Skip to content

feat: 优化docker镜像构建逻辑，预计可从原来33分钟提升到十分钟之内 #315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Sep 24, 2025
Merged

feat: 优化docker镜像构建逻辑，预计可从原来33分钟提升到十分钟之内 #315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2c4fa03
refactor(docker): 优化Docker构建流程，支持多平台编译
eryajf Sep 24, 2025
a548a88
refactor(workflow): 更新DockerHub和AliHub用户名及镜像仓库名称，移除冗余构建步骤
eryajf Sep 24, 2025
bef455f
refactor(workflow): 简化CI流程，移除GHCR推送并更新actions版本
eryajf Sep 24, 2025
953dcc2
refactor(docker): 合并RUN指令并优化helm安装流程
eryajf Sep 24, 2025
46fde7f
refactor(workflow): 更新actions版本至v5/v3并调整阿里云镜像仓库名称
eryajf Sep 24, 2025
2668936
refactor(workflow): 更新DockerHub和AliHub用户名及镜像仓库名称，启用GHCR推送并添加相关标签
eryajf Sep 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ fabric.properties
go.work
k8m
tmp/
bin/
/def.json
/example.json
/uploads/
Expand Down
63 changes: 25 additions & 38 deletions .github/workflows/build-docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,20 +31,17 @@ env:
OPENAI_API_URL: https://public.chatgpt.k8m.site/v1

jobs:
buildx:
build-docker-image:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [ 18 ]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
- uses: pnpm/action-setup@v4
with:
version: latest
- name: 使用 Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
- name: 使用 Node.js
uses: actions/setup-node@v5
with:
node-version: ${{ matrix.node-version }}
node-version: 18
cache: "pnpm"
cache-dependency-path: "ui/pnpm-lock.yaml"
- name: 编译前端
Expand All @@ -53,23 +50,23 @@ jobs:
pnpm install
pnpm build

- name: 上传到共享
uses: actions/upload-artifact@v4
- name: 设置go环境
uses: actions/setup-go@v6
with:
name: workspace
path: ui/dist
go-version-file: "go.mod"
cache-dependency-path: "go.sum"

buildImage:
needs: buildx
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: 从共享下载
uses: actions/download-artifact@v4
- name: 安装 UPX
uses: crazy-max/ghaction-upx@v3
with:
name: workspace
path: ui/dist # 覆盖当前目录
install-only: true

- name: Set build time variable
run: echo "BUILD_TIME=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV

- name: 编译后端
run: |
make build-linux GIT_COMMIT=${{ github.sha }} GIT_TAG=${{ github.ref_name }} GIT_REPOSITORY=${{ github.repository }} BUILD_DATE=${{ env.BUILD_TIME }} VERSION=${{ github.ref_name }} MODEL=${{ env.OPENAI_API_MODEL }} API_KEY=${{ secrets.OPENAI_API_KEY }} API_URL=${{ env.OPENAI_API_URL }}

Comment on lines +67 to 70
Copy link
Contributor

@coderabbitai coderabbitai bot Sep 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

严重：将 OPENAI_API_KEY 烘焙进镜像二进制（泄露机密）

与 release 流程同样问题：密钥通过 -ldflags 注入，最终进入公开镜像。

删除编译期注入的 API_KEY，运行期通过环境变量注入：

-          make build-linux GIT_COMMIT=${{ github.sha }} GIT_TAG=${{ github.ref_name }} GIT_REPOSITORY=${{ github.repository }} BUILD_DATE={{ env.BUILD_TIME }} VERSION=${{ github.ref_name }} MODEL=${{ env.OPENAI_API_MODEL }} API_KEY=${{ secrets.OPENAI_API_KEY }} API_URL=${{ env.OPENAI_API_URL }}
+          make build-linux GIT_COMMIT=${{ github.sha }} GIT_TAG=${{ github.ref_name }} GIT_REPOSITORY=${{ github.repository }} BUILD_DATE=${{ env.BUILD_TIME }} VERSION=${{ github.ref_name }} MODEL=${{ env.OPENAI_API_MODEL }} API_URL=${{ env.OPENAI_API_URL }}

随后在部署时以 env 方式传入 OPENAI_API_KEY（不写入镜像/二进制）。

我可以同步给出应用读取环境变量的代码改动建议。

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: 编译后端
run: |
make build-linux GIT_COMMIT=${{ github.sha }} GIT_TAG=${{ github.ref_name }} GIT_REPOSITORY=${{ github.repository }} BUILD_DATE=${{ env.BUILD_TIME }} VERSION=${{ github.ref_name }} MODEL=${{ env.OPENAI_API_MODEL }} API_KEY=${{ secrets.OPENAI_API_KEY }} API_URL=${{ env.OPENAI_API_URL }}
- name: 编译后端
run: |
make build-linux GIT_COMMIT=${{ github.sha }} GIT_TAG=${{ github.ref_name }} GIT_REPOSITORY=${{ github.repository }} BUILD_DATE=${{ env.BUILD_TIME }} VERSION=${{ github.ref_name }} MODEL=${{ env.OPENAI_API_MODEL }} API_URL=${{ env.OPENAI_API_URL }}
🤖 Prompt for AI Agents 
.github/workflows/build-docker-image.yml around lines 67-70: the workflow is
passing OPENAI_API_KEY into the build command which causes the secret to be
baked into the binary; remove API_KEY from the make build invocation and any
ldflags that inject it into the binary, update the Makefile/build scripts to
accept no compile-time API key (keep MODEL/API_URL/etc. if needed) and ensure
the application reads OPENAI_API_KEY at runtime from process environment
variables; finally document or update deployment manifests to supply
OPENAI_API_KEY as an environment variable (secrets) to containers instead of
embedding it during build.

- name: Inject slug/short variables
uses: rlespinasse/github-slug-action@v4
Expand All @@ -79,32 +76,32 @@ jobs:
run: echo "::set-output name=today::$(date +'%Y%m%d-%H%M')"

- name: Set up QEMU
uses: docker/setup-qemu-action@v2
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v2
uses: docker/setup-buildx-action@v3

- name: Available platforms
run: echo ${{ steps.buildx.outputs.platforms }}

- name: Login to DockerHub
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
username: ${{ env.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

# 镜像推送到 ghcr 仓库
- name: Login to the ghcr Registry
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GHCR_TOKEN }}

# 镜像推送到 阿里云仓库
- name: Login to the Ali Registry
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
registry: ${{ env.ALIHUB_URL }}
username: ${{ env.ALIHUB_USERNAME }}
Expand All @@ -119,7 +116,6 @@ jobs:
cache-from: type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/${{ env.IMAGE_REPONAME }}:buildcache
cache-to: type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/${{ env.IMAGE_REPONAME }}:buildcache,mode=max
platforms: linux/amd64,linux/arm64
#platforms: linux/amd64
# 给清单打上多个标签
tags: |
${{ env.DOCKERHUB_USERNAME }}/${{ env.IMAGE_REPONAME }}:latest
Expand All @@ -130,13 +126,4 @@ jobs:
${{ env.ALIHUB_URL }}/${{ env.ALIHUB_IMAGE_REPONAME }}/${{ env.IMAGE_REPONAME }}:${{ steps.date.outputs.today }}
ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_REPONAME }}:latest
ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_REPONAME }}:${{ steps.date.outputs.today }}
ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_REPONAME }}:${{ env.GITHUB_REF_NAME }}
build-args: |
GIT_COMMIT=${{ github.sha }}
GIT_TAG=${{ github.ref_name }}
GIT_REPOSITORY=${{ github.repository }}
VERSION=${{ github.ref_name }}
MODEL=${{ env.OPENAI_API_MODEL }}
API_KEY=${{ secrets.OPENAI_API_KEY }}
API_URL=${{ env.OPENAI_API_URL }}
BUILD_DATE=${{ steps.date.outputs.today }}
ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_REPONAME }}:${{ env.GITHUB_REF_NAME }}
11 changes: 4 additions & 7 deletions .github/workflows/build-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,15 @@ env:
jobs:
build-release:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [ 18 ]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
- uses: pnpm/action-setup@v4
with:
version: latest
- name: 使用 Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
- name: 使用 Node.js
uses: actions/setup-node@v5
with:
node-version: ${{ matrix.node-version }}
node-version: 18
cache: "pnpm"
cache-dependency-path: "ui/pnpm-lock.yaml"

Expand Down
38 changes: 9 additions & 29 deletions Dockerfile.action
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,41 +1,21 @@
FROM golang:1.24-alpine AS golang-builder
ARG VERSION
ARG GIT_COMMIT
ARG MODEL
ARG API_KEY
ARG API_URL
ARG GIT_TAG
ARG GIT_REPOSITORY
ARG BUILD_DATE
ENV GOPROXY="https://goproxy.io"

WORKDIR /app

ADD . .

RUN apk add upx
RUN --mount=type=cache,target=/go/pkg/mod \
go build -ldflags "-s -w -X main.Version=$VERSION -X main.GitCommit=$GIT_COMMIT -X main.GitTag=$GIT_TAG -X main.GitRepo=$GIT_REPOSITORY -X main.BuildDate=$BUILD_DATE -X main.InnerModel=$MODEL -X main.InnerApiKey=$API_KEY -X main.InnerApiUrl=$API_URL" -o k8m . && apk add upx && upx -9 k8m

### build final image
FROM alpine:3.21

WORKDIR /app

ENV BINARY_NAME=k8m
ENV TZ=Asia/Shanghai

COPY --from=golang-builder /app/k8m .
ARG TARGETOS
ARG TARGETARCH

RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
&& apk upgrade && apk add --no-cache curl bash inotify-tools alpine-conf busybox-extras tzdata aws-cli tar gzip\
&& apk del alpine-conf && rm -rf /var/cache/* && chmod +x k8m
ADD reload.sh /app/reload.sh
RUN chmod +x /app/reload.sh
ADD reload.sh reload.sh
COPY ./bin/${BINARY_NAME}-${TARGETOS}-${TARGETARCH} ${BINARY_NAME}

RUN export VERIFY_CHECKSUM=false&&curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
RUN helm version
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
&& apk upgrade && apk add --no-cache curl bash inotify-tools alpine-conf busybox-extras tzdata aws-cli helm tar gzip\
&& apk del alpine-conf && rm -rf /var/cache/* && chmod +x k8m && chmod +x /app/reload.sh

#k8m Server
EXPOSE 3618

ENTRYPOINT ["/app/reload.sh","k8m","/app"]
ENTRYPOINT ["/app/reload.sh", "k8m", "/app"]
3 changes: 2 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,8 @@ PLATFORMS := \
# 定义需要编译的Linux平台和架构
# 格式为 GOOS/GOARCH
LINUX_PLATFORMS := \
linux/arm64
linux/arm64 \
linux/amd64

# 默认目标
.PHONY: all
Expand Down
Loading