Dockerfile 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193
  1. # syntax=docker/dockerfile:1
  2. # Dockerfile to build the matrixdotorg/synapse docker images.
  3. #
  4. # Note that it uses features which are only available in BuildKit - see
  5. # https://docs.docker.com/go/buildkit/ for more information.
  6. #
  7. # To build the image, run `docker build` command from the root of the
  8. # synapse repository:
  9. #
  10. # DOCKER_BUILDKIT=1 docker build -f docker/Dockerfile .
  11. #
  12. # There is an optional PYTHON_VERSION build argument which sets the
  13. # version of python to build against: for example:
  14. #
  15. # DOCKER_BUILDKIT=1 docker build -f docker/Dockerfile --build-arg PYTHON_VERSION=3.10 .
  16. #
  17. # Irritatingly, there is no blessed guide on how to distribute an application with its
  18. # poetry-managed environment in a docker image. We have opted for
  19. # `poetry export | pip install -r /dev/stdin`, but beware: we have experienced bugs in
  20. # in `poetry export` in the past.
  21. ARG PYTHON_VERSION=3.11
  22. ###
  23. ### Stage 0: generate requirements.txt
  24. ###
  25. # We hardcode the use of Debian bullseye here because this could change upstream
  26. # and other Dockerfiles used for testing are expecting bullseye.
  27. FROM docker.io/python:${PYTHON_VERSION}-slim-bullseye as requirements
  28. # RUN --mount is specific to buildkit and is documented at
  29. # https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/syntax.md#build-mounts-run---mount.
  30. # Here we use it to set up a cache for apt (and below for pip), to improve
  31. # rebuild speeds on slow connections.
  32. RUN \
  33. --mount=type=cache,target=/var/cache/apt,sharing=locked \
  34. --mount=type=cache,target=/var/lib/apt,sharing=locked \
  35. apt-get update -qq && apt-get install -yqq \
  36. build-essential curl git libffi-dev libssl-dev \
  37. && rm -rf /var/lib/apt/lists/*
  38. # Install rust and ensure its in the PATH.
  39. # (Rust may be needed to compile `cryptography`---which is one of poetry's
  40. # dependencies---on platforms that don't have a `cryptography` wheel.
  41. ENV RUSTUP_HOME=/rust
  42. ENV CARGO_HOME=/cargo
  43. ENV PATH=/cargo/bin:/rust/bin:$PATH
  44. RUN mkdir /rust /cargo
  45. RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain stable --profile minimal
  46. # arm64 builds consume a lot of memory if `CARGO_NET_GIT_FETCH_WITH_CLI` is not
  47. # set to true, so we expose it as a build-arg.
  48. ARG CARGO_NET_GIT_FETCH_WITH_CLI=false
  49. ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_NET_GIT_FETCH_WITH_CLI
  50. # We install poetry in its own build stage to avoid its dependencies conflicting with
  51. # synapse's dependencies.
  52. RUN --mount=type=cache,target=/root/.cache/pip \
  53. pip install --user "poetry==1.3.2"
  54. WORKDIR /synapse
  55. # Copy just what we need to run `poetry export`...
  56. COPY pyproject.toml poetry.lock /synapse/
  57. # If specified, we won't verify the hashes of dependencies.
  58. # This is only needed if the hashes of dependencies cannot be checked for some
  59. # reason, such as when a git repository is used directly as a dependency.
  60. ARG TEST_ONLY_SKIP_DEP_HASH_VERIFICATION
  61. # If specified, we won't use the Poetry lockfile.
  62. # Instead, we'll just install what a regular `pip install` would from PyPI.
  63. ARG TEST_ONLY_IGNORE_POETRY_LOCKFILE
  64. # Export the dependencies, but only if we're actually going to use the Poetry lockfile.
  65. # Otherwise, just create an empty requirements file so that the Dockerfile can
  66. # proceed.
  67. RUN if [ -z "$TEST_ONLY_IGNORE_POETRY_LOCKFILE" ]; then \
  68. /root/.local/bin/poetry export --extras all -o /synapse/requirements.txt ${TEST_ONLY_SKIP_DEP_HASH_VERIFICATION:+--without-hashes}; \
  69. else \
  70. touch /synapse/requirements.txt; \
  71. fi
  72. ###
  73. ### Stage 1: builder
  74. ###
  75. FROM docker.io/python:${PYTHON_VERSION}-slim-bullseye as builder
  76. # install the OS build deps
  77. RUN \
  78. --mount=type=cache,target=/var/cache/apt,sharing=locked \
  79. --mount=type=cache,target=/var/lib/apt,sharing=locked \
  80. apt-get update -qq && apt-get install -yqq \
  81. build-essential \
  82. libffi-dev \
  83. libjpeg-dev \
  84. libpq-dev \
  85. libssl-dev \
  86. libwebp-dev \
  87. libxml++2.6-dev \
  88. libxslt1-dev \
  89. openssl \
  90. zlib1g-dev \
  91. git \
  92. curl \
  93. libicu-dev \
  94. pkg-config \
  95. && rm -rf /var/lib/apt/lists/*
  96. # Install rust and ensure its in the PATH
  97. ENV RUSTUP_HOME=/rust
  98. ENV CARGO_HOME=/cargo
  99. ENV PATH=/cargo/bin:/rust/bin:$PATH
  100. RUN mkdir /rust /cargo
  101. RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain stable --profile minimal
  102. # arm64 builds consume a lot of memory if `CARGO_NET_GIT_FETCH_WITH_CLI` is not
  103. # set to true, so we expose it as a build-arg.
  104. ARG CARGO_NET_GIT_FETCH_WITH_CLI=false
  105. ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_NET_GIT_FETCH_WITH_CLI
  106. # To speed up rebuilds, install all of the dependencies before we copy over
  107. # the whole synapse project, so that this layer in the Docker cache can be
  108. # used while you develop on the source
  109. #
  110. # This is aiming at installing the `[tool.poetry.depdendencies]` from pyproject.toml.
  111. COPY --from=requirements /synapse/requirements.txt /synapse/
  112. RUN --mount=type=cache,target=/root/.cache/pip \
  113. pip install --prefix="/install" --no-deps --no-warn-script-location -r /synapse/requirements.txt
  114. # Copy over the rest of the synapse source code.
  115. COPY synapse /synapse/synapse/
  116. COPY rust /synapse/rust/
  117. # ... and what we need to `pip install`.
  118. COPY pyproject.toml README.rst build_rust.py Cargo.toml Cargo.lock /synapse/
  119. # Repeat of earlier build argument declaration, as this is a new build stage.
  120. ARG TEST_ONLY_IGNORE_POETRY_LOCKFILE
  121. # Install the synapse package itself.
  122. # If we have populated requirements.txt, we don't install any dependencies
  123. # as we should already have those from the previous `pip install` step.
  124. RUN --mount=type=cache,target=/synapse/target,sharing=locked \
  125. --mount=type=cache,target=${CARGO_HOME}/registry,sharing=locked \
  126. if [ -z "$TEST_ONLY_IGNORE_POETRY_LOCKFILE" ]; then \
  127. pip install --prefix="/install" --no-deps --no-warn-script-location /synapse[all]; \
  128. else \
  129. pip install --prefix="/install" --no-warn-script-location /synapse[all]; \
  130. fi
  131. ###
  132. ### Stage 2: runtime
  133. ###
  134. FROM docker.io/python:${PYTHON_VERSION}-slim-bullseye
  135. LABEL org.opencontainers.image.url='https://matrix.org/docs/projects/server/synapse'
  136. LABEL org.opencontainers.image.documentation='https://github.com/matrix-org/synapse/blob/master/docker/README.md'
  137. LABEL org.opencontainers.image.source='https://github.com/matrix-org/synapse.git'
  138. LABEL org.opencontainers.image.licenses='Apache-2.0'
  139. RUN \
  140. --mount=type=cache,target=/var/cache/apt,sharing=locked \
  141. --mount=type=cache,target=/var/lib/apt,sharing=locked \
  142. apt-get update -qq && apt-get install -yqq \
  143. curl \
  144. gosu \
  145. libjpeg62-turbo \
  146. libpq5 \
  147. libwebp6 \
  148. xmlsec1 \
  149. libjemalloc2 \
  150. libicu67 \
  151. libssl-dev \
  152. openssl \
  153. && rm -rf /var/lib/apt/lists/*
  154. COPY --from=builder /install /usr/local
  155. COPY ./docker/start.py /start.py
  156. COPY ./docker/conf /conf
  157. EXPOSE 8008/tcp 8009/tcp 8448/tcp
  158. ENTRYPOINT ["/start.py"]
  159. HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
  160. CMD curl -fSs http://localhost:8008/health || exit 1