fork of https://github.com/sourcegraph/zoekt
ci: publish image to ghcr.io (#1042)
author
Keegan Carruthers-Smith
committer
GitHub
date
(Apr 10, 2026, 1:18 PM +0200)
commit
36ce97f2
36ce97f252661089f9abb887e89f7cc8be0ab390
parent
8a4b57b4
8a4b57b4c2b850939c00823424c888b7577c1010
+122
-58
+13
.github/workflows/docker-version.sh
+13
.github/workflows/docker-version.sh
···
1
+
#!/usr/bin/env bash
2
+
3
+
set -euo pipefail
4
+
5
+
# This is the pseudo-version that go.mod uses. We use the same version string
6
+
# so that downstream consumers can line up image versions with module versions.
7
+
version="$(TZ=UTC git --no-pager show \
8
+
--quiet \
9
+
--abbrev=12 \
10
+
--date='format-local:%Y%m%d%H%M%S' \
11
+
--format='0.0.0-%cd-%h')"
12
+
13
+
printf 'value=%s\n' "$version" >>"$GITHUB_OUTPUT"
+59
.github/workflows/docker.yml
+59
.github/workflows/docker.yml
···
1
+
name: Publish Docker Image
2
+
3
+
on:
4
+
push:
5
+
branches:
6
+
- main
7
+
tags:
8
+
- 'v*'
9
+
workflow_dispatch:
10
+
11
+
jobs:
12
+
docker:
13
+
runs-on: ubuntu-latest
14
+
permissions:
15
+
contents: read
16
+
packages: write
17
+
steps:
18
+
- name: checkout
19
+
uses: actions/checkout@v4
20
+
with:
21
+
fetch-depth: 0
22
+
23
+
- name: version
24
+
id: version
25
+
run: .github/workflows/docker-version.sh
26
+
27
+
- name: setup-buildx
28
+
uses: docker/setup-buildx-action@v3
29
+
30
+
- name: docker-meta
31
+
id: meta
32
+
uses: docker/metadata-action@v5
33
+
with:
34
+
images: ghcr.io/${{ github.repository }}
35
+
tags: |
36
+
type=semver,pattern={{version}}
37
+
type=semver,pattern={{major}}.{{minor}}
38
+
type=raw,value=${{ steps.version.outputs.value }},enable={{is_default_branch}}
39
+
type=raw,value=latest,enable={{is_default_branch}}
40
+
type=sha,prefix=sha-,format=short
41
+
42
+
- name: login to ghcr.io
43
+
uses: docker/login-action@v3
44
+
with:
45
+
registry: ghcr.io
46
+
username: ${{ github.actor }}
47
+
password: ${{ secrets.GITHUB_TOKEN }}
48
+
49
+
- name: build and push
50
+
uses: docker/build-push-action@v6
51
+
with:
52
+
context: .
53
+
push: true
54
+
tags: ${{ steps.meta.outputs.tags }}
55
+
labels: ${{ steps.meta.outputs.labels }}
56
+
cache-from: type=gha
57
+
cache-to: type=gha,mode=max
58
+
build-args: |
59
+
VERSION=${{ steps.version.outputs.value }}
+31
-11
Dockerfile
+31
-11
Dockerfile
···
1
-
FROM golang:1.23.4-alpine3.19 AS builder
1
+
# syntax=docker/dockerfile:1.7
2
+
FROM golang:1.26.2-alpine AS builder
2
3
3
4
RUN apk add --no-cache ca-certificates
4
5
5
6
ENV CGO_ENABLED=0
6
-
WORKDIR /go/src/github.com/sourcegraph/zoekt
7
+
WORKDIR /src
7
8
8
-
# Cache dependencies
9
+
# Cache dependency resolution separately from source changes.
9
10
COPY go.mod go.sum ./
10
-
RUN go mod download
11
+
RUN --mount=type=cache,target=/go/pkg/mod \
12
+
go mod download
11
13
12
-
COPY . ./
13
-
ARG VERSION
14
-
RUN go install -ldflags "-X github.com/sourcegraph/zoekt.Version=$VERSION" ./cmd/...
14
+
COPY . .
15
+
ARG VERSION=dev
16
+
RUN --mount=type=cache,target=/go/pkg/mod \
17
+
--mount=type=cache,target=/root/.cache/go-build \
18
+
mkdir -p /out && \
19
+
go build \
20
+
-trimpath \
21
+
-ldflags "-X github.com/sourcegraph/zoekt.Version=$VERSION" \
22
+
-o /out/ \
23
+
./cmd/...
15
24
16
-
FROM alpine:3.19 AS zoekt
25
+
FROM alpine:3
17
26
18
27
RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget
19
28
20
-
COPY install-ctags-alpine.sh .
21
-
RUN ./install-ctags-alpine.sh && rm install-ctags-alpine.sh
29
+
COPY --chmod=755 install-ctags-alpine.sh /usr/local/bin/install-ctags-alpine.sh
30
+
RUN /usr/local/bin/install-ctags-alpine.sh && rm /usr/local/bin/install-ctags-alpine.sh
31
+
32
+
RUN addgroup -S zoekt && \
33
+
adduser -S -G zoekt -h /home/zoekt zoekt && \
34
+
mkdir -p /data/index /home/zoekt && \
35
+
chown -R zoekt:zoekt /data /home/zoekt
22
36
23
-
COPY --from=builder /go/bin/* /usr/local/bin/
37
+
COPY --from=builder /out/ /usr/local/bin/
38
+
39
+
USER zoekt
40
+
WORKDIR /home/zoekt
41
+
42
+
ENV DATA_DIR=/data/index
24
43
25
44
ENTRYPOINT ["/sbin/tini", "--"]
45
+
CMD ["zoekt-webserver", "-index", "/data/index", "-pprof", "-rpc"]
-23
Dockerfile.indexserver
-23
Dockerfile.indexserver
···
1
-
FROM alpine:3.19
2
-
3
-
RUN apk add --no-cache ca-certificates bind-tools tini git jansson
4
-
5
-
# Run as non-root user sourcegraph. External volumes should be mounted under /data (which will be owned by sourcegraph).
6
-
RUN mkdir -p /home/sourcegraph
7
-
RUN addgroup -S sourcegraph && adduser -S -G sourcegraph -h /home/sourcegraph sourcegraph && mkdir -p /data && chown -R sourcegraph:sourcegraph /data
8
-
USER sourcegraph
9
-
WORKDIR /home/sourcegraph
10
-
11
-
ENV SRC_FRONTEND_INTERNAL http://sourcegraph-frontend-internal
12
-
ENV DATA_DIR /data/index
13
-
RUN mkdir -p ${DATA_DIR}
14
-
15
-
COPY --from=zoekt \
16
-
/usr/local/bin/universal-* \
17
-
/usr/local/bin/zoekt-sourcegraph-indexserver \
18
-
/usr/local/bin/zoekt-archive-index \
19
-
/usr/local/bin/zoekt-git-index \
20
-
/usr/local/bin/zoekt-merge-index \
21
-
/usr/local/bin/
22
-
23
-
ENTRYPOINT ["/sbin/tini", "--", "zoekt-sourcegraph-indexserver"]
-24
Dockerfile.webserver
-24
Dockerfile.webserver
···
1
-
FROM alpine:3.19
2
-
3
-
RUN apk add --no-cache ca-certificates bind-tools tini
4
-
5
-
# Run as non-root user sourcegraph. External volumes should be mounted under /data (which will be owned by sourcegraph).
6
-
RUN mkdir -p /home/sourcegraph
7
-
RUN addgroup -S sourcegraph && adduser -S -G sourcegraph -h /home/sourcegraph sourcegraph && mkdir -p /data && chown -R sourcegraph:sourcegraph /data
8
-
USER sourcegraph
9
-
WORKDIR /home/sourcegraph
10
-
11
-
ENV DATA_DIR /data/index
12
-
RUN mkdir -p ${DATA_DIR}
13
-
14
-
# We copy from the locally built zoekt image
15
-
COPY --from=zoekt /usr/local/bin/zoekt-webserver /usr/local/bin/
16
-
17
-
# zoekt-webserver has a large stable heap size (10s of gigs), and as such the
18
-
# default GOGC=100 could be better tuned. https://dave.cheney.net/tag/gogc
19
-
# In go1.18 the GC changed significantly and from experimentation we tuned it
20
-
# down from 50 to 25.
21
-
ENV GOGC=25
22
-
23
-
ENTRYPOINT ["/sbin/tini", "--"]
24
-
CMD zoekt-webserver -index $DATA_DIR -pprof -rpc -indexserver_proxy
+19
README.md
+19
README.md
···
82
82
See the [query syntax docs](doc/query_syntax.md) for more details on the query
83
83
language.
84
84
85
+
#### Container image
86
+
87
+
Zoekt publishes a single container image at `ghcr.io/sourcegraph/zoekt`. It
88
+
includes the Zoekt binaries, `git`, and `universal-ctags`. By default it runs
89
+
`zoekt-webserver` against `/data/index`:
90
+
91
+
docker run --rm -p 6070:6070 -v "$PWD/index:/data/index" ghcr.io/sourcegraph/zoekt
92
+
93
+
You can override the default command to run `zoekt-indexserver` instead. This
94
+
example stores cloned repositories, logs, and indexes under `/data` and reads a
95
+
mounted mirror config file:
96
+
97
+
docker run --rm \
98
+
-v "$PWD/config.json:/config.json:ro" \
99
+
-v "$PWD/token.txt:/home/zoekt/token.txt:ro" \
100
+
-v "$PWD/zoekt-data:/data" \
101
+
ghcr.io/sourcegraph/zoekt \
102
+
zoekt-indexserver -mirror_config /config.json -data_dir /data
103
+
85
104
If you start the web server with `-rpc`, it exposes a [simple JSON search
86
105
API](doc/json-api.md) at `http://localhost:6070/api/search`.
87
106