anton/cardy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Build images with kaniko instead of privileged buildx
ci/woodpecker/manual/ci Pipeline was successful
Details

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
azykov@mail.ru
2026-10-08 11:10:31 +03:00
co-authored by Claude Sonnet 5.5
parent 52d8e0f7e0
commit 6701c6bc0d
2 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.woodpecker/ci.yaml
+8 -9
View File
@@ -2,12 +2,11 @@
# #
# Required secrets (Repository settings -> Secrets): # Required secrets (Repository settings -> Secrets):
# registry_username, registry_password # registry_username, registry_password
# The repo must be marked "Trusted" (docker-buildx plugin runs privileged), # Images are built with kaniko: no privileged mode / Trusted flag needed.
# or switch the publish steps to woodpeckerci/plugin-kaniko.
# #
variables: variables:
- &node_image 'node:22-alpine' - &node_image 'node:22-alpine'
- &buildx 'woodpeckerci/plugin-docker-buildx:latest' - &kaniko 'woodpeckerci/plugin-kaniko:latest'
- &registry 'git.aggtaa.com' - &registry 'git.aggtaa.com'
- &publish_when - &publish_when
- event: push - event: push
@@ -25,11 +24,11 @@ steps:
- event: [push, pull_request] - event: [push, pull_request]
- name: image-server-be - name: image-server-be
image: *buildx image: *kaniko
depends_on: [check] depends_on: [check]
settings: settings:
registry: *registry registry: *registry
repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-server-be repo: ${CI_REPO_OWNER}/cardy-server-be
dockerfile: docker/server-be.Dockerfile dockerfile: docker/server-be.Dockerfile
context: . context: .
tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}'] tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
@@ -40,11 +39,11 @@ steps:
when: *publish_when when: *publish_when
- name: image-server-fe - name: image-server-fe
image: *buildx image: *kaniko
depends_on: [check] depends_on: [check]
settings: settings:
registry: *registry registry: *registry
repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-server-fe repo: ${CI_REPO_OWNER}/cardy-server-fe
dockerfile: docker/server-fe.Dockerfile dockerfile: docker/server-fe.Dockerfile
context: . context: .
tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}'] tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
@@ -55,11 +54,11 @@ steps:
when: *publish_when when: *publish_when
- name: image-mobile-client - name: image-mobile-client
image: *buildx image: *kaniko
depends_on: [check] depends_on: [check]
settings: settings:
registry: *registry registry: *registry
repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-mobile-client repo: ${CI_REPO_OWNER}/cardy-mobile-client
dockerfile: docker/mobile-client.Dockerfile dockerfile: docker/mobile-client.Dockerfile
context: . context: .
tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}'] tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
README.md
+1 -1
View File
@@ -109,5 +109,5 @@ pnpm typecheck
`.woodpecker/ci.yaml`: typecheck + tests on every push/PR, then images are pushed on `main` and `ci` `.woodpecker/ci.yaml`: typecheck + tests on every push/PR, then images are pushed on `main` and `ci`
(tags: short commit SHA and branch name, e.g. `:main`). Images go to the Gitea registry (`git.aggtaa.com/anton/cardy-*`); add secrets `registry_username` (tags: short commit SHA and branch name, e.g. `:main`). Images go to the Gitea registry (`git.aggtaa.com/anton/cardy-*`); add secrets `registry_username`
(Gitea user + access token with `write:package`) and `registry_password`, and mark the repository as Trusted (buildx plugin is privileged). (Gitea user + access token with `write:package`) and `registry_password`. Images are built with kaniko, so the repository doesn't need to be Trusted.
`docker/compose.example.yml` shows how to run the images. APK/OTA publishing stays local (needs the signing key). `docker/compose.example.yml` shows how to run the images. APK/OTA publishing stays local (needs the signing key).