Skip to content

Commit a02f033

Browse files
ericallamTrigger.dev RepoOps
ericallam
authored and
Trigger.dev RepoOps
committed
feat(base-images): build the bun base images from official inputs and add node-less 1.3 / 1.4
The bun deploy base images are now built from official upstream inputs, both pinned by digest: the bun binary comes from the `oven/bun` slim image and is layered onto either the `node:20` slim base (the existing `1.3-node20-bookworm` tag, which keeps a node binary) or plain `debian:bookworm-slim` (two new node-less tags, `1.3-bookworm` and `1.4-bookworm`). Each has a `-build` variant with the native-module toolchain and is published for amd64 and arm64. The existing tag keeps bun 1.3.3, the same paths and the same uid 1001, so deployed bun task images are unchanged. This drops the third-party combined bun+node image (and its container-startup telemetry) and gives the bun images the same provenance and Debian snapshot layering as the node images. The node-less images contain no node binary and are not selectable by the CLI yet; they back the versioned bun runtimes that follow. Mono-RevId: 530ee98b63f97da278025f6cfde92a60d890a786
1 parent b9ca103 commit a02f033

4 files changed

Lines changed: 81 additions & 6 deletions

File tree

‎.github/workflows/base-images.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,9 @@ jobs:
6464
printf '%s\0' "$PACKAGES" | grep -zqxE '[a-z0-9][a-z0-9 .+:=~-]*' || { echo "invalid packages value"; exit 1; }
6565
printf '%s\0' "$BUILD_PACKAGES" | grep -zqxE '[a-z0-9][a-z0-9 .+:=~-]*' || { echo "invalid buildPackages value"; exit 1; }
6666
printf '%s\0' "$SUITE" | grep -zqxE '[a-z]+' || { echo "invalid suite value"; exit 1; }
67-
jq -e '.images | length > 0 and all((.repo | test("^[a-z0-9-]+$")) and (.tag | test("^[a-z0-9.-]+$")) and (.base | test("^[a-zA-Z0-9./:@-]+$")))' base-images/images.json > /dev/null \
67+
# runtimeKind/bunSource are optional (node entries omit them); when present they
68+
# feed FROM/COPY, so validate their shape too.
69+
jq -e '.images | length > 0 and all((.repo | test("^[a-z0-9-]+$")) and (.tag | test("^[a-z0-9.-]+$")) and (.base | test("^[a-zA-Z0-9./:@-]+$")) and ((.runtimeKind // "node") | test("^(node|bun)$")) and ((.bunSource // "scratch") | test("^[a-zA-Z0-9./:@-]+$")))' base-images/images.json > /dev/null \
6870
|| { echo "invalid images entries"; exit 1; }
6971
7072
SNAPSHOT="$SNAPSHOT_INPUT"
@@ -146,6 +148,8 @@ jobs:
146148
tags: triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-build
147149
build-args: |
148150
BASE_IMAGE=${{ matrix.image.base }}
151+
RUNTIME_KIND=${{ matrix.image.runtimeKind || 'node' }}
152+
BUN_SOURCE_IMAGE=${{ matrix.image.bunSource || 'scratch' }}
149153
DEBIAN_SNAPSHOT=${{ needs.setup.outputs.snapshot }}
150154
DEBIAN_SUITE=${{ needs.setup.outputs.suite }}
151155
PACKAGES=${{ needs.setup.outputs.packages }}
@@ -174,6 +178,8 @@ jobs:
174178
triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-${{ needs.setup.outputs.publish_id }}
175179
build-args: |
176180
BASE_IMAGE=${{ matrix.image.base }}
181+
RUNTIME_KIND=${{ matrix.image.runtimeKind || 'node' }}
182+
BUN_SOURCE_IMAGE=${{ matrix.image.bunSource || 'scratch' }}
177183
DEBIAN_SNAPSHOT=${{ needs.setup.outputs.snapshot }}
178184
DEBIAN_SUITE=${{ needs.setup.outputs.suite }}
179185
PACKAGES=${{ needs.setup.outputs.packages }}
@@ -199,6 +205,8 @@ jobs:
199205
triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-build-${{ needs.setup.outputs.publish_id }}
200206
build-args: |
201207
BASE_IMAGE=${{ matrix.image.base }}
208+
RUNTIME_KIND=${{ matrix.image.runtimeKind || 'node' }}
209+
BUN_SOURCE_IMAGE=${{ matrix.image.bunSource || 'scratch' }}
202210
DEBIAN_SNAPSHOT=${{ needs.setup.outputs.snapshot }}
203211
DEBIAN_SUITE=${{ needs.setup.outputs.suite }}
204212
PACKAGES=${{ needs.setup.outputs.packages }}

‎base-images/Dockerfile‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,37 @@
55
# from a pinned Debian snapshot, then apt is restored to the live archive.
66

77
ARG BASE_IMAGE
8+
# node entries leave these at their defaults; bun entries set RUNTIME_KIND=bun
9+
# and BUN_SOURCE_IMAGE so the runtime-bun stage below is selected. For node builds
10+
# neither the bun-source stage nor runtime-bun is in the target's graph, so the
11+
# scratch default is never pulled or copied.
12+
ARG RUNTIME_KIND=node
13+
ARG BUN_SOURCE_IMAGE=scratch
814

9-
FROM ${BASE_IMAGE} AS runtime
15+
# We build our own bun images instead of depending on a third-party one: the
16+
# bun binary is copied from the official oven/bun image (pinned by digest in
17+
# images.json) onto either a node slim base (the node+bun "legacy" image, which
18+
# keeps a node binary for tasks that shell out to it) or a plain debian slim base
19+
# (the node-less images, which contain no node at all). Layout matches what
20+
# deployed bun tasks expect: bun on PATH at /usr/local/bin/bun, BUN_INSTALL_BIN
21+
# pointing there (resolved by execPathForRuntime), and a bun user/group at uid/gid
22+
# 1001 (the node base already owns 1000; supervisor pins bun tasks to 1001).
23+
FROM ${BUN_SOURCE_IMAGE} AS bun-source
24+
25+
FROM ${BASE_IMAGE} AS runtime-node
26+
27+
FROM ${BASE_IMAGE} AS runtime-bun
28+
ARG BUN_INSTALL_BIN=/usr/local/bin
29+
ENV BUN_INSTALL_BIN=${BUN_INSTALL_BIN}
30+
# Ephemeral task containers gain nothing from the on-disk transpiler cache.
31+
ENV BUN_RUNTIME_TRANSPILER_CACHE_PATH=0
32+
COPY --from=bun-source /usr/local/bin/bun /usr/local/bin/bun
33+
RUN groupadd bun --gid 1001 && \
34+
useradd bun --uid 1001 --gid bun --shell /bin/sh --create-home && \
35+
ln -sf /usr/local/bin/bun /usr/local/bin/bunx && \
36+
bun --version
37+
38+
FROM runtime-${RUNTIME_KIND} AS runtime
1039

1140
ARG DEBIAN_SNAPSHOT
1241
ARG DEBIAN_SUITE=bookworm

‎base-images/README.md‎

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,38 @@
11
# Deploy base images
22

33
Base images for deployed task containers, published to Docker Hub as
4-
`triggerdotdev/node:<major>-bookworm` and `triggerdotdev/bun:<line>-node<major>-bookworm`,
5-
each with a `-build` variant that adds the native-module toolchain
6-
(python3, make, g++).
4+
`triggerdotdev/node:<major>-bookworm`, `triggerdotdev/bun:<line>-bookworm`
5+
(node-less) and `triggerdotdev/bun:<line>-node<major>-bookworm` (node + bun), each
6+
with a `-build` variant that adds the native-module toolchain (python3, make,
7+
g++).
78

89
Each image is its upstream slim base (pinned by digest in `images.json`) with
910
all preinstalled Debian packages upgraded to the pinned snapshot state, plus
1011
the system packages deployed tasks rely on: busybox, ca-certificates,
1112
dumb-init, git, openssl. apt stays configured for the live Debian archive, so
1213
images derived from these behave like their upstream bases.
1314

15+
### The bun images
16+
17+
The bun images (`runtimeKind: "bun"` in `images.json`) are composed rather than
18+
taken from a single upstream: the bun binary is copied from the official
19+
`oven/bun` slim image (`bunSource`) onto a separately pinned `base`, both by
20+
digest. Two flavours share that mechanism:
21+
22+
- `bun:<line>-node<major>-bookworm` starts from the same `node:<major>-slim`
23+
base as the node images, so a `node` binary stays present for tasks that shell
24+
out to it. This is the `bun-legacy` runtime.
25+
- `bun:<line>-bookworm` starts from `debian:bookworm-slim` and contains **no
26+
node binary**. These back the versioned `bun-1.3` / `bun-1.4` runtimes; a task
27+
that spawns `node` must stay on the node + bun image or add node itself.
28+
29+
Both give bun at `/usr/local/bin/bun` with `BUN_INSTALL_BIN=/usr/local/bin`
30+
(what `execPathForRuntime` resolves) and a `bun` user/group at uid/gid 1001 (the
31+
node base already owns 1000; the supervisor pins bun task pods to 1001). We build
32+
these ourselves instead of depending on a third-party combined bun+node image, so
33+
the bun version moves by bumping `bunSource`, and every input carries the same
34+
provenance and snapshot layering as the node images.
35+
1436
## Tags and pinning
1537

1638
Tags are mutable and rebuilt in place on demand; each rebuild picks up Debian

‎base-images/images.json‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,23 @@
2626
{
2727
"repo": "bun",
2828
"tag": "1.3-node20-bookworm",
29-
"base": "imbios/bun-node:1.3.3-20-slim@sha256:59d84856a7e31eec83afedadb542f7306f672343b8b265c70d733404a6e8834b"
29+
"runtimeKind": "bun",
30+
"base": "node:20.20.2-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0",
31+
"bunSource": "oven/bun:1.3.3-slim@sha256:5d55d9702e1c634a931f048d0ec84d35583450d6059327cb88d82edd55068556"
32+
},
33+
{
34+
"repo": "bun",
35+
"tag": "1.3-bookworm",
36+
"runtimeKind": "bun",
37+
"base": "debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171",
38+
"bunSource": "oven/bun:1.3.14-slim@sha256:d56a2534ffd262e92c12fd3249d3924d296d97086da773f821d7d0477435ea04"
39+
},
40+
{
41+
"repo": "bun",
42+
"tag": "1.4-bookworm",
43+
"runtimeKind": "bun",
44+
"base": "debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171",
45+
"bunSource": "oven/bun:1.4.2-slim@sha256:cb3bbbb08e13a4a2ff400f24c7a2a1d5efa83f6ef8544d52d95a519631e2fc61"
3046
}
3147
]
3248
}

0 commit comments

Comments
 (0)