feat(docker): publish official runtime image ghcr.io/objectstack-ai/objectstack - #2952
Merged
Merged
Conversation
…bjectstack Ship an official, versioned runtime image instead of only a copy-me example: - docker/Dockerfile: app-agnostic runtime — node:22-slim + pinned @objectstack/cli + `os start`, non-root `node` user, /api/v1/health HEALTHCHECK, OS_ARTIFACT_PATH/OS_PORT preset, OCI source labels. - .github/workflows/docker-publish.yml: reusable workflow (workflow_call + workflow_dispatch) building multi-arch (amd64/arm64) and pushing tags X.Y.Z / X.Y / X / latest, tag = published @objectstack/cli version, with a post-push `os --version` smoke test. Dispatch path covers base-image CVE rebuilds between releases. - release.yml: expose published/cli-version outputs from the changesets step and call docker-publish after every successful npm publish (a tags trigger would never fire — tags are pushed with GITHUB_TOKEN). - examples/docker: runtime stage now extends the official image; README documents tag pinning and the no-build mount path. - docs/deployment/self-hosting: Docker section leads with the official image (mount-and-run + extend), keeps a self-built equivalent for air-gapped registries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0162o68e5w3bpUBEVRQboUGG
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
os-zhuang
added
skip-changeset
Claude
…dd changeset The docker e2e builds examples/docker, whose runtime stage is now FROM ghcr.io/objectstack-ai/objectstack — a tag that doesn't exist until the first release publishes it. Build that base locally from docker/Dockerfile inside the job instead of pulling: kills the chicken-and-egg AND makes every PR exercise the official runtime Dockerfile itself. Also trigger the e2e on docker/** changes, and add the feature changeset (minor on @objectstack/cli). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0162o68e5w3bpUBEVRQboUGG
os-zhuang
marked this pull request as ready for review
July 15, 2026 07:41
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
ObjectStack 此前只提供
examples/docker里的"复制进你项目"参考 Dockerfile,没有官方镜像。本 PR 发布官方 runtime 镜像ghcr.io/objectstack-ai/objectstack:面向开发商的通用生产运行时(Node 22 + 锁版本@objectstack/cli+os start),开发商FROM它 +COPY自己的 artifact 即完成生产部署,甚至可以直接挂载 artifactdocker run,主机无需任何 Node 工具链。变更内容
官方镜像
docker/Dockerfile:app 无关的 runtime — 非 rootnode用户、/api/v1/healthHEALTHCHECK、预置OS_ARTIFACT_PATH/OS_PORT=8080、OCI source labels;CLI 版本由 CI 通过OS_CLI_VERSIONbuild-arg 锁定。docker/README.md:tag 策略(X.Y.Z/X.Y/X/latest,与@objectstack/cli版本一一对应)、两种用法(extend / 直接挂载运行)、运行时必须注入的三个密钥变量(OS_DATABASE_URL/OS_AUTH_SECRET/OS_SECRET_KEY)。发布流水线
.github/workflows/docker-publish.yml:reusable workflow(workflow_call+workflow_dispatch),buildx 多架构(amd64/arm64)推送 ghcr,推送后os --version冒烟。workflow_dispatch路径用于两次发版之间的基础镜像 CVE 重建。.github/workflows/release.yml:changesets 发布成功后提取@objectstack/cli版本并调用 docker-publish。不用on: push: tags触发——release 工作流用GITHUB_TOKEN推 tag,GitHub 会抑制由此产生的 workflow 触发,tag 触发器永远不会点火。文档与示例
examples/docker/Dockerfile:runtime 阶段改为FROM ghcr.io/objectstack-ai/objectstack(健康检查、env、非 root 均继承),最终镜像只叠加编译产物;README 说明 tag 钉版与免构建路径。content/docs/deployment/self-hosting.mdx:Docker 章节改为以官方镜像为主路径(挂载直跑 + extend 两种),保留自建等价 Dockerfile 供 air-gapped 场景。验证
release → docker正确,caller 授予 callee 所需的packages: write。workflow_dispatch一个已发布版本,如14.8.0)时需确认 ghcr 推送与冒烟步骤通过。备注
create-objectstack脚手架模板可默认带上 examples/docker 三件套;README 增加 docker 快速开始入口。🤖 Generated with Claude Code
https://claude.ai/code/session_0162o68e5w3bpUBEVRQboUGG