campo-reportes (sha256:fcf110b73c4e3f73ab9a369229cea2d4ae4def5150026bb0e98c3e574aaacdf8)
Published 2026-09-29 16:19:55 -05:00 by damian
Installation
docker pull git.griotech.linkpc.net/damian/campo-reportes@sha256:fcf110b73c4e3f73ab9a369229cea2d4ae4def5150026bb0e98c3e574aaacdf8sha256:fcf110b73c4e3f73ab9a369229cea2d4ae4def5150026bb0e98c3e574aaacdf8Image Layers
| # debian.sh --arch 'amd64' out/ 'bookworm' '@1789689600' |
| ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
| ENV LANG=C.UTF-8 |
| RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates netbase tzdata ; rm -rf /var/lib/apt/lists/* # buildkit |
| ENV GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D |
| ENV PYTHON_VERSION=3.11.16 |
| ENV PYTHON_SHA256=91bcdebfdde239a003ae93738a7fce0f9230fee5c4bc2b86f6e6e8c6f98aabe8 |
| RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends dpkg-dev g++ gcc gnupg libbluetooth-dev libbz2-dev libc6-dev libdb-dev libffi-dev libgdbm-dev liblzma-dev libncursesw5-dev libreadline-dev libsqlite3-dev libssl-dev make tk-dev uuid-dev wget xz-utils zlib1g-dev ; wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; wget -O python.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc"; GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$GPG_KEY"; gpg --batch --verify python.tar.xz.asc python.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME" python.tar.xz.asc; mkdir -p /usr/src/python; tar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; rm python.tar.xz; cd /usr/src/python; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; ./configure --build="$gnuArch" --enable-loadable-sqlite-extensions --enable-optimizations --enable-option-checking=fatal --enable-shared $(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') --with-ensurepip ; nproc="$(nproc)"; EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; LDFLAGS="$(dpkg-buildflags --get LDFLAGS)"; LDFLAGS="${LDFLAGS:-} -Wl,--strip-all"; make -j "$nproc" "EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" "LDFLAGS=${LDFLAGS:-}" ; rm python; make -j "$nproc" "EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" "LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\$\$ORIGIN/../lib'" python ; make install; cd /; rm -rf /usr/src/python; find /usr/local -depth \( \( -type d -a \( -name test -o -name tests -o -name idle_test \) \) -o \( -type f -a \( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \) \) \) -exec rm -rf '{}' + ; ldconfig; apt-mark auto '.*' > /dev/null; apt-mark manual $savedAptMark; find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' | awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' | sort -u | xargs -rt dpkg-query --search | awk 'sub(":$", "", $1) { print $1 }' | sort -u | xargs -r apt-mark manual ; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; rm -rf /var/lib/apt/lists/*; export PYTHONDONTWRITEBYTECODE=1; python3 --version; pip3 install --disable-pip-version-check --no-cache-dir --no-compile 'setuptools==79.0.1' 'wheel==0.46.3' ; pip3 --version # buildkit |
| RUN /bin/sh -c set -eux; for src in idle3 pip3 pydoc3 python3 python3-config; do dst="$(echo "$src" | tr -d 3)"; [ -s "/usr/local/bin/$src" ]; [ ! -e "/usr/local/bin/$dst" ]; ln -svT "$src" "/usr/local/bin/$dst"; done # buildkit |
| CMD ["python3"] |
| ARG WKHTMLTOPDF_VERSION=0.12.6.1-3 |
| ARG WKHTMLTOPDF_DISTRO=bookworm |
| ARG INSTALL_CHROMIUM=true |
| ARG NODE_VERSION=22 |
| ENV NVM_DIR=/home/frappe/.nvm |
| ENV NVM_SYMLINK_CURRENT=true |
| ENV PATH=/home/frappe/.nvm/current/bin/:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
| RUN |4 WKHTMLTOPDF_VERSION=0.12.6.1-3 WKHTMLTOPDF_DISTRO=bookworm INSTALL_CHROMIUM=true NODE_VERSION=22 /bin/sh -c useradd -ms /bin/bash frappe && apt-get update && apt-get install --no-install-recommends -y curl git vim nginx gettext-base file libpango-1.0-0 libharfbuzz0b libpangoft2-1.0-0 libpangocairo-1.0-0 restic gpg mariadb-client less libpq-dev postgresql-client wait-for-it jq media-types && mkdir -p ${NVM_DIR} && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.6/install.sh | bash && . ${NVM_DIR}/nvm.sh && nvm install ${NODE_VERSION} && nvm use ${NODE_VERSION} && npm install -g yarn && corepack enable pnpm && nvm alias default ${NODE_VERSION} && rm -rf ${NVM_DIR}/.cache && echo 'export NVM_DIR="/home/frappe/.nvm"' >>/home/frappe/.bashrc && echo '[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm' >>/home/frappe/.bashrc && echo '[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion" # This loads nvm bash_completion' >>/home/frappe/.bashrc && if [ "$(uname -m)" = "aarch64" ]; then export ARCH=arm64; fi && if [ "$(uname -m)" = "x86_64" ]; then export ARCH=amd64; fi && downloaded_file=wkhtmltox_${WKHTMLTOPDF_VERSION}.${WKHTMLTOPDF_DISTRO}_${ARCH}.deb && curl -sLO https://github.com/wkhtmltopdf/packaging/releases/download/$WKHTMLTOPDF_VERSION/$downloaded_file && apt-get install -y ./$downloaded_file && rm $downloaded_file && if [ "$INSTALL_CHROMIUM" != "false" ]; then DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y chromium-headless-shell; fi && rm -rf /var/lib/apt/lists/* && rm -fr /etc/nginx/sites-enabled/default && mkdir -p /etc/nginx/snippets && pip3 install frappe-bench && sed -i '/user www-data/d' /etc/nginx/nginx.conf && ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log && touch /run/nginx.pid && chown -R frappe:frappe /etc/nginx/conf.d && chown -R frappe:frappe /etc/nginx/nginx.conf && chown -R frappe:frappe /etc/nginx/snippets && chown -R frappe:frappe /var/log/nginx && chown -R frappe:frappe /var/lib/nginx && chown -R frappe:frappe /run/nginx.pid # buildkit |
| COPY resources/core/nginx/nginx-template.conf /templates/nginx/frappe.conf.template # buildkit |
| COPY resources/core/nginx/nginx-entrypoint.sh /usr/local/bin/nginx-entrypoint.sh # buildkit |
| COPY resources/core/nginx/security_headers.conf /etc/nginx/snippets/security_headers.conf # buildkit |
| RUN |4 WKHTMLTOPDF_VERSION=0.12.6.1-3 WKHTMLTOPDF_DISTRO=bookworm INSTALL_CHROMIUM=true NODE_VERSION=22 /bin/sh -c chmod 755 /usr/local/bin/nginx-entrypoint.sh # buildkit |
| USER frappe |
| RUN |4 WKHTMLTOPDF_VERSION=0.12.6.1-3 WKHTMLTOPDF_DISTRO=bookworm INSTALL_CHROMIUM=true NODE_VERSION=22 /bin/sh -c echo "echo \"Commands restricted in prodution container, Read FAQ before you proceed: https://frappe.io/ctr-faq\"" >> ~/.bashrc # buildkit |
| COPY --chown=frappe:frappe /home/frappe/frappe-bench /home/frappe/frappe-bench # buildkit |
| WORKDIR /home/frappe/frappe-bench |
| RUN |4 WKHTMLTOPDF_VERSION=0.12.6.1-3 WKHTMLTOPDF_DISTRO=bookworm INSTALL_CHROMIUM=true NODE_VERSION=22 /bin/sh -c cp -r /home/frappe/frappe-bench/sites/assets /home/frappe/frappe-bench/assets && rm -rf /home/frappe/frappe-bench/sites/assets # buildkit |
| VOLUME [/home/frappe/frappe-bench/sites /home/frappe/frappe-bench/logs] |
| USER root |
| COPY resources/core/main-entrypoint.sh /usr/local/bin/entrypoint.sh # buildkit |
| RUN |4 WKHTMLTOPDF_VERSION=0.12.6.1-3 WKHTMLTOPDF_DISTRO=bookworm INSTALL_CHROMIUM=true NODE_VERSION=22 /bin/sh -c chmod 755 /usr/local/bin/entrypoint.sh # buildkit |
| COPY resources/core/start.sh /usr/local/bin/start.sh # buildkit |
| RUN |4 WKHTMLTOPDF_VERSION=0.12.6.1-3 WKHTMLTOPDF_DISTRO=bookworm INSTALL_CHROMIUM=true NODE_VERSION=22 /bin/sh -c chmod 755 /usr/local/bin/start.sh # buildkit |
| USER frappe |
| ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] |
| CMD ["start.sh"] |
| USER frappe |
| WORKDIR /home/frappe/frappe-bench |
| ARG CACHEBUST=20260929T211938Z |
| RUN |1 CACHEBUST=20260929T211938Z /bin/sh -c python3 - "$CACHEBUST" <<'PY' import glob import json import os import shutil import subprocess import sys print("Clonando apps (CACHEBUST={0})".format(sys.argv[1])) BENCH = "/home/frappe/frappe-bench" INSTALADAS = "/tmp/apps_instaladas.txt" instaladas = [] for app in json.load(open("/tmp/apps.json")): url = app["url"] token = url.split("//", 1)[-1].split("@", 1)[0].split(":", 1)[-1] proceso = subprocess.run( [ "bench", "get-app", url, "--branch", app["branch"], "--overwrite", # La app no trae bundles; los assets estaticos se copian abajo. # Sin esto, `get-app` dispara `yarn run production` y muere. "--skip-assets", ], capture_output=True, text=True, ) if proceso.returncode: # El error se muestra con el token enmascarado, no se oculta. salida = (proceso.stdout or "") + (proceso.stderr or "") salida = salida.replace(url, "<repo>").replace(token, "<token>") print(salida[-4000:]) raise SystemExit( "bench get-app fallo (rc={0}) para la rama {1}".format( proceso.returncode, app["branch"] ) ) # `get-app` guarda la URL con el token en apps/<app>/.git/config y deja # rastro en logs/. Se borra TODO en este mismo RUN. for gitdir in glob.glob(os.path.join(BENCH, "apps", "*", ".git")): shutil.rmtree(gitdir, ignore_errors=True) shutil.rmtree(os.path.join(BENCH, "logs"), ignore_errors=True) for ruta in glob.glob(os.path.join(BENCH, "sites", "*", "logs")): shutil.rmtree(ruta, ignore_errors=True) # `logs/` es un VOLUME de la imagen base: si no se recrea, Docker monta un # volumen anonimo de root y `bench` muere con PermissionError. Se recrea # vacio y del usuario frappe (este RUN corre como frappe). os.makedirs(os.path.join(BENCH, "logs"), exist_ok=True) # Guardarrail: si el token quedo en algun archivo, el build falla. hallazgos = [] for raiz, dirs, archivos in os.walk(BENCH): dirs[:] = [d for d in dirs if d not in ("node_modules", "assets", ".git")] for nombre in archivos: ruta = os.path.join(raiz, nombre) try: with open(ruta, "rb") as fh: if token.encode() in fh.read(): hallazgos.append(ruta) except OSError: continue if hallazgos: raise SystemExit("El token quedo en la imagen: " + ", ".join(hallazgos[:5])) # El nombre de la app es el ultimo segmento de la URL. Se deja la lista en # disco para que el RUN de abajo copie los assets de cada una sin tener que # nombrarlas a mano: agregar una app a apps.json no obliga a tocar este # archivo. instaladas.append(url.rsplit("/", 1)[-1].removesuffix(".git")) open(INSTALADAS, "w").write("\n".join(instaladas) + "\n") print("Apps instaladas sin rastro del token: " + ", ".join(instaladas)) PY # buildkit |
| RUN |1 CACHEBUST=20260929T211938Z /bin/sh -c set -e; while read -r app; do [ -n "$app" ] || continue; if [ -d "apps/$app/$app/public" ]; then mkdir -p "assets/$app"; cp -r "apps/$app/$app/public/." "assets/$app/"; echo "assets de $app copiados"; else echo "aviso: $app no tiene public/, se omite"; fi; done < /tmp/apps_instaladas.txt # buildkit |
| USER frappe |