Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
bazel-*
builds/
.git
.circleci
.github
42 changes: 42 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# Build stage — compile everything with Bazel
FROM ubuntu:24.04 AS builder

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
build-essential \
git \
openjdk-21-jdk-headless \
python3 \
curl \
zip \
unzip \
&& rm -rf /var/lib/apt/lists/*

# Install Bazelisk (manages Bazel version via .bazelversion)
RUN curl -L https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-amd64 \
-o /usr/local/bin/bazel && chmod +x /usr/local/bin/bazel

RUN useradd -m builder && mkdir -p /output && chown builder /output
WORKDIR /src
COPY --chown=builder . .

# Use CI bazelrc for optimized builds
RUN cp .bazelrc.ci .bazelrc

USER builder
RUN bazel build :livegrep \
&& mkdir -p /output \
Comment thread
sentry[bot] marked this conversation as resolved.
&& tar -C /output -xf "$(bazel info bazel-bin)/livegrep.tar"
Comment thread
cursor[bot] marked this conversation as resolved.

# Runtime stage
FROM ubuntu:24.04

RUN apt-get update \
&& apt-get -y dist-upgrade \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y \
git \
openssh-client \
ca-certificates \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*

COPY --from=builder /output/ /livegrep/
Comment thread
sentry[bot] marked this conversation as resolved.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dockerfile missing CMD or ENTRYPOINT directive

High Severity

The runtime stage of the Dockerfile copies the built livegrep binaries but doesn't specify a CMD or ENTRYPOINT directive. When this container is deployed to Cloud Run (as configured in cloudbuild.yaml), it won't know which binary to execute, causing the service and job to fail at startup.

Fix in Cursor Fix in Web

50 changes: 50 additions & 0 deletions cloudbuild.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
steps:
# Build the container image
- name: 'gcr.io/cloud-builders/docker'
args:
- 'build'
- '-t'
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:$COMMIT_SHA'
Comment thread
trevor-e marked this conversation as resolved.
- '-t'
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:$SHORT_SHA'
- '-t'
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:latest'
- '.'

# Push all tags
- name: 'gcr.io/cloud-builders/docker'
args:
- 'push'
- '--all-tags'
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image'

# Deploy to Cloud Run service
- name: 'gcr.io/cloud-builders/gcloud'
args:
- 'run'
- 'services'
- 'update'
- 'livegrep-web-and-server'
- '--region=us-west2'
- '--image=us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:$COMMIT_SHA'
Comment thread
sentry[bot] marked this conversation as resolved.
Comment thread
trevor-e marked this conversation as resolved.

# Deploy to Cloud Run indexer job
- name: 'gcr.io/cloud-builders/gcloud'
args:
- 'run'
- 'jobs'
- 'update'
- 'livegrep-indexer'
- '--region=us-west2'
- '--image=us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:$COMMIT_SHA'

images:
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:$COMMIT_SHA'
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:$SHORT_SHA'
- 'us-west2-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/image:latest'

timeout: 3600s

options:
machineType: 'E2_HIGHCPU_8'
logging: CLOUD_LOGGING_ONLY
Loading