eho/register-referentie
1
0
Fork 0
Code Issues 17 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor(infra): bake config via dockerfile_inline, drop Dockerfile files (refs #30)
All checks were successful
CI / lint (pull_request) Successful in 51s
Details
CI / build (pull_request) Successful in 42s
Details
CI / unit (pull_request) Successful in 46s
Details
CI / compose-smoke (pull_request) Successful in 4m7s
Details

Browse Source 
Replaces the three standalone Dockerfiles (openzaak, opennotificaties,
keycloak) with `build.dockerfile_inline` recipes in the compose files, so the
config bake has no separate Dockerfile artifacts to maintain. Behaviour is
identical: each derived image still COPYies its config in.

- oz-init / keycloak / flowable-init: 2-line inline Dockerfiles.
- Open Notificaties needs no bake at all now — nrc-init runs migrations only,
  so all NRC services use the plain base image (removes a whole derived image).

Why dockerfile_inline and not `docker cp` into named volumes: docker cp avoids
images entirely but needs `docker compose create`, which podman-compose (the
local dev runtime) does not implement — it would break `make openzaak-up` etc.
locally. dockerfile_inline works on both podman-compose and the CI runner
(verified both: oz-init + keycloak inline builds locally; flowable-init inline
has been green on CI since run 27).

Docs updated: gitea-actions-gotchas.md and openzaak.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niek Otten
2026-06-25 09:32:35 +02:00
parent a0aa22c80b
commit 6d8e1d0830
9 changed files with 50 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
docs/runbooks/gitea-actions-gotchas.md
View File

@@ -40,18 +40,24 @@ exposed it.
**Fix: bake assets into derived images instead of bind-mounting them.** Anything
a Compose service needs at runtime that lives in the repo is `COPY`-ed into a
small derived image, so it is present regardless of where the daemon runs:
small derived image, so it is present regardless of where the daemon runs. We use
**`build.dockerfile_inline`** — the 2-line recipe lives in the compose file, so
there are no standalone `Dockerfile` artifacts to maintain:
| Asset | Derived image | Dockerfile |
| Asset | Derived image | Built by |
|---|---|---|
| OpenZaak `setup_configuration/data.yaml` | `register-referentie/openzaak:dev` | `infra/openzaak/Dockerfile` |
| Open Notificaties `setup_configuration/data.yaml` | `register-referentie/opennotificaties:dev` | `infra/opennotificaties/Dockerfile` |
| Keycloak realm exports | `register-referentie/keycloak:dev` | `infra/keycloak/Dockerfile` |
| `workflows/registratie.bpmn` | `register-referentie/flowable-init:dev` | `build.dockerfile_inline` in the compose files |
| OpenZaak `setup_configuration/data.yaml` | `register-referentie/openzaak:dev` | `oz-init` `dockerfile_inline` |
| Keycloak realm exports | `register-referentie/keycloak:dev` | `keycloak` `dockerfile_inline` |
| `workflows/registratie.bpmn` | `register-referentie/flowable-init:dev` | `flowable-init` `dockerfile_inline` |
The base image tag stays a build `arg` (`OPENZAAK_TAG`, `OPENNOTIFICATIES_TAG`)
so version pinning is unchanged. The three `*-init`/web/celery services that share
a base now share one built image tag, so the bake happens once per `up --build`.
The base image tag is interpolated by Compose (`${OPENZAAK_TAG}`) so pinning is
unchanged. OpenZaak's `openzaak`/`oz-celery` reuse the one image `oz-init` builds.
Open Notificaties needs **no** bake — `nrc-init` runs migrations only, so all NRC
services use the plain base image.
`dockerfile_inline` works on both the CI runner (docker compose) and local
**podman-compose**, unlike `docker cp`-into-volumes (which needs `docker compose
create`, a subcommand podman-compose lacks).
**Why not the alternatives.**