Add cache to container build (#35697)

add mount cache directives to container builds, which speeds up local builds bypassing node and go package download entirely on second build and caching go compilation. drop job level split on regular/rootless, which allows to reuse the previously made stage for rootless, skipping duplicate builds in CI. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2025-11-12 09:40:11 +01:00 · 2025-11-02 10:42:25 +01:00 · 2025-11-02 10:42:25 +01:00 · 685c8c314f
commit 685c8c314f
parent 5cb453c01b
7 changed files with 109 additions and 162 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -74,6 +74,9 @@ cpu.out
 /VERSION
 /.air
 /.go-licenses
+/Dockerfile
+/Dockerfile.rootless
+/.venv

 # Files and folders that were previously generated
 /public/assets/img/webpack
--- a/.github/workflows/pull-docker-dryrun.yml
+++ b/.github/workflows/pull-docker-dryrun.yml
@ -11,25 +11,23 @@ jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml

-  regular:
+  container:
    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
+      - uses: actions/checkout@v5
      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v5
+      - name: Build regular container image
+        uses: docker/build-push-action@v5
        with:
+          context: .
          push: false
          tags: gitea/gitea:linux-amd64
-
-  rootless:
-    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    steps:
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v5
+      - name: Build rootless container image
+        uses: docker/build-push-action@v5
        with:
+          context: .
          push: false
          file: Dockerfile.rootless
          tags: gitea/gitea:linux-amd64
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@ -56,7 +56,7 @@ jobs:
      - name: upload binaries to s3
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
-  nightly-docker-rootful:
+  nightly-container:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
      packages: write # to publish to ghcr.io
@ -65,10 +65,6 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - name: Get cleaned branch name
@ -76,6 +72,29 @@ jobs:
        run: |
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: |-
+            gitea/gitea
+            ghcr.io/go-gitea/gitea
+          tags: |
+            type=raw,value=${{ steps.clean_name.outputs.branch }}
+          annotations: |
+            org.opencontainers.image.authors="maintainers@gitea.io"
+      - uses: docker/metadata-action@v5
+        id: meta_rootless
+        with:
+          images: |-
+            gitea/gitea
+            ghcr.io/go-gitea/gitea
+          # each tag below will have the suffix of -rootless
+          flavor: |
+            suffix=-rootless
+          tags: |
+            type=raw,value=${{ steps.clean_name.outputs.branch }}
+          annotations: |
+            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@ -87,57 +106,20 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: fetch go modules
-        run: make vendor
-      - name: build rootful docker image
+      - name: build regular docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
-          tags: |-
-            gitea/gitea:${{ steps.clean_name.outputs.branch }}
-            ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}
-  nightly-docker-rootless:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@v5
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
-      - name: Get cleaned branch name
-        id: clean_name
-        run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
-          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: fetch go modules
-        run: make vendor
+          tags: ${{ steps.meta.outputs.tags }}
+          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless docker image
        uses: docker/build-push-action@v5
        with:
          context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: |-
-            gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
-            ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
+          tags: ${{ steps.meta_rootless.outputs.tags }}
+          annotations: ${{ steps.meta_rootless.outputs.annotations }}
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@ -66,7 +66,7 @@ jobs:
          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --draft --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-  docker-rootful:
+  container:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
      packages: write # to publish to ghcr.io
@ -88,38 +88,10 @@ jobs:
          # 1.2.3-rc0
          tags: |
            type=semver,pattern={{version}}
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build rootful docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-  docker-rootless:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@v5
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+          annotations: |
+            org.opencontainers.image.authors="maintainers@gitea.io"
      - uses: docker/metadata-action@v5
-        id: meta
+        id: meta_rootless
        with:
          images: |-
            gitea/gitea
@ -131,6 +103,8 @@ jobs:
          # 1.2.3-rc0
          tags: |
            type=semver,pattern={{version}}
+          annotations: |
+            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@ -142,12 +116,20 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build rootless docker image
+      - name: build regular container image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+      - name: build rootless container image
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta_rootless.outputs.tags }}
+          annotations: ${{ steps.meta_rootless.outputs.annotations }}
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@ -70,7 +70,7 @@ jobs:
          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-  docker-rootful:
+  container:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
      packages: write # to publish to ghcr.io
@ -96,36 +96,10 @@ jobs:
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build rootful docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-  docker-rootless:
-    runs-on: namespace-profile-gitea-release-docker
-    steps:
-      - uses: actions/checkout@v5
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+          annotations: |
+            org.opencontainers.image.authors="maintainers@gitea.io"
      - uses: docker/metadata-action@v5
-        id: meta
+        id: meta_rootless
        with:
          images: |-
            gitea/gitea
@ -142,6 +116,8 @@ jobs:
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
+          annotations: |
+            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@ -153,12 +129,20 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build rootless docker image
+      - name: build regular container image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+      - name: build rootless container image
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta_rootless.outputs.tags }}
+          annotations: ${{ steps.meta_rootless.outputs.annotations }}
--- a/38
+++ b/38
@ -1,8 +1,8 @@
+# syntax=docker/dockerfile:1
 # Build stage
 FROM docker.io/library/golang:1.25-alpine3.22 AS build-env

-ARG GOPROXY
-ENV GOPROXY=${GOPROXY:-direct}
+ARG GOPROXY=direct

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
@ -14,22 +14,24 @@ RUN apk --no-cache add \
    build-base \
    git \
    nodejs \
-    npm \
-    && npm install -g pnpm@10 \
-    && rm -rf /var/cache/apk/*
+    pnpm

-# Setup repo
-COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+# Use COPY but not "mount" because some directories like "node_modules" contain platform-depended contents and these directories need to be ignored.
+# ".git" directory will be mounted later separately for getting version data.
+# TODO: in the future, maybe we can pre-build the frontend assets on one platform and share them for different platforms, the benefit is that it won't be affected by webpack plugin compatibility problems, then the working directory can be fully mounted and the COPY is not needed.
+COPY --exclude=.git/ . .

-# Checkout version if set
-RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
- && make clean-all build
+# Build gitea, .git mount is required for version data
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target="/root/.cache/go-build" \
+    --mount=type=cache,target=/root/.local/share/pnpm/store \
+    --mount=type=bind,source=".git/",target=".git/" \
+    make

-# Copy local files
 COPY docker/root /tmp/local

-# Set permissions
+# Set permissions for builds that made under windows which strips the executable bit from file
 RUN chmod 755 /tmp/local/usr/bin/entrypoint \
              /tmp/local/usr/local/bin/* \
              /tmp/local/etc/s6/gitea/* \
@ -37,8 +39,7 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
              /tmp/local/etc/s6/.s6-svscan/* \
              /go/src/code.gitea.io/gitea/gitea

-FROM docker.io/library/alpine:3.22
-LABEL maintainer="maintainers@gitea.io"
+FROM docker.io/library/alpine:3.22 AS gitea

 EXPOSE 22 3000

@ -53,8 +54,7 @@ RUN apk --no-cache add \
    s6 \
    sqlite \
    su-exec \
-    gnupg \
-    && rm -rf /var/cache/apk/*
+    gnupg

 RUN addgroup \
    -S -g 1000 \
@ -68,6 +68,9 @@ RUN addgroup \
    git && \
  echo "git:*" | chpasswd -e

+COPY --from=build-env /tmp/local /
+COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+
 ENV USER=git
 ENV GITEA_CUSTOM=/data/gitea

@ -75,6 +78,3 @@ VOLUME ["/data"]

 ENTRYPOINT ["/usr/bin/entrypoint"]
 CMD ["/usr/bin/s6-svscan", "/etc/s6"]
-
-COPY --from=build-env /tmp/local /
-COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@ -1,40 +1,39 @@
+# syntax=docker/dockerfile:1
 # Build stage
 FROM docker.io/library/golang:1.25-alpine3.22 AS build-env

-ARG GOPROXY
-ENV GOPROXY=${GOPROXY:-direct}
+ARG GOPROXY=direct

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

-#Build deps
+# Build deps
 RUN apk --no-cache add \
    build-base \
    git \
    nodejs \
-    npm \
-    && npm install -g pnpm@10 \
-    && rm -rf /var/cache/apk/*
+    pnpm

-# Setup repo
-COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+# See the comments in Dockerfile
+COPY --exclude=.git/ . .

-# Checkout version if set
-RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
- && make clean-all build
+# Build gitea, .git mount is required for version data
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target="/root/.cache/go-build" \
+    --mount=type=cache,target=/root/.local/share/pnpm/store \
+    --mount=type=bind,source=".git/",target=".git/" \
+    make

-# Copy local files
 COPY docker/rootless /tmp/local

-# Set permissions
+# Set permissions for builds that made under windows which strips the executable bit from file
 RUN chmod 755 /tmp/local/usr/local/bin/* \
              /go/src/code.gitea.io/gitea/gitea

-FROM docker.io/library/alpine:3.22
-LABEL maintainer="maintainers@gitea.io"
+FROM docker.io/library/alpine:3.22 AS gitea-rootless

 EXPOSE 2222 3000

@ -46,8 +45,7 @@ RUN apk --no-cache add \
    git \
    curl \
    gnupg \
-    openssh-keygen \
-    && rm -rf /var/cache/apk/*
+    openssh-keygen

 RUN addgroup \
    -S -g 1000 \