Add cache to container build #35697

TheFox0x7 · 2025-10-18T17:22:58Z

add mount cache directives to container builds, which speeds up local builds bypassing node and go package download entirely on second build and caching go compilation.
drop job level split on regular/rootless, which allows to reuse the previously made stage for rootless, skipping duplicate builds in CI.

correct permissions on copied files

Avoid copying .git directory into the container

instead of running two jobs compiling the same code, run one and reuse layers

drop platforms from dryrun

TheFox0x7 · 2025-10-18T17:48:03Z

replaces #34876 and #27998 to a lesser degree.

I've tried to trim down CI time further but I can either optimize for local or CI builds because dockers caching system allows to push layers to registry but it does not allow to share mounted cache in any way. I've tried using one action to do so but it did not work at all and maybe for the better as juggling the cache wouldn't be too fun if something went wrong.

It would be possible to optimize for layers here (which I've sort of done) and have them pushed to registry on nightly builds then pulled during every other one but it then removes the mountable cache completely as when both are used they are unreliable (cache is empty and layers apply as if it worked).

docker/root/usr/local/bin/gitea

Dockerfile

Dockerfile.rootless

silverwind · 2025-10-23T06:52:15Z

.github/workflows/release-tag-rc.yml

-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+          annotations: |
+            org.opencontainers.image.authors="[email protected]"


Just add this to the Dockerfiles instead:

LABEL org.opencontainers.image.authors="[email protected]"

Ref: https://docs.docker.com/reference/build-checks/maintainer-deprecated/

Note, Dockerfiles do already have a maintainer label:

gitea/Dockerfile

Line 45 in 8085c75

LABEL maintainer="[email protected]"

It's probably better to use org.opencontainers.image.authors instead, but definitely not two labels for the same thing.

I moved it to tag generation to avoid having implicitly marking user built containers as maintained by gitea, but I can move back into the container if it's not a concern.

Hmm makes sense your way I guess. Would just like to avoid duplication.

It's not required and grows over time. Also exclude containerfiles from the copy so changes in them won't trigger layer invalidation if it's not needed

Dockerfile.rootless

Dockerfile

wxiaoguang · 2025-10-29T02:05:46Z

By the way, to speed up the "github actions release", I can see a much faster approach:

Build release binaries first (they will be released to https://dl.gitea.com/gitea/)
Use these pre-built binaries and just copy them into the container image, no need to build anymore.

(The container build cache can still be supported for developers who need to build the images by themselves)

TheFox0x7 · 2025-10-29T09:09:35Z

How would you keep it sane though? It is a good idea (~~though I thought of it in inverse - take binaries from docker~~ nvm windows builds exist). But I don't see how you'd add the binary without another Dockerfile with ADD for remote resource. That could replace the existing ones sure but then I can't exactly make my own container.
How do you see it?

wxiaoguang · 2025-10-29T09:27:48Z

Just an idea 😄 not sure whether it brings enough value

TheFox0x7 · 2025-10-29T09:31:24Z

I'd say it does but inverse (binary from container) would be simpler to do (safe for windows builds). I can look at it later.

Is the git checkout in container even used btw? I don't exactly see a usecase for it...
I mean I do but I'm not sure why would someone use that instead of checking out the version with git. Maybe I'm missing something?

wxiaoguang · 2025-10-29T09:37:50Z

Is the git checkout in container even used btw? I don't exactly see a usecase for it... I mean I do but I'm not sure why would someone use that instead of checking out the version with git. Maybe I'm missing something?

Agree with you. That checkout came from "Docker multi-stage (#2927)", it seems no real use case for it.

permit to chose the version of the binary build via --build-arg GITEA_VERSION=v1.2.3

If removing it can make the whole system simpler, maybe it's fine to remove it.

If removing it doesn't simplify, maybe it can still be kept for a while.

Update: it just conflicts the GITEA_VERSION used by Makefile:

In Makefile, GITEA_VERSION means always set it as the version, no matter what commit it uses
In Dockerfile, GITEA_VERSION means "checkout the target branch" .....

wxiaoguang

Overall LGTM.

The new approach looks pretty cool and much clearer than before.

wxiaoguang · 2025-10-30T00:31:42Z

Dockerfile

-# Setup repo
-COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+COPY --exclude=.git/ . .


Suggested change

COPY --exclude=.git/ . .

# Use COPY but not "mount" because some directories like "node_modules" contain platform-depended contents and these directories need to be ignored.

# ".git" directory will be mounted later separately for getting version data.

# TODO: in the future, maybe we can pre-build the frontend assets on one platform and share them for different platforms, the benefit is that it won't be affected by webpack plugin compatibility problems, then the working directory can be fully mounted and the COPY is not needed.

COPY --exclude=.git/ . .

@silverwind Maybe you are also interested in this TODO (to see whether it is feasible in the future)

IIRC sometimes the webpack (or esbuild, whatever) plugins have platform compatibility problems, for example: lacking riscv64 support, etc.

Yes, frontend assets only need to be built once. Could run make frontend outside docker, and then if the frontend files have a fresh modified timestamp, Make will skip the target next time.

If that works, we could migrate to rspack, which as of today still does not support RISC-V.

Hm... I'll look at it later. It sounds doable if I figure out how to convince build system to take amd64 frontend for other architectures. I did play with separate stage for frontend when I was trying to optimize for registry cache.
Or prebuilding on host and copying it over would also work and would be simpler to pull off at the cost of not being able to run docker build . for everything.

(no need to be in this PR's scope 😄 )

wxiaoguang · 2025-10-30T00:32:13Z

Dockerfile

 EXPOSE 22 3000

-RUN apk --no-cache add \
+RUN apk add --no-cache \


Can be reverted (and keep consistent with Dockerfile.rootless)

wxiaoguang · 2025-10-30T00:33:02Z

Dockerfile.rootless

-# Setup repo
-COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+COPY --exclude=.git/ . .


Suggested change

COPY --exclude=.git/ . .

# See the comments in Dockerfile

COPY --exclude=.git/ . .

wxiaoguang · 2025-10-30T00:33:17Z

Dockerfile.rootless


 COPY --from=build-env /tmp/local /
-COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env --chmod=755 --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea


--chmod=755 is not needed because there is a complete chmod 755 above

Suggested change

COPY --from=build-env --chmod=755 --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea

COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea

wxiaoguang · 2025-10-30T00:34:07Z

Dockerfile

  echo "git:*" | chpasswd -e

+COPY --from=build-env /tmp/local /
+COPY --chmod=755 --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea


--chmod=755 is not needed because there is a complete chmod 755 above

Suggested change

COPY --chmod=755 --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea

COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea

wxiaoguang · 2025-10-30T00:35:34Z

docker/root/usr/local/bin/gitea

I think we can revert these file mode changes now 😄

Using 0644 can help us to confirm our chmod really work as expected.

silverwind · 2025-10-30T00:38:28Z

.dockerignore

 /.air
 /.go-licenses
+Dockerfile
+Dockerfile.rootless


Why no leading slash? Imho it's better to exactly ignore these files in the root, not ignore them anywhere in the tree.

Actually I think maybe they don't need to be ignored? I guess there should be nothing wrong by keeping them

IMO they should be ignored - if they aren't you end up rebuilding entire container because of a change in a comment in Dockerfile, which I just find annoying if nothing meaningful changes. When working on the dockerfile it's just annoying as let's say you changed package in the assembly stage or directives for binds/cache in RUN make step. Now the COPY digest differs so it ends up running again and has to build gitea from scratch despite nothing of relevance to the build being changed.
You don't hit this unless you're tinkering with the container builds and it was much worse pre-cache since building took 15-30 minutes on my machine due to having to download packages over and over.

silverwind · 2025-10-30T09:27:46Z

.dockerignore

+Dockerfile
+Dockerfile.rootless


Suggested change

Dockerfile

Dockerfile.rootless

/Dockerfile

/Dockerfile.rootless

In any case, let's match exactly.

lunny and others added 14 commits September 29, 2025 23:07

Add mount cache for docker building

062c5f4

experiment

48c432d

update all cache

afba5ff

improvements

b9bc1b8

improvements

efb558a

add mount cache during builds

4b70dd9

correct permissions on copied files

trim down build stage

b4fc88b

Avoid copying .git directory into the container

unify container builds

da539d8

instead of running two jobs compiling the same code, run one and reuse layers

add cache-to and from directives

2421538

avoid copying all files to trim down the build stage

2f9e047

drop remote cache fully

db78470

Merge branch 'main' into container-build-cache

5a927c5

rename jobs

1c08d25

unify naming

c8abefb

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Oct 18, 2025

github-actions bot added the modifies/internal label Oct 18, 2025

TheFox0x7 added 3 commits October 18, 2025 19:28

add checkout so .git is avalible for bind

37cf5db

drop platforms from dryrun

fix bad merge choice

fe925c1

bypass dockers git context

1218db2

TheFox0x7 marked this pull request as ready for review October 18, 2025 17:48

lunny reviewed Oct 18, 2025

View reviewed changes

docker/root/usr/local/bin/gitea Show resolved Hide resolved

lunny reviewed Oct 18, 2025

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

lunny added this to the 1.26.0 milestone Oct 20, 2025

lunny added the topic/build PR changes how Gitea is built, i.e. regarding Docker or the Makefile label Oct 20, 2025

wxiaoguang reviewed Oct 22, 2025

View reviewed changes

Dockerfile.rootless Outdated Show resolved Hide resolved

silverwind reviewed Oct 23, 2025

View reviewed changes

TheFox0x7 added 2 commits October 27, 2025 23:22

exclude git from container build

1aa245f

It's not required and grows over time. Also exclude containerfiles from the copy so changes in them won't trigger layer invalidation if it's not needed

Merge branch 'main' into container-build-cache

0551e5b

wxiaoguang reviewed Oct 29, 2025

View reviewed changes

Dockerfile.rootless Outdated Show resolved Hide resolved

wxiaoguang reviewed Oct 29, 2025

View reviewed changes

Dockerfile Show resolved Hide resolved

wxiaoguang mentioned this pull request Oct 29, 2025

Reduce incremental Docker build times #27998

Closed

TheFox0x7 added 2 commits October 29, 2025 19:06

remove checkout from container

449d2b4

restore chmod for windows based builds

1d5345d

wxiaoguang approved these changes Oct 30, 2025

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Oct 30, 2025

silverwind reviewed Oct 30, 2025

View reviewed changes

-COPY --exclude=.git/ . .
+# Use COPY but not "mount" because some directories like "node_modules" contain platform-depended contents and these directories need to be ignored.
+# ".git" directory will be mounted later separately for getting version data.
+# TODO: in the future, maybe we can pre-build the frontend assets on one platform and share them for different platforms, the benefit is that it won't be affected by webpack plugin compatibility problems, then the working directory can be fully mounted and the COPY is not needed.
+COPY --exclude=.git/ . .

	COPY --exclude=.git/ . .
	# See the comments in Dockerfile
	COPY --exclude=.git/ . .

	COPY --from=build-env --chmod=755 --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
	COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea

	COPY --chmod=755 --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
	COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea

Uh oh!

Add cache to container build #35697

Are you sure you want to change the base?

Add cache to container build #35697

Conversation

TheFox0x7 commented Oct 18, 2025

Uh oh!

TheFox0x7 commented Oct 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

silverwind Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

wxiaoguang commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheFox0x7 commented Oct 29, 2025

Uh oh!

wxiaoguang commented Oct 29, 2025

Uh oh!

TheFox0x7 commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wxiaoguang commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wxiaoguang left a comment

Choose a reason for hiding this comment

Uh oh!

wxiaoguang Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wxiaoguang Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wxiaoguang Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

silverwind Oct 23, 2025 •

edited

Loading

silverwind Oct 23, 2025 •

edited

Loading

wxiaoguang commented Oct 29, 2025 •

edited

Loading

TheFox0x7 commented Oct 29, 2025 •

edited

Loading

wxiaoguang commented Oct 29, 2025 •

edited

Loading

wxiaoguang Oct 30, 2025 •

edited

Loading

wxiaoguang Oct 30, 2025 •

edited

Loading

silverwind Oct 30, 2025 •

edited

Loading

wxiaoguang Oct 30, 2025 •

edited

Loading

silverwind Oct 30, 2025 •

edited

Loading