ghcr.io — registry policy, a
source-audit requirement, or a build network that only reaches your own
Artifactory or Nexus — build the same image CI builds. The entire build runs
inside Docker: code generation, the frontend, the docs, the Go binary, and
the full test suite, so a build that succeeds is a tested build. Git and
Docker (with BuildKit) are the only host requirements.
VERSION — it becomes the
version the instance reports (in the app footer, logs, and telemetry), which
upgrade tooling and support will ask for.
Every image the repository builds
The command above builds the product image, the Dockerfile’s default target and the only image published toghcr.io. The same checkout builds two more
for the load-testing harness described in
Load Tests. Those are
not published: building them here and pushing them to your own registry is
how you get them.
To build and push the load-test images next to the product image:
What the build downloads
Every host the build contacts, and the build arg that repoints it:
The mock upstream’s Dockerfile honors the same
GOLANG_IMAGE,
ALPINE_IMAGE and GOPROXY args; it installs no npm or apk packages, so the
other two don’t apply to it.
Building the docs embedded in the image contacts five more hosts. No build
arg repoints them:
The docs are a required part of the image. If the build can’t reach one of
these hosts, the build fails. Because the assets are copied into the image,
the docs a running instance serves load nothing from these hosts or any
other external host.
Nothing else is contacted. Code generation runs locally inside the build,
and dependency integrity comes from the hashes committed in
go.sum and the
npm lockfiles — no external checksum service is consulted, and a mirror
can’t substitute a package unnoticed. npm re-points lockfile URLs from the
default registry to the one you configure.
A fully repointed build looks like:
Dockerfile
for the tag you’re building — they’re part of the tested build.
If your network uses a forward proxy rather than registry mirrors, Docker’s
predefined http_proxy / https_proxy / no_proxy build args cover the Go,
npm and Alpine package downloads with no per-ecosystem configuration.
The build downloads the docs icons, CSS and fonts directly, not through the
proxy, so allow their four hosts through your firewall.
Running your build
Point your deployment at the pushed image:image.repository / image.tag
with the Helm chart (see
Private registries),
the image: line in raw manifests, or the image in your docker run
command. Upgrades are the same loop — check out the new tag, build, push,
roll — reading the changelog’s Upgrade
notes first, as with any upgrade.
The load-test images go wherever Load Tests
says to deploy them, by the names you pushed them under.
What the running instance downloads is a separate, deliberately short list —
see Network Access.