswscale-dev && \ rm -rf /var/lib/apt/lists/* ############################################################################## @@ -43,7 +46,9 @@ RUN cd /go/src/github.com/kerberos-io/agent/machinery && \ if [ -z "${VERSION}" ] || [ "${VERSION}" = "0.0.0" ]; then \ VERSION=$(cd /go/src/github.com/kerberos-io/agent && git describe --tags --always 2>/dev/null || echo "0.0.0"); \ fi && \ - go build -tags timetzdata,netgo,osusergo --ldflags "-s -w -X github.com/kerberos-io/agent/machinery/src/utils.VERSION=${VERSION} -extldflags '-static -latomic'" main.go && \ + BUILD_TAGS=timetzdata,netgo,osusergo && \ + case "${TARGETARCH:-$(go env GOARCH)}" in amd64|arm64) BUILD_TAGS="moq,${BUILD_TAGS}" ;; esac && \ + go build -tags "${BUILD_TAGS}" --ldflags "-s -w -X github.com/kerberos-io/agent/machinery/src/utils.VERSION=${VERSION}" main.go && \ mkdir -p /agent && \ mv main /agent && \ mv version /agent && \ @@ -89,12 +94,16 @@ RUN mkdir -p ./agent && cp -r /go/src/github.com/kerberos-io/agent/machinery/www ############################################ # Publish main binary to GitHub release -FROM alpine:latest +FROM ${RUNTIME_IMAGE} ############################ # Protect by non-root user. -RUN addgroup -S kerberosio && adduser -S agent -G kerberosio && addgroup agent video +RUN apt-get update && apt-get install -y --no-install-recommends \ + ca-certificates curl ffmpeg libatomic1 libcap2-bin libstdc++6 && \ + rm -rf /var/lib/apt/lists/* && \ + groupadd --system kerberosio && \ + useradd --system --gid kerberosio --groups video --create-home agent ################################# # Copy files from previous images @@ -102,8 +111,6 @@ RUN addgroup -S kerberosio && adduser -S agent -G kerberosio && addgroup agent v COPY --chown=0:0 --from=build-machinery /dist / COPY --chown=0:0 --from=build-ui /dist / -RUN apk update && apk add ca-certificates curl ffmpeg libstdc++ libc6-compat --no-cache && rm -rf /var/cache/apk/* - ################## # Try running agent @@ -123,7 +130,7 @@ RUN chown -R agent:kerberosio /home/agent/www ########################### # Grant the necessary root capabilities to the process trying to bind to the privileged port -RUN apk add libcap && setcap 'cap_net_bind_service=+ep' /home/agent/main +RUN setcap 'cap_net_bind_service=+ep' /home/agent/main ################### # Run non-root user diff --git a/Dockerfile.arm64 b/Dockerfile.arm64 deleted file mode 100644 index e324e6d..0000000 --- a/Dockerfile.arm64 +++ /dev/null @@ -1,147 +0,0 @@ - -ARG BASE_IMAGE_VERSION=arm64-ddbe40e -ARG VERSION=0.0.0 -FROM kerberos/base:${BASE_IMAGE_VERSION} AS build-machinery -LABEL AUTHOR=uug.ai - -# Re-declare VERSION inside this stage so the value passed via -# `--build-arg VERSION=...` (e.g. the release tag) is available below. -# ARGs declared before the first FROM are not visible inside build stages. -ARG VERSION - -ENV GOROOT=/usr/local/go -ENV GOPATH=/go -ENV PATH=$GOPATH/bin:$GOROOT/bin:/usr/local/lib:$PATH -ENV GOSUMDB=off - -########################################## -# Installing some additional dependencies. - -RUN apt-get upgrade -y && apt-get update && apt-get install -y --fix-missing --no-install-recommends \ - git build-essential cmake pkg-config unzip libgtk2.0-dev \ - curl ca-certificates libcurl4-openssl-dev libssl-dev libjpeg62-turbo-dev && \ - rm -rf /var/lib/apt/lists/* - -############################################################################## -# Copy all the relevant source code in the Docker image, so we can build this. - -RUN mkdir -p /go/src/github.com/kerberos-io/agent -COPY machinery /go/src/github.com/kerberos-io/agent/machinery -RUN rm -rf /go/src/github.com/kerberos-io/agent/machinery/.env - -################################################################## -# Get the latest commit hash, so we know which version we're running -COPY .git /go/src/github.com/kerberos-io/agent/.git -RUN cd /go/src/github.com/kerberos-io/agent/.git && git log --format="%H" -n 1 | head -c7 > /go/src/github.com/kerberos-io/agent/machinery/version -RUN cat /go/src/github.com/kerberos-io/agent/machinery/version - -################## -# Build Machinery - -RUN cd /go/src/github.com/kerberos-io/agent/machinery && \ - go mod download && \ - if [ -z "${VERSION}" ] || [ "${VERSION}" = "0.0.0" ]; then \ - VERSION=$(cd /go/src/github.com/kerberos-io/agent && git describe --tags --always 2>/dev/null || echo "0.0.0"); \ - fi && \ - go build -tags timetzdata,netgo,osusergo --ldflags "-s -w -X github.com/kerberos-io/agent/machinery/src/utils.VERSION=${VERSION} -extldflags '-static -latomic'" main.go && \ - mkdir -p /agent && \ - mv main /agent && \ - mv version /agent && \ - mv data /agent && \ - mkdir -p /agent/data/cloud && \ - mkdir -p /agent/data/snapshots && \ - mkdir -p /agent/data/log && \ - mkdir -p /agent/data/recordings && \ - mkdir -p /agent/data/capture-test && \ - mkdir -p /agent/data/config - -#################################### -# Let's create a /dist folder containing just the files necessary for runtime. -# Later, it will be copied as the / (root) of the output image. - -WORKDIR /dist -RUN cp -r /agent ./ - -#################################################################################### -# This will collect dependent libraries so they're later copied to the final image. - -RUN /dist/agent/main version - -FROM node:22-alpine AS build-ui - -RUN apk update && apk upgrade --available && sync - -######################## -# Build Web (React app) - -RUN mkdir -p /go/src/github.com/kerberos-io/agent/machinery/www -COPY ui /go/src/github.com/kerberos-io/agent/ui -RUN cd /go/src/github.com/kerberos-io/agent/ui && rm -rf yarn.lock && yarn config set network-timeout 300000 && \ - yarn && yarn build - -#################################### -# Let's create a /dist folder containing just the files necessary for runtime. -# Later, it will be copied as the / (root) of the output image. - -WORKDIR /dist -RUN mkdir -p ./agent && cp -r /go/src/github.com/kerberos-io/agent/machinery/www ./agent/ - -############################################ -# Publish main binary to GitHub release - -FROM alpine:latest - -############################ -# Protect by non-root user. - -RUN addgroup -S kerberosio && adduser -S agent -G kerberosio && addgroup agent video - -################################# -# Copy files from previous images - -COPY --chown=0:0 --from=build-machinery /dist / -COPY --chown=0:0 --from=build-ui /dist / - -RUN apk update && apk add ca-certificates curl ffmpeg libstdc++ libc6-compat --no-cache && rm -rf /var/cache/apk/* - -################## -# Try running agent - -RUN mv /agent/* /home/agent/ -RUN /home/agent/main version - -####################### -# Make template config - -RUN cp /home/agent/data/config/config.json /home/agent/data/config.template.json - -########################### -# Set permissions correctly - -RUN chown -R agent:kerberosio /home/agent/data -RUN chown -R agent:kerberosio /home/agent/www - -########################### -# Grant the necessary root capabilities to the process trying to bind to the privileged port -RUN apk add libcap && setcap 'cap_net_bind_service=+ep' /home/agent/main - -################### -# Run non-root user - -USER agent - -###################################### -# By default the app runs on port 80 - -EXPOSE 80 - -###################################### -# Check if agent is still running - -HEALTHCHECK CMD curl --fail http://localhost:80 || exit 1 - -################################################### -# Leeeeettttt'ssss goooooo!!! -# Run the shizzle from the right working directory. -WORKDIR /home/agent -CMD ["./main", "-action", "run", "-port", "80"] \ No newline at end of file diff --git a/Dockerfile.moq b/Dockerfile.moq deleted file mode 100644 index 6f5fcfe..0000000 --- a/Dockerfile.moq +++ /dev/null @@ -1,74 +0,0 @@ -ARG GO_IMAGE=golang:1.24-trixie -ARG RUNTIME_IMAGE=debian:trixie-slim -ARG VERSION=0.0.0 - -FROM ${GO_IMAGE} AS build-machinery - -ARG VERSION -ENV CGO_ENABLED=1 - -RUN apt-get update && apt-get install -y --no-install-recommends \ - build-essential \ - ca-certificates \ - git \ - libavcodec-dev \ - libavutil-dev \ - libswscale-dev \ - pkg-config \ - && rm -rf /var/lib/apt/lists/* - -WORKDIR /src -COPY machinery ./machinery -COPY .git ./.git - -RUN cd machinery && \ - go mod download && \ - if [ -z "${VERSION}" ] || [ "${VERSION}" = "0.0.0" ]; then \ - VERSION=$(git -C /src describe --tags --always 2>/dev/null || echo "0.0.0"); \ - fi && \ - go build \ - -tags moq,timetzdata,netgo,osusergo \ - -ldflags "-s -w -X github.com/kerberos-io/agent/machinery/src/utils.VERSION=${VERSION}" \ - -o /out/main \ - ./main.go && \ - cp -r data /out/data && \ - printf '%s' "${VERSION}" > /out/version && \ - mkdir -p /out/data/cloud /out/data/snapshots /out/data/log /out/data/recordings /out/data/capture-test /out/data/config - -FROM node:22-alpine AS build-ui - -WORKDIR /src/ui -COPY ui ./ -RUN mkdir -p /src/machinery && \ - yarn config set network-timeout 300000 && \ - yarn install --frozen-lockfile && \ - yarn build - -FROM ${RUNTIME_IMAGE} - -RUN apt-get update && apt-get install -y --no-install-recommends \ - ca-certificates \ - curl \ - ffmpeg \ - libcap2-bin \ - libstdc++6 \ - && rm -rf /var/lib/apt/lists/* && \ - groupadd --system kerberosio && \ - useradd --system --gid kerberosio --groups video --create-home agent - -COPY --from=build-machinery --chown=root:root /out/main /home/agent/main -COPY --from=build-machinery --chown=agent:kerberosio /out/data /home/agent/data -COPY --from=build-machinery --chown=root:root /out/version /home/agent/version -COPY --from=build-ui --chown=agent:kerberosio /src/machinery/www /home/agent/www - -RUN cp /home/agent/data/config/config.json /home/agent/data/config.template.json && \ - chown agent:kerberosio /home/agent/data/config.template.json && \ - setcap 'cap_net_bind_service=+ep' /home/agent/main && \ - /home/agent/main -action version - -USER agent -WORKDIR /home/agent - -EXPOSE 80 -HEALTHCHECK CMD curl --fail http://localhost:80 || exit 1 -CMD ["./main", "-action", "run", "-port", "80"] \ No newline at end of file diff --git a/README.md b/README.md index 0ba64dd..748d626 100644 --- a/README.md +++ b/README.md @@ -412,27 +412,22 @@ Remember the build step of the `web` part, during build time we move the build d ## Building for Docker -Inside the root of this `agent` repository, you will find a `Dockerfile`. This file contains the instructions for building and shipping a **Kerberos Agent**. Important to note is that you start from a prebuilt base image, `kerberos/base:xxx`. -This base image already contains a couple of tools, such as Golang, FFmpeg and OpenCV. We do this for faster compilation times. +Inside the root of this `agent` repository, you will find a `Dockerfile`. This file contains the instructions for building and shipping a **Kerberos Agent**. It uses Debian Trixie to support the native dependencies used by the Agent, including Media over QUIC. By running the `docker build` command, you will create the Kerberos Agent Docker image. After building you can simply run the image as a Docker container. docker build -t kerberos/agent . -### Building with Media over QUIC +### Media over QUIC -The optional MoQ publisher uses a Rust FFI archive that requires CGO and glibc -2.38 or newer. Build it with the Debian-based image instead of the standard -static Alpine image: - - docker build -f Dockerfile.moq -t kerberos/agent:moq . - -The publisher is still disabled unless explicitly enabled at runtime: +The standard AMD64 and ARM64 images include the optional MoQ publisher. Its Rust +FFI archive requires CGO and glibc 2.38 or newer, which is why the standard image +uses Debian Trixie. The publisher is disabled unless explicitly enabled at runtime: docker run --rm -p 80:80 \ -e AGENT_LIVE_MOQ_ENABLED=true \ -e AGENT_LIVE_MOQ_URL=https://relay.uug.ai/anon \ - kerberos/agent:moq + kerberos/agent `AGENT_LIVE_MOQ_BROADCAST_PREFIX` defaults to `devices`, producing the broadcast `devices//live.hang`. `AGENT_LIVE_MOQ_QUALITY` accepts `auto` (the diff --git a/machinery/data/tus/1785961483_3-259_encrypted_0-0-0-0_-1_20373.mp4.primary.json b/machinery/data/tus/1785961483_3-259_encrypted_0-0-0-0_-1_20373.mp4.primary.json deleted file mode 100644 index f9a394e..0000000 --- a/machinery/data/tus/1785961483_3-259_encrypted_0-0-0-0_-1_20373.mp4.primary.json +++ /dev/null @@ -1 +0,0 @@ -{"upload_url":"https://vault.kerberos.io/api/storage/tus/7a192d02cd47ede3939ddfa5f8819465","vault_uri":"https://vault.kerberos.io/api/storage/tus/","size":4739581} \ No newline at end of file