mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-22 07:54:17 +00:00
7643f4f541
* rust: a seaweed-common crate for the address and TLS helpers both crates carry seaweed-volume and seaweed-worker are separate cargo trees with separate lockfiles and no root manifest, so anything both of them need has had to be written twice. Two of those copies are a correctness risk rather than a typing cost, and this crate is where they stop being copies. address.rs is the HTTP<->gRPC port rule: `host:port` means gRPC on port+10000, `host:port.grpcPort` names it outright. The two copies had already drifted — the worker's bracketed IPv6 literals, the volume server's did not — so the rule lives here once, returning a typed AddressError whose Display text is the volume server's original wording, with join_host_port public beside it. A test asserts two of those messages in full rather than by substring, because the wording is the contract its callers hand to a Status or an io::Error; the other three end in a std ParseIntError message, which is std's to reword. The enum is #[non_exhaustive] so a future variant is not a breaking change for either consumer. The tests are both crates' cases together, plus the IPv6, already-bracketed and normalisation cases neither copy covered on its own. tls.rs is install_default_crypto_provider. Both binaries link aws-lc-rs and ring transitively, so rustls cannot auto-select and tonic's client TLS panics on first use; each binary has to pin one and it has to be the same one, which is exactly the kind of choice that should not exist twice. It is safe to share because `cargo tree -i rustls` resolves a single rustls in each tree (0.23.37 in seaweed-volume, 0.23.43 in seaweed-worker) and cargo unifies all semver-compatible `rustls = "0.23"` requirements into one crate per binary, so this crate writes the same process-wide static its consumer reads. rustls is already in both graphs — directly in the volume server, through tonic's tls-aws-lc in seaweed-worker-core — so the dependency adds no crate to either. rust-version is 1.91.1, the lower of the two consumers' floors, so depending on this crate cannot raise either tree's MSRV; verified with `cargo +1.91.1 check --all-targets`. The lockfile is committed even though this is a library: CI builds it directly, so a committed lock is what makes those runs reproducible and their caches stable. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * rust: take the address and TLS helpers from seaweed-common Both public signatures are kept, so no caller outside the two wrapper files changes. parse_grpc_address stays `Result<String, String>` and maps the typed error through Display; server_to_grpc_address stays `Option<String>` and drops it with .ok(). Their doc comments and the volume server's 13 call sites are otherwise untouched. Three behaviours change, each in the direction of the copy that was already right: - The volume server now brackets IPv6 literals. `::1:19333` used to come back as `::1:29333`, which build_grpc_endpoint rejects with "invalid gRPC endpoint http://::1:19333: invalid authority" — an IPv6 master or EC peer could not be dialled at all. Two tests in grpc_client.rs pin it, one on the string and one on the endpoint the string builds. - The volume server now emits the *parsed* gRPC port of the dotted form instead of the original text it had just validated, so `host:8080.018080` and `host:8080.+18080` come back as `host:18080` rather than as authorities the URI parser rejects. Same port either way; only malformed spellings change. - The worker's dotted form now validates the HTTP port it discards. `server_to_grpc_address("host:abc.18080")` used to answer Some("host:18080"); it now answers None, which is what the volume server's copy has always done. install_default_crypto_provider becomes a re-export in both trees, so `crate::security::tls::install_default_crypto_provider` and `weed_lance_worker::tls::install_default_crypto_provider` still resolve. The lance crate's `rustls = "0.23"` was its only direct use of rustls and goes away with the body; seaweed-common states the same requirement, so neither the resolved version nor the enabled features move in either lockfile. The PEM test fixtures stay where they are. The two tests that use them are not duplicates: the volume server's exercises build_grpc_endpoint, and the lance one exists precisely because aws-lc-rs and ring are both linked in that crate's graph. Only the literals are shared, and exporting test fixtures from a library to dedupe two constants costs more than it saves. A path dependency outside both trees means every build context that copies one crate directory has to copy the other. The repo has one: the Rust source-build stage of docker/Dockerfile.go_build, which now copies seaweed-common beside seaweed-volume. Every workflow whose `paths:` filter keys on a crate directory gains `seaweed-common/**` — the two Rust test workflows, rust_binaries_dev, container_dev and performance. The tag- and dispatch-triggered ones (rust_binaries_release, container_release_unified, container_latest) have no `paths:` filter and need nothing. The two Rust test workflows also run `cargo test` in seaweed-common, from their unit-test job, because a path dependency is not a workspace member and neither tree's own `cargo test` reaches it. Each step builds into its job's cached target directory, and both cache keys now hash seaweed-common/Cargo.lock as well so a change there invalidates the cache it would otherwise silently reuse. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docker: keep go_build working for BRANCH revisions without seaweed-common The rust_builder stage copies seaweed-common unconditionally now that seaweed-volume path-depends on it, but BRANCH can name any revision — including ones that predate the crate. Create the directory in the builder stage so the COPY always has a source; an empty dir beside an old seaweed-volume is harmless. --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Chris Lu <chris.lu@gmail.com>
127 lines
5.7 KiB
Docker
127 lines
5.7 KiB
Docker
# Pin the builder to the host arch and cross-compile the (CGO-free) Go binary,
|
|
# so arm64/arm/386 targets skip QEMU emulation of the whole compile.
|
|
FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
|
|
RUN apk add git g++ fuse
|
|
RUN mkdir -p /go/src/github.com/seaweedfs/
|
|
ARG BRANCH=${BRANCH:-master}
|
|
# Clone with full history and all tags to ensure all commits are available
|
|
RUN git clone --no-single-branch --tags https://github.com/seaweedfs/seaweedfs /go/src/github.com/seaweedfs/seaweedfs
|
|
ARG TAGS
|
|
RUN cd /go/src/github.com/seaweedfs/seaweedfs && \
|
|
(git checkout $BRANCH || \
|
|
(echo "Checkout failed, fetching all history..." && \
|
|
git fetch --all --tags --prune && \
|
|
git checkout $BRANCH) || \
|
|
(echo "ERROR: Branch/commit $BRANCH not found in repository" && \
|
|
echo "Available branches:" && git branch -a && exit 1))
|
|
# seaweed-common only exists on revisions that have it; a BRANCH predating it
|
|
# still needs the directory so the COPY into rust_builder below never fails.
|
|
RUN mkdir -p /go/src/github.com/seaweedfs/seaweedfs/seaweed-common
|
|
ARG TARGETOS TARGETARCH TARGETVARIANT
|
|
RUN cd /go/src/github.com/seaweedfs/seaweedfs/weed \
|
|
&& export LDFLAGS="-X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=$(git rev-parse --short HEAD)" \
|
|
&& export GOOS=$TARGETOS GOARCH=$TARGETARCH \
|
|
&& case "$TARGETARCH" in arm) export GOARM="${TARGETVARIANT#v}";; esac \
|
|
&& CGO_ENABLED=0 go build -tags "$TAGS" -ldflags "-extldflags -static ${LDFLAGS}" -o /go/bin/weed .
|
|
|
|
# Rust volume server: use pre-built binary from CI when available (placed in
|
|
# weed-volume-prebuilt/ by the build-rust-binaries job), otherwise compile
|
|
# from source. Pre-building avoids a multi-hour QEMU-emulated cargo build
|
|
# for non-native architectures.
|
|
FROM alpine:3.23 as rust_builder
|
|
ARG TARGETARCH
|
|
ARG TAGS
|
|
COPY weed-volume-prebuilt/ /prebuilt/
|
|
COPY weed-worker-prebuilt/ /prebuilt-worker/
|
|
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-volume /build/seaweed-volume
|
|
# seaweed-common is a path dependency of seaweed-volume that lives beside it,
|
|
# so the source build below needs it in the same relative position.
|
|
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-common /build/seaweed-common
|
|
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/weed /build/weed
|
|
WORKDIR /build/seaweed-volume
|
|
RUN if [ -f "/prebuilt/weed-volume-${TARGETARCH}" ]; then \
|
|
echo "Using pre-built Rust binary for ${TARGETARCH}" && \
|
|
cp "/prebuilt/weed-volume-${TARGETARCH}" /weed-volume; \
|
|
elif [ "$TARGETARCH" = "amd64" ] || [ "$TARGETARCH" = "arm64" ]; then \
|
|
apk add --no-cache musl-dev openssl-dev protobuf-dev git rust cargo; \
|
|
if [ "$TAGS" = "5BytesOffset" ]; then \
|
|
cargo build --release; \
|
|
else \
|
|
cargo build --release --no-default-features; \
|
|
fi && \
|
|
cp target/release/weed-volume /weed-volume; \
|
|
else \
|
|
echo "Skipping Rust build for $TARGETARCH (unsupported)" && \
|
|
touch /weed-volume; \
|
|
fi
|
|
# The Rust maintenance worker is taken pre-built or not at all: the lance jobs
|
|
# it carries pull in arrow and datafusion, a far larger dependency tree than
|
|
# the image build can carry, so an architecture CI did not build for gets the
|
|
# same empty placeholder the entrypoint refuses to exec.
|
|
RUN if [ -f "/prebuilt-worker/weed-worker-${TARGETARCH}" ]; then \
|
|
echo "Using pre-built Rust worker for ${TARGETARCH}" && \
|
|
cp "/prebuilt-worker/weed-worker-${TARGETARCH}" /weed-worker; \
|
|
else \
|
|
echo "No pre-built Rust worker for ${TARGETARCH}" && \
|
|
touch /weed-worker; \
|
|
fi
|
|
|
|
# Pre-built binaries arrive via GitHub Actions artifacts, which drop the
|
|
# executable bit, so the copied file is 0644 and exec fails with "Permission
|
|
# denied". Restore it (no-op for the empty placeholders, which stay size 0).
|
|
RUN chmod 0755 /weed-volume /weed-worker
|
|
|
|
FROM alpine AS final
|
|
LABEL author="Chris Lu"
|
|
COPY --from=builder /go/bin/weed /usr/bin/
|
|
# Copy Rust volume server binary (real binary on amd64/arm64, empty placeholder on other platforms)
|
|
COPY --from=rust_builder /weed-volume /usr/bin/weed-volume
|
|
# Same for the Rust maintenance worker, which serves Lance table buckets
|
|
COPY --from=rust_builder /weed-worker /usr/bin/weed-worker
|
|
RUN mkdir -p /etc/seaweedfs
|
|
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer.toml /etc/seaweedfs/filer.toml
|
|
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
|
|
|
|
# FIPS 140-3 mode is ON by default (Go 1.24+)
|
|
# To disable: docker run -e GODEBUG=fips140=off ...
|
|
|
|
# Install dependencies and create non-root user
|
|
RUN apk upgrade --no-cache && \
|
|
apk add --no-cache fuse curl su-exec libgcc libcrypto3 libssl3 && \
|
|
addgroup -g 1000 seaweed && \
|
|
adduser -D -u 1000 -G seaweed seaweed
|
|
|
|
# volume server gprc port
|
|
EXPOSE 18080
|
|
# volume server http port
|
|
EXPOSE 8080
|
|
# filer server gprc port
|
|
EXPOSE 18888
|
|
# filer server http port
|
|
EXPOSE 8888
|
|
# master server shared gprc port
|
|
EXPOSE 19333
|
|
# master server shared http port
|
|
EXPOSE 9333
|
|
# s3 server http port
|
|
EXPOSE 8333
|
|
# webdav server http port
|
|
EXPOSE 7333
|
|
|
|
# Create data directory and set proper ownership for seaweed user
|
|
RUN mkdir -p /data/filerldb2 && \
|
|
chown -R seaweed:seaweed /data && \
|
|
chown -R seaweed:seaweed /etc/seaweedfs && \
|
|
chmod 755 /entrypoint.sh
|
|
|
|
VOLUME /data
|
|
WORKDIR /data
|
|
|
|
# Entrypoint will handle permission fixes and user switching
|
|
ENTRYPOINT ["/entrypoint.sh"]
|
|
# Default to a complete single-process cluster (master+volume+filer+S3+admin)
|
|
# so the image is usable out of the box — including in environments like
|
|
# GitHub Actions service containers that cannot pass arguments to the entrypoint.
|
|
# Override with any other subcommand at `docker run` / compose time.
|
|
CMD ["mini", "-dir=/data"]
|