From 5ac625915d991073278f9458e3959fc51998ca77 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sun, 3 May 2026 11:46:28 -0500 Subject: [PATCH] ci: switch app Dockerfile to FROM prop-base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The wgrib2-builder stage and the runtime apt-install stages (libstdc++6/openssl/locale + cdo/gdal-bin) now live in git.mcintire.me/graham/prop-base, built separately by build-base.yaml. The app Dockerfile FROMs that image and just COPYs the Elixir release on top. Net effect: typical pushes drop ~8 min of wgrib2 compile + ~2 min of cdo/gdal-bin apt installs. Bumping wgrib2 or g2c is now a one-line change to Dockerfile.base — the next push picks up :latest automatically. --- Dockerfile | 122 +++++------------------------------------------------ 1 file changed, 11 insertions(+), 111 deletions(-) diff --git a/Dockerfile b/Dockerfile index 344581d3..2455c528 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,8 +8,7 @@ # This file is based on these images: # # - https://hub.docker.com/r/hexpm/elixir/tags - for the build image -# - https://hub.docker.com/_/debian/tags?name=trixie-20260316-slim - for the release image -# - https://pkgs.org/ - resource for finding needed packages +# - git.mcintire.me/graham/prop-base - prebuilt runtime base (see Dockerfile.base) # - Ex: docker.io/hexpm/elixir:1.19.5-erlang-28.4.1-debian-trixie-20260316-slim # ARG ELIXIR_VERSION=1.19.5 @@ -17,82 +16,12 @@ ARG OTP_VERSION=28.4.1 ARG DEBIAN_VERSION=trixie-20260316-slim ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}" -ARG RUNNER_IMAGE="docker.io/debian:${DEBIAN_VERSION}" - -# ---- wgrib2 build stage (cached independently) ---- -FROM ${RUNNER_IMAGE} AS wgrib2-builder - -ARG WGRIB2_VERSION=3.8.0 -# wgrib2 3.6.0 has a memory-corruption bug that surfaces on HRDPS -# rotated lat/lon files via -lon point extraction: emits denormal -# garbage values, then aborts with `free(): invalid size`. 3.8.0 -# fixes it. Verified by reproducing the failure with wgrib2 3.6.0 -# in the production pod against an HRDPS file on 2026-04-30 and -# confirming 3.8.0 handles the same file correctly locally. Keep -# this aligned with rust/prop_grid_rs/Dockerfile. -# g2c v2.1.0 is the first release where BUILD_G2C defaults ON, which -# wgrib2 needs at link time (g2c_enc_jpeg2000 / g2c_dec_jpeg2000 -# come from the "new" file-based API). wgrib2 3.8.0 bumps the -# find_package requirement to g2c >= 2.3.0 (CMakeLists.txt:93). -ARG G2C_VERSION=2.3.0 - -# BuildKit cache mounts keep the .deb archive + apt-lists out of the -# image overlay and on the builder's cache storage, so image layers -# don't pay the disk cost and CI runners with tight /var budgets can -# still fetch ~100 MB of packages. The `rm -rf lists/*` below targets -# the cache-mount contents; BuildKit persists whatever remains for -# the next build. -RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ - --mount=type=cache,target=/var/lib/apt,sharing=locked \ - rm -f /etc/apt/apt.conf.d/docker-clean \ - && apt-get update \ - && apt-get install -y --no-install-recommends \ - build-essential gfortran cmake wget ca-certificates pkg-config \ - zlib1g-dev libaec-dev libpng-dev libopenjp2-7-dev - -# NCEPLIBS-g2c: wgrib2 >= 3.x delegates GRIB2 decompression to this -# library via find_package whenever any of JASPER / OPENJPEG / PNG -# is enabled (wgrib2 CMakeLists:94). Build g2c with all the -# decoders we care about — PNG (MRMS PrecipRate / HRRR native), -# OpenJPEG (modern JPEG2000 replacement for the CVE-riddled Jasper), -# and AEC (CCSDS) — and disable Jasper so we don't need libjasper, -# which Debian dropped years ago. -WORKDIR /tmp/g2c -RUN wget -q --content-disposition "https://github.com/NOAA-EMC/NCEPLIBS-g2c/archive/refs/tags/v${G2C_VERSION}.tar.gz" \ - -O g2c.tar.gz \ - && tar xzf g2c.tar.gz \ - && cd NCEPLIBS-g2c-${G2C_VERSION} \ - && mkdir build && cd build \ - && cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local \ - -DCMAKE_BUILD_TYPE=Release \ - -DUSE_PNG=ON \ - -DUSE_AEC=ON \ - -DUSE_OpenJPEG=ON \ - -DUSE_Jasper=OFF \ - && make -j$(nproc) \ - && make install - -WORKDIR /tmp/wgrib2 - -# wgrib2 3.8.0 cmake flags: -# * USE_AEC turns on AEC compression decode for HRRR files. -# * USE_G2CLIB_LOW links wgrib2 to the external g2c lib for png + -# jpeg2000 decode. The previous USE_PNG / USE_OPENJPEG flags don't -# exist in wgrib2 3.8.0 — they were silently ignored, leaving -# wgrib2 unable to read GRIB2 packing type 40 (HRDPS uses it). -# Verified 2026-04-30 by ldd showing only libc/libm linked. -# * The g2c v2.3.0 build above carries the actual OpenJPEG support; -# wgrib2 dispatches to g2c via USE_G2CLIB_LOW. -RUN wget -q --content-disposition "https://github.com/NOAA-EMC/wgrib2/archive/refs/tags/v${WGRIB2_VERSION}.tar.gz" \ - -O wgrib2.tar.gz \ - && tar xzf wgrib2.tar.gz \ - && cd wgrib2-${WGRIB2_VERSION} \ - && mkdir build && cd build \ - && cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release \ - -DUSE_AEC=ON -DUSE_G2CLIB_LOW=ON \ - && make -j$(nproc) \ - && make install \ - && strip /usr/local/bin/wgrib2 +# Prebuilt runtime base contains wgrib2 + cdo + gdal-bin + locale + the +# BEAM runtime apt deps. Built by .forgejo/workflows/build-base.yaml +# only when Dockerfile.base changes, so this Dockerfile pulls a +# ready-made layer instead of recompiling wgrib2 + reinstalling cdo +# (~10 min) on every push. +ARG BASE_IMAGE="git.mcintire.me/graham/prop-base:latest" # ---- Elixir build stage ---- FROM ${BUILDER_IMAGE} AS builder @@ -154,50 +83,21 @@ COPY rel rel RUN mix release # ---- Final runtime stage ---- -FROM ${RUNNER_IMAGE} AS final +# Pulls the prebuilt prop-base image (Dockerfile.base) which already +# carries wgrib2 + g2c libs + cdo + gdal-bin + locale + BEAM runtime +# apt deps. We just COPY the Elixir release on top. +FROM ${BASE_IMAGE} AS final # Build timestamp baked in by CI (--build-arg BUILD_TIMESTAMP=...). # Only consumed in this final stage, so it never busts the earlier # compile cache. Read at runtime by Microwaveprop.Application.build_timestamp/0. ARG BUILD_TIMESTAMP=unknown -# Runtime deps. BuildKit cache mounts keep the .deb archives and apt -# lists out of the image layer, so the CI builder's tight /var disk -# cap doesn't trip during install. cdo is split into its own RUN -# layer because its dep tree (netCDF/HDF5/ecCodes/Fortran) is ~1 GB -# and we'd rather not have a single failed cdo install invalidate the -# base-runtime layer. -RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ - --mount=type=cache,target=/var/lib/apt,sharing=locked \ - rm -f /etc/apt/apt.conf.d/docker-clean \ - && apt-get update \ - && apt-get install -y --no-install-recommends \ - libstdc++6 openssl libncurses6 locales ca-certificates snmp \ - libgfortran5 libaec0 zlib1g libpng16-16t64 libopenjp2-7 - -RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ - --mount=type=cache,target=/var/lib/apt,sharing=locked \ - rm -f /etc/apt/apt.conf.d/docker-clean \ - && apt-get update \ - && apt-get install -y --no-install-recommends cdo gdal-bin - -RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen - -ENV LANG=en_US.UTF-8 -ENV LANGUAGE=en_US:en -ENV LC_ALL=en_US.UTF-8 ENV MIX_ENV="prod" WORKDIR "/app" RUN chown nobody /app -COPY --from=wgrib2-builder /usr/local/bin/wgrib2 /usr/local/bin/wgrib2 -# wgrib2 links dynamically against libg2c.so from the builder stage — -# carry it across and refresh the loader cache so /usr/local/lib is -# searched at exec time. -COPY --from=wgrib2-builder /usr/local/lib/libg2c.so* /usr/local/lib/ -RUN ldconfig - COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/microwaveprop ./ RUN echo "${BUILD_TIMESTAMP}" > /app/BUILD_TIMESTAMP \