From 8cb8b5e463b752230fc675f05de3d910f8c90332 Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Sat, 15 Aug 2026 22:11:08 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9dockerfile?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../20260815-go-mod-download-timeout-5b8e2c.md | 8 ++++++++ Dockerfile | 13 ++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/.project-docs/30-worklog/tasks/20260815-go-mod-download-timeout-5b8e2c.md b/.project-docs/30-worklog/tasks/20260815-go-mod-download-timeout-5b8e2c.md index 8a88c42..09468bb 100644 --- a/.project-docs/30-worklog/tasks/20260815-go-mod-download-timeout-5b8e2c.md +++ b/.project-docs/30-worklog/tasks/20260815-go-mod-download-timeout-5b8e2c.md @@ -16,12 +16,14 @@ - Verify whether `github.com/jackc/pgpassfile@v1.0.0` is invalid or whether the failure is limited to dependency-network access. - Identify the repository-supported build path for China-hosted CI and provide a target-environment verification command. - Make the standard Go Docker build use a China-reachable, integrity-checked module source by default while allowing CI to override it. +- Diagnose and fix the root Next.js image's `npm ci` registry timeout using a free mirror without changing dependency versions. ## Intent And Constraints - Treat the supplied Jenkins log as the production-environment failure artifact and keep confirmed repository facts separate from target-network assumptions. - Keep the implementation surgical: change only the standard Go Docker build configuration and its task record; Jenkins configuration is outside this repository. - Do not weaken module integrity checks (`go.sum`/`GOSUMDB`) to work around a transport timeout. +- Keep the package lockfile authoritative; do not regenerate dependency versions merely to change registry routing. ## Outcome @@ -30,6 +32,9 @@ - A cold download of the failing module and then the complete module set succeeded through `https://goproxy.cn,direct`; the individual fetch completed in 0.18 seconds and the complete set in 1 second in the diagnostic environment. - The repository already supplies `backend/Dockerfile.alpine` as the recommended China-CI build. It uses the Aliyun Alpine package mirror, `GOPROXY=https://goproxy.cn,direct`, and `GOSUMDB=sum.golang.google.cn`. - Updated the standard `backend/Dockerfile` to use the same integrity-checked Go module endpoints by default and expose `GOPROXY`/`GOSUMDB` as build arguments for internal or global proxy overrides. +- The later Jenkins failure was a separate root-image issue: `npm ci` used the default npm registry and ran for 1769 seconds before npm reported `Exit handler never called`. +- Updated the root `Dockerfile` deps stage to use the free `https://registry.npmmirror.com` mirror by default, expose `NPM_REGISTRY` as a build argument, add bounded retries/timeouts, and skip audit/fund network calls. The package lockfile and dependency versions were not changed. +- An initial `--replace-registry-host=always` experiment was rejected because 16 lockfile entries point to Tencent's `/npm/...` tarball paths, which do not map to the npmmirror path layout; the retained command only sets `--registry` and leaves those explicit URLs intact. - No application, deployment manifest, dependency, checksum, or CI file was changed. ## Verification @@ -42,12 +47,15 @@ - `go test ./...` passed for all 19 Go packages, and `go vet ./...` passed. - Re-ran a fresh-cache full module download using the new defaults: exit 0. - Ran `go mod verify`: all downloaded modules verified. +- Ran a fresh-cache root `npm ci` with the Dockerfile's registry, retry, timeout, `--no-audit`, and `--no-fund` options: exit 0 in 15.29 seconds. +- Confirmed the root lockfile contains 241 `registry.npmjs.org` entries and 16 explicit Tencent mirror entries; no lockfile rewrite was performed. - Could not run a full Docker image build because the local Docker Desktop Linux daemon is unavailable; the Jenkins-node rerun remains the authoritative end-to-end check. ## Follow-ups - Re-run the existing standard Docker build on the Jenkins agent; `backend/Dockerfile.alpine` remains the more self-contained fallback when Alpine package downloads also need an Aliyun mirror. - If that command still times out, test HTTPS egress/DNS from the Jenkins Docker build network to `mirrors.aliyun.com`, `goproxy.cn`, and `sum.golang.google.cn`, or use the organization's internal Go module proxy. +- Re-run the root image build on Jenkins with `docker build --progress=plain --no-cache -t .`; if it still fails, capture the first failing package URL because the lockfile has explicit Tencent mirror URLs for a small subset of packages. ## Promotion Candidates diff --git a/Dockerfile b/Dockerfile index e81af4d..31fc589 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,8 +2,19 @@ FROM node:22-alpine AS deps WORKDIR /app ENV NEXT_TELEMETRY_DISABLED=1 +# Use a free mainland-China npm mirror by default. CI can override this with +# --build-arg NPM_REGISTRY=https://registry.npmjs.org if its egress allows it. +ARG NPM_REGISTRY=https://registry.npmmirror.com + COPY package.json package-lock.json ./ -RUN npm ci +RUN npm ci \ + --registry="${NPM_REGISTRY}" \ + --fetch-retries=5 \ + --fetch-timeout=120000 \ + --fetch-retry-mintimeout=10000 \ + --fetch-retry-maxtimeout=60000 \ + --no-audit \ + --no-fund FROM node:22-alpine AS builder WORKDIR /app