From 7512ae0f00822be6a653f632e049f8a1b92e86db Mon Sep 17 00:00:00 2001 From: JustMe Date: Sat, 10 Oct 2026 16:16:17 +0800 Subject: [PATCH] ci: build ARM64 dev images with AotAnywhere [CI] [SKIP TESTS] Signed-off-by: JustMe --- .../container/Agent.NativeBuild.Containerfile | 25 ++++++++++--------- .../container/Probe.NativeBuild.Containerfile | 25 ++++++++++--------- 2 files changed, 26 insertions(+), 24 deletions(-) diff --git a/packaging/container/Agent.NativeBuild.Containerfile b/packaging/container/Agent.NativeBuild.Containerfile index 733a9e5..d803d27 100644 --- a/packaging/container/Agent.NativeBuild.Containerfile +++ b/packaging/container/Agent.NativeBuild.Containerfile @@ -2,19 +2,9 @@ # the NativeAOT output, so an ARM64 build never needs QEMU. FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys -FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build - -WORKDIR /src/backend -COPY restore/backend/ ./ +FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs ARG NODE_RID=linux-musl-x64 -ENV NUGET_PACKAGES=/root/.nuget/packages -COPY --from=arm64-apk-keys /usr/share/apk/keys/aarch64 /tmp/apk-keys-arm64 -# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」 -RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \ - && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts - -# Fetch target-musl runtime libraries on the native builder before copying -# application sources. This layer stays reusable when only app code changes. +COPY --from=arm64-apk-keys /usr/share/apk/keys/ /tmp/apk-keys-arm64/ RUN set -eu; \ apk_arch=x86_64; \ case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \ @@ -29,6 +19,16 @@ RUN set -eu; \ for package do tar -xzf "$package" -C /tmp/runtime-root; done; \ cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/ +FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build + +WORKDIR /src/backend +COPY restore/backend/ ./ +ARG NODE_RID=linux-musl-x64 +ENV NUGET_PACKAGES=/root/.nuget/packages +# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」 +RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \ + && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts + COPY source/backend/ ./ # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效） ARG MOSHIRO_TAG= @@ -46,6 +46,7 @@ RUN dotnet publish agent/src/MoShiro.Agent -m:3 -c Release -r "$NODE_RID" \ # 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器 RUN test -x /out/agent/moshiro-agent && test -x /out/enroll/fleet-enroll \ && test "$(stat -c%s /out/agent/moshiro-agent)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 +COPY --from=runtime-libs /out/runtime/ /out/runtime/ FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine diff --git a/packaging/container/Probe.NativeBuild.Containerfile b/packaging/container/Probe.NativeBuild.Containerfile index 5f450c3..fcfe164 100644 --- a/packaging/container/Probe.NativeBuild.Containerfile +++ b/packaging/container/Probe.NativeBuild.Containerfile @@ -2,19 +2,9 @@ # the NativeAOT output, so an ARM64 build never needs QEMU. FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys -FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build - -WORKDIR /src/backend -COPY restore/backend/ ./ +FROM --platform=linux/amd64 alpine:3.24 AS runtime-libs ARG NODE_RID=linux-musl-x64 -ENV NUGET_PACKAGES=/root/.nuget/packages -COPY --from=arm64-apk-keys /usr/share/apk/keys/aarch64 /tmp/apk-keys-arm64 -# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」 -RUN dotnet restore probe/src/MoShiro.Probe -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \ - && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts - -# Fetch target-musl runtime libraries on the native builder before copying -# application sources. This layer stays reusable when only app code changes. +COPY --from=arm64-apk-keys /usr/share/apk/keys/ /tmp/apk-keys-arm64/ RUN set -eu; \ apk_arch=x86_64; \ case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \ @@ -29,6 +19,16 @@ RUN set -eu; \ for package do tar -xzf "$package" -C /tmp/runtime-root; done; \ cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/ +FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build + +WORKDIR /src/backend +COPY restore/backend/ ./ +ARG NODE_RID=linux-musl-x64 +ENV NUGET_PACKAGES=/root/.nuget/packages +# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」 +RUN dotnet restore probe/src/MoShiro.Probe -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \ + && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts + COPY source/backend/ ./ # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效） ARG MOSHIRO_TAG= @@ -46,6 +46,7 @@ RUN dotnet publish probe/src/MoShiro.Probe -m:3 -c Release -r "$NODE_RID" \ # 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器 RUN test -x /out/probe/moshiro-probe && test -x /out/enroll/fleet-enroll \ && test "$(stat -c%s /out/probe/moshiro-probe)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000 +COPY --from=runtime-libs /out/runtime/ /out/runtime/ FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine