@toa.io/operations 1.0.0-alpha.232 → 1.0.0-alpha.234

package/image/runtime.Dockerfile

@@ -0,0 +1,4 @@
+FROM node:24.14.0-alpine3.22
+
+ARG VERSION
+RUN npm i -g @toa.io/runtime@${VERSION} --omit=dev

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/operations",
-  "version": "1.0.0-alpha.232",
+  "version": "1.0.0-alpha.234",
   "description": "Toa Deployment",
   "homepage": "https://toa.io",
   "author": {
@@ -34,5 +34,5 @@
     "execa": "5.1.1",
     "fs-extra": "11.1.1"
   },
-  "gitHead": "a9c61fad587aa8f0dcd0e4db39901fc778d5bfa4"
+  "gitHead": "0a102917aca0115eadc2410f0a7836e3e40096a0"
 }

package/readme.md

@@ -4,6 +4,22 @@
 
 ### Container Registry
 
+Deploy images default to `FROM ghcr.io/toa-io/runtime:<runtime.version>`
+(published with each Toa release). The base image already has `@toa.io/runtime`
+installed; composition/service Dockerfiles only install component dependencies.
+
+To use a custom base image, set `registry.build.image` (or `composition.image`).
+That image must provide the `toa` CLI, or install it via `registry.build.run`:
+
+```yaml
+# context.toa.yaml
+
+registry:
+  build:
+    image: node:24.14.0-alpine3.22
+    run: npm i -g @toa.io/runtime --omit=dev
+```
+
 #### Build Options
 
 ```yaml

package/src/deployment/chart/templates/compositions.yaml

@@ -66,5 +66,12 @@ spec:
             claimName: {{ .claim }}
         {{- end }}
       {{- end }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              toa.io/composition: {{ .name }}
 ---
 {{- end }}

package/src/deployment/chart/templates/services.yaml

@@ -73,6 +73,13 @@ spec:
               exec:
                 command: [sleep, "5"]
       terminationGracePeriodSeconds: 45
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              toa.io/service: extension-{{ .name }}
 {{- if .port }}
 ---
 apiVersion: v1

package/src/deployment/factory.js

@@ -22,7 +22,7 @@ class Factory {
 
     const imagesFactory = new ImagesFactory(context.name, context.runtime, context.registry)
 
-    this.#registry = new Registry(context.registry, imagesFactory, this.#process)
+    this.#registry = new Registry(context.name, context.registry, imagesFactory, this.#process)
     this.#compositions = context.compositions.map((composition) => this.#composition(composition))
     this.#dependencies = this.#getDependencies()
   }

package/src/deployment/images/composition.Dockerfile

@@ -5,7 +5,6 @@ FROM {{build.image}}
 ENV NODE_ENV=production
 RUN if [ "{{runtime.registry}}" != "" ]; then npm set registry {{runtime.registry}}; fi
 RUN if [ "{{runtime.proxy}}" != "" ]; then npm set proxy {{runtime.proxy}}; fi
-RUN npm i -g @toa.io/runtime@{{runtime.version}} --omit=dev
 
 WORKDIR /composition
 COPY --chown=node:node . /composition
@@ -13,7 +12,8 @@ COPY --chown=node:node . /composition
 {{build.run}}
 
 # run 'npm i' in each component
-RUN for entry in *; do if [ -f "$entry/package.json" ]; then (cd $entry && npm i --omit=dev); fi; done
+RUN --mount=type=cache,target=/root/.npm \
+  for entry in *; do if [ -f "$entry/package.json" ]; then (cd $entry && npm i --omit=dev); fi; done
 
 USER node
 CMD toa compose *

package/src/deployment/images/image.js

@@ -26,9 +26,7 @@ class Image {
   #registry
   #runtime
   #values = {
-    build: {
-      image: 'node:24.14.0-alpine3.22'
-    }
+    build: {}
   }
 
   constructor (scope, runtime, registry) {
@@ -79,7 +77,9 @@ class Image {
 
   #setValues () {
     this.#values.runtime = this.#runtime
-    this.#values.build = overwrite(this.#values.build, this.#registry.build)
+    this.#values.build = overwrite({
+      image: `${RUNTIME_IMAGE}:${this.#runtime.version}`
+    }, this.#registry.build)
 
     const image = this.base
 
@@ -127,4 +127,7 @@ function createArguments (variables) {
   return args.join('\n')
 }
 
+const RUNTIME_IMAGE = 'ghcr.io/toa-io/runtime'
+
 exports.Image = Image
+exports.RUNTIME_IMAGE = RUNTIME_IMAGE

package/src/deployment/images/runtime-base.test.js

@@ -0,0 +1,90 @@
+'use strict'
+
+const { join } = require('node:path')
+const { readFile } = require('node:fs/promises')
+const { directory } = require('@toa.io/filesystem')
+
+const { Image, RUNTIME_IMAGE } = require('./image')
+
+const compositionDockerfile = join(__dirname, 'composition.Dockerfile')
+const serviceDockerfile = join(__dirname, 'service.Dockerfile')
+
+class TestImage extends Image {
+  dockerfile
+
+  #name
+  #base
+
+  constructor (runtime, registry, dockerfile, name = 'test', base) {
+    super('acme', runtime, registry)
+
+    this.dockerfile = dockerfile
+    this.#name = name
+    this.#base = base
+  }
+
+  get name () {
+    return this.#name
+  }
+
+  get version () {
+    return 'abcdef12'
+  }
+
+  get base () {
+    return this.#base
+  }
+}
+
+describe('runtime base image', () => {
+  /** @type {string} */
+  let root
+
+  beforeEach(async () => {
+    root = await directory.temp('toa-runtime-base-test')
+  })
+
+  it('should default build.image to version-pinned GHCR runtime image', async () => {
+    const runtime = { version: '1.0.0-alpha.232' }
+    const image = new TestImage(runtime, {}, compositionDockerfile)
+
+    const path = await image.prepare(root)
+    const dockerfile = await readFile(join(path, 'Dockerfile'), 'utf8')
+
+    expect(dockerfile).toContain(`FROM ${RUNTIME_IMAGE}:1.0.0-alpha.232`)
+    expect(dockerfile).not.toMatch(/npm i -g @toa\.io\/runtime/)
+  })
+
+  it('should not install runtime in service Dockerfile template', async () => {
+    const runtime = { version: '1.0.0-alpha.99' }
+    const image = new TestImage(runtime, {}, serviceDockerfile, 'service-test')
+
+    const path = await image.prepare(root)
+    const dockerfile = await readFile(join(path, 'Dockerfile'), 'utf8')
+
+    expect(dockerfile).toContain(`FROM ${RUNTIME_IMAGE}:1.0.0-alpha.99`)
+    expect(dockerfile).not.toMatch(/npm i -g @toa\.io\/runtime/)
+  })
+
+  it('should allow registry.build.image override', async () => {
+    const runtime = { version: '1.0.0-alpha.232' }
+    const registry = { build: { image: 'node:24.14.0-alpine3.22' } }
+    const image = new TestImage(runtime, registry, compositionDockerfile)
+
+    const path = await image.prepare(root)
+    const dockerfile = await readFile(join(path, 'Dockerfile'), 'utf8')
+
+    expect(dockerfile).toContain('FROM node:24.14.0-alpine3.22')
+    expect(dockerfile).not.toContain(RUNTIME_IMAGE)
+  })
+
+  it('should allow composition.image override via base', async () => {
+    const runtime = { version: '1.0.0-alpha.232' }
+    const image = new TestImage(runtime, {}, compositionDockerfile, 'mono', 'custom.example/base:1')
+
+    const path = await image.prepare(root)
+    const dockerfile = await readFile(join(path, 'Dockerfile'), 'utf8')
+
+    expect(dockerfile).toContain('FROM custom.example/base:1')
+  })
+})

package/src/deployment/images/service.Dockerfile

@@ -3,12 +3,12 @@ FROM {{build.image}}
 ENV NODE_ENV=production
 RUN if [ "{{runtime.registry}}" != "" ]; then npm set registry {{runtime.registry}}; fi
 RUN if [ "{{runtime.proxy}}" != "" ]; then npm set proxy {{runtime.proxy}}; fi
-RUN npm i -g @toa.io/runtime@{{runtime.version}} --omit=dev
 
 WORKDIR /service
 COPY --chown=node:node . /service
 
-RUN npm i --omit=dev
+RUN --mount=type=cache,target=/root/.npm \
+  npm i --omit=dev
 
 USER node
 CMD toa serve .

package/src/deployment/registry.js

@@ -1,12 +1,14 @@
 'use strict'
 
+const { posix } = require('node:path')
 const workspace = require('./workspace')
-const { newid } = require('@toa.io/generic')
 
 /**
  * @implements {toa.deployment.Registry}
  */
 class Registry {
+  #scope
+
   #registry
 
   #factory
@@ -15,7 +17,11 @@ class Registry {
 
   #images = []
 
-  constructor (registry, factory, process) {
+  /** @type {string | undefined} */
+  #builder
+
+  constructor (scope, registry, factory, process) {
+    this.#scope = scope
     this.#registry = registry
     this.#factory = factory
     this.#process = process
@@ -40,9 +46,8 @@ class Registry {
   async build () {
     await this.prepare()
 
-    for (const image of this.#images) {
+    for (const image of this.#images)
       await this.#build(image)
-    }
   }
 
   async push () {
@@ -81,11 +86,10 @@ class Registry {
 
     const args = ['--context=default', 'buildx', 'build']
 
-    if (push) {
+    if (push)
       args.push('--push')
-    } else {
+    else
       args.push('--load')
-    }
 
     args.push('--tag', image.reference, image.context)
 
@@ -97,13 +101,15 @@ class Registry {
 
     if (multiarch) {
       const platform = this.#registry.platforms.join(',')
-      const builder = await this.#createBuilder()
+      const builder = await this.#ensureBuilder()
 
       args.push('--platform', platform)
       args.push('--builder', builder)
-    } else {
+
+      if (this.#registry.base !== undefined)
+        this.#appendCache(args)
+    } else
       args.push('--builder', 'default')
-    }
 
     args.push('--progress', 'plain')
 
@@ -128,13 +134,29 @@ class Registry {
     return true
   }
 
-  async #createBuilder () {
-    const name = `toa-${newid()}`
-    const create = `buildx create --name ${name} --bootstrap --use`.split(' ')
+  async #ensureBuilder () {
+    if (this.#builder !== undefined)
+      return this.#builder
+
+    try {
+      await this.#process.execute('docker', ['buildx', 'inspect', BUILDER], { silently: true })
+    } catch {
+      await this.#process.execute('docker', ['buildx', 'create', '--name', BUILDER, '--bootstrap'])
+    }
 
-    await this.#process.execute('docker', create)
+    this.#builder = BUILDER
+
+    return BUILDER
+  }
+
+  /**
+   * @param {string[]} args
+   */
+  #appendCache (args) {
+    const ref = posix.join(this.#registry.base, this.#scope, 'buildcache')
 
-    return name
+    args.push('--cache-from', `type=registry,ref=${ref}`)
+    args.push('--cache-to', `type=registry,ref=${ref},mode=max,image-manifest=true`)
   }
 }
 

package/src/deployment/registry.test.js

@@ -0,0 +1,175 @@
+'use strict'
+
+const { Registry } = require('./registry')
+
+/** @type {toa.operations.Process} */
+let process
+
+/** @type {toa.deployment.images.Factory} */
+let factory
+
+/** @type {toa.deployment.images.Image[]} */
+let images
+
+beforeEach(() => {
+  images = []
+  process = /** @type {toa.operations.Process} */ {
+    execute: jest.fn(async (cmd, args) => {
+      if (args[0] === 'manifest')
+        throw new Error('manifest unknown')
+
+      if (args[0] === 'buildx' && args[1] === 'inspect')
+        throw new Error('builder not found')
+
+      return ''
+    })
+  }
+
+  factory = /** @type {toa.deployment.images.Factory} */ {
+    composition: () => createImage('composition-mono'),
+    service: () => createImage('extension-realtime')
+  }
+})
+
+it('should reuse named builder across images', async () => {
+  const registry = createRegistry({ base: 'example.com/reg', platforms: ['linux/amd64'] })
+
+  registry.composition(/** @type {any} */ ({}))
+  registry.service('.', /** @type {any} */ ({}))
+
+  await registry.build()
+
+  const creates = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === 'buildx' && args[1] === 'create')
+
+  expect(creates).toHaveLength(1)
+  expect(creates[0][1]).toEqual(['buildx', 'create', '--name', 'toa', '--bootstrap'])
+
+  const builds = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === '--context=default' && args[1] === 'buildx' && args[2] === 'build')
+
+  expect(builds).toHaveLength(2)
+
+  for (const [, args] of builds) {
+    expect(args).toContain('--builder')
+    expect(args[args.indexOf('--builder') + 1]).toBe('toa')
+  }
+})
+
+it('should not create builder when it already exists', async () => {
+  process.execute = jest.fn(async (cmd, args) => {
+    if (args[0] === 'manifest')
+      throw new Error('manifest unknown')
+
+    return ''
+  })
+
+  const registry = createRegistry({ base: 'example.com/reg', platforms: ['linux/amd64'] })
+
+  registry.composition(/** @type {any} */ ({}))
+
+  await registry.build()
+
+  const creates = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === 'buildx' && args[1] === 'create')
+
+  expect(creates).toHaveLength(0)
+})
+
+it('should add shared registry cache flags when base is set', async () => {
+  const registry = createRegistry({ base: 'example.com/reg', platforms: ['linux/amd64'] })
+
+  registry.composition(/** @type {any} */ ({}))
+  registry.service('.', /** @type {any} */ ({}))
+
+  await registry.build()
+
+  const builds = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === '--context=default' && args[2] === 'build')
+
+  expect(builds).toHaveLength(2)
+
+  for (const [, args] of builds) {
+    expect(args).toContain('--cache-from')
+    expect(args).toContain('type=registry,ref=example.com/reg/acme/buildcache')
+    expect(args).toContain('--cache-to')
+    expect(args).toContain('type=registry,ref=example.com/reg/acme/buildcache,mode=max,image-manifest=true')
+  }
+})
+
+it('should omit cache flags when base is not set', async () => {
+  const registry = createRegistry({ platforms: ['linux/amd64'] })
+
+  registry.composition(/** @type {any} */ ({}))
+
+  await registry.build()
+
+  const builds = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === '--context=default' && args[2] === 'build')
+
+  expect(builds).toHaveLength(1)
+
+  const [, args] = builds[0]
+
+  expect(args).not.toContain('--cache-from')
+  expect(args).not.toContain('--cache-to')
+})
+
+it('should use default builder when platforms is null', async () => {
+  const registry = createRegistry({ base: 'example.com/reg', platforms: null })
+
+  registry.composition(/** @type {any} */ ({}))
+
+  await registry.build()
+
+  const builds = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === '--context=default' && args[2] === 'build')
+
+  expect(builds).toHaveLength(1)
+
+  const [, args] = builds[0]
+
+  expect(args[args.indexOf('--builder') + 1]).toBe('default')
+  expect(args).not.toContain('--cache-from')
+  expect(args).not.toContain('--platform')
+})
+
+it('should skip build when image already exists', async () => {
+  process.execute = jest.fn(async () => '')
+
+  const registry = createRegistry({ base: 'example.com/reg', platforms: ['linux/amd64'] })
+
+  registry.composition(/** @type {any} */ ({}))
+
+  await registry.build()
+
+  const builds = process.execute.mock.calls.filter(([, args]) =>
+    args[0] === '--context=default' && args[2] === 'build')
+
+  expect(builds).toHaveLength(0)
+  expect(process.execute).toHaveBeenCalledWith('docker', ['manifest', 'inspect', images[0].reference], { silently: true })
+})
+
+/**
+ * @param {object} [registry]
+ * @returns {Registry}
+ */
+function createRegistry (registry = {}) {
+  return new Registry('acme', registry, factory, process)
+}
+
+/**
+ * @param {string} name
+ * @returns {toa.deployment.images.Image}
+ */
+function createImage (name) {
+  const image = /** @type {toa.deployment.images.Image} */ {
+    reference: `example.com/reg/acme/${name}:abcdef12`,
+    context: `/tmp/${name}`,
+    prepare: jest.fn(async () => `/tmp/${name}`)
+  }
+
+  images.push(image)
+
+  return image
+}