feat: publish document-rest and document-mcp as GHCR container images - #1241
Merged
Conversation
A container's -p host:container port mapping reaches the container's external network interface, not its loopback -- a process bound only to 127.0.0.1 is unreachable from outside the container regardless of what port Docker maps. --host lets a container's own ENTRYPOINT bind 0.0.0.0 explicitly while every existing caller (npx, the standalone binary) keeps today's loopback-only default unchanged.
A container's -p host:container port mapping reaches the container's external network interface, not its loopback -- a process bound only to 127.0.0.1 is unreachable from outside the container regardless of what port Docker maps. --host lets a container's own ENTRYPOINT bind 0.0.0.0 explicitly while every existing caller (npx, the standalone binary) keeps today's loopback-only default unchanged.
…ages Adds build-container-images (per-architecture build+push) and publish-container-manifests (multi-arch manifest merge via docker buildx imagetools create) as two more post-release jobs, following the exact matrix-building and needs/if-gating pattern the SEA-binary matrix already established. Each image wraps the Linux SEA binary build-sea-binaries already built and uploaded to the release -- downloaded via gh release download, never rebuilt -- on a distroless cc-debian12 base rather than a general-purpose one, since the binary needs only glibc/libstdc++ at runtime and never a shell or package manager. A small multi-stage build step supplies libatomic.so.1, confirmed by direct verification to be the one runtime dependency cc-debian12 doesn't ship on its own (the binary otherwise fails at startup with "cannot open shared object file"). ghcr.io/exadev/documents.js (document-rest) and ghcr.io/exadev/document-mcp (document-mcp) publish under an exact version tag plus a floating latest, latest only from a genuine release run and never from a workflow_dispatch backfill, so a historical catch-up run can never regress it to an older version. document-cli is excluded: it has no server role, only a one-shot CLI/TUI. Verified end to end locally: built a real Linux SEA binary inside a Node container, built both images against it, and ran each with a real docker run -p mapping and curl from the host -- catching the libatomic gap this way rather than by inspection, and confirming the resulting image is a genuinely lightweight ~60MB compressed despite ~256MB uncompressed on disk, the embedded SEA binary itself being the dominant contributor either way.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
🎉 This PR is included in version 4.14.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Contributor
|
🎉 This PR is included in version 1.4.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes ghcr.io/exadev/documents.js (document-rest) and ghcr.io/exadev/document-mcp (document-mcp) as multi-arch (linux/amd64 + linux/arm64) container images on every release. document-cli is excluded -- it has no server role, only a one-shot CLI/TUI.
Wraps the identical Linux SEA binary the existing build-sea-binaries job already builds and uploads to the release, downloaded via gh release download rather than rebuilt. Base image is distroless cc-debian12, not a general-purpose image, since the binary needs only glibc/libstdc++ at runtime and never a shell or package manager.
Two real bugs surfaced while designing and verifying this, both fixed here:
Verified end to end locally: built a real Linux arm64 SEA binary inside a Node container, built both images against it, ran each with a real docker run -p mapping, and curled from the host to confirm actual reachability. Final image is ~256MB uncompressed but ~60MB compressed (the number that matters for a registry pull) -- the embedded SEA binary itself is the dominant contributor to size either way.
Each image publishes under its exact release version plus a floating latest, with latest only ever set from a genuine release run, never a workflow_dispatch backfill, so a historical catch-up can't regress it to an older version.
One manual step needed after the first release of each package following this merge: a brand-new GHCR package defaults to private visibility regardless of this repo's own visibility, so an org admin needs to flip ghcr.io/exadev/documents.js and ghcr.io/exadev/document-mcp to public once each (documented in the root README's Releases section).