nandi/frq · container.toml

nandi/frqpublic⑂ Fork 0

⑂ 2e24e647a7766c822d13d253777204c3bf92fb7a

container.toml · 140 lines · 6.6 KBTOML    Blame HistoryRaw
Six verbs, and the last of the nix   1[container]
2name        = "frq-dev"
3description = "the Flutter desktop build, incremental, from a pinned toolchain"
4# `debian:13-slim` and not `arch-nix`: there is no nix in this container any
5# more, and no flake left in the tree for it to enter. The build is
6# `just build desktop`, which gets Flutter, a JDK, the Clojure CLI and Nim out
7# of `tools/toolchain.sh` by pinned sha256 -- so what the image owes it is the
8# C and GTK half Flutter's Linux target links against, and nothing else.
9registry    = "debian:13-slim"
10# A Sandbox, not a Function: runs on a real VM, and the command is
11# the sandbox's own process so it dies when the command does.
12runtime     = "sandbox"
15# The container lives inside the repo it builds, so the copy is rooted two
16# levels up and `.` is the whole tree.
17context = "../.."
18include = ["."]
19# The whole image build, and it is one apt line. What used to be here -- a nix
20# store to populate and a devShell to print into /etc/devshell.sh, so that a
21# shell attached to this container *was* the devShell -- is gone with the nix
22# it was for. The toolchain script now plays that part, and it lives on the
23# volume rather than in a layer.
25# The first half is what the toolchain itself needs: git, because Flutter
26# shells out to it against its own SDK checkout and refuses to run without
27# one; unzip and xz-utils for the tarballs; ca-certificates so curl can verify
28# what it fetches; rsync for the sync below.
30# The second half is Flutter's Linux target: CMake, Ninja and pkg-config drive
31# the build, GTK 3 is what the runner links, and a C toolchain compiles both
32# that and whatever `nim c` is asked for. libssl is Nim's: nim.cfg is
33# `-d:ssl`, and std/net resolves -lssl and -lcrypto through dynlib at run time.
34
35  "apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git rsync tar unzip xz-utils && rm -rf /var/lib/apt/lists/*",
36  "apt-get update && apt-get install -y --no-install-recommends build-essential clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libssl-dev && rm -rf /var/lib/apt/lists/*",
38# The build state a local checkout carries: 395MB of a 441MB repo, uploaded on
39# every start and wanted by nothing out there. Flutter builds into a volume of
40# its own, and the clojure caches are this machine's.
41ignore  = [
42    "flutter/build", "flutter/.home", "flutter/.dart_tool",
43    "flutter/.clojuredart", "flutter/.cpcache",
44    # The ClojureDart compiler's output. Uploading a laptop's copy would make
45    # the rsync below overwrite the one the last container compiled, and every
46    # file whose content differed would look new to the compiler and to
47    # Flutter -- the incremental build undone by the thing meant to feed it.
48    "flutter/lib/cljd-out",
49    # The toolchain, which is a gigabyte of Flutter SDK and lives on the
50    # volume out here.
51    ".toolchain",
52    ".cpcache", "result", "build", ".git",
53    # An editor's linter rewrites this while the upload is reading it, and
54    # Modal fails the whole run with "was modified during build process".
55    ".clj-kondo",
58# One volume now, where there were two: the nix binary cache went with nix.
59# `devshell` is the working state of an incremental loop, shared by every
60# container that has one -- each gets its own directory under it, named for
61# what it belongs to, so `web` and `flutter-desktop` never write the
62# same tree. Modal Volumes have no locking, so those directory names are the
63# only thing keeping them apart, and two runs of the *same* container must not
64
65
66devshell = "/devshell"
68[resources]
69cpu     = 8
70memory  = 16384
71timeout = 3600
74workdir = "/app"
75# Source in, toolchain out of the volume, build in place. None of it
76# evaluates anything: the old command spent its first minutes entering a
77# devShell, printing an environment, caching that environment against
78# flake.lock and copying a nix closure back afterwards, all to arrive at a
79# PATH. A PATH is what `tools/toolchain.sh env` prints, out of a directory
80# already on the volume.
82# An incremental build is the point, and `nix build` could not give one: a
83# derivation is all-or-nothing, so any edit is a fresh sandbox and a fresh
84# compile of everything. Here the toolchain supplies the compiler and
85# `flutter build` decides what is stale -- which is the whole reason
86# `just build desktop` exists as the working-tree loop.
87command = """
89SHELL_DIR=/devshell/frq-desktop
91# Beside the working tree and NOT inside it: the rsync below runs with
92# --delete, so anything under $SHELL_DIR that is not in /app is removed on
93# every run. A cache kept in there would be deleted moments before it was
94# consulted.
95export FRQ_TOOLCHAIN=/devshell/frq-desktop.toolchain
96mkdir -p "$SHELL_DIR" "$FRQ_TOOLCHAIN"
98echo "sync: /app -> $SHELL_DIR"
99# rsync and not cp, with --checksum and not mtimes: Modal copies the source in
100# with fresh timestamps every run, so a plain copy looks entirely new to
101# Flutter and rebuilds the lot. --checksum compares content and leaves the
102# unchanged files' timestamps alone, which is the whole basis of the
103# incremental build.
105# The excludes are the state we are here to keep -- overwriting them from /app
106# would defeat the volume.
107rsync -a --checksum --delete \
108    --exclude 'flutter/.home/' \
109    --exclude 'flutter/.clojuredart/' \
110    --exclude 'flutter/build/' \
111    --exclude 'flutter/lib/cljd-out/' \
112    --exclude 'flutter/.dart_tool/' \
113    --exclude '.toolchain/' \
114    --exclude '.git' \
115    /app/ "$SHELL_DIR/"
117cd "$SHELL_DIR"
118# What survived from the last run, by presence and not by size: `du` here
119# walked the pub cache, the toolchain and every object of the last build over
120# a network volume, for numbers nobody acts on.
121for d in "$FRQ_TOOLCHAIN" flutter/.clojuredart flutter/lib/cljd-out flutter/build; do
122    [ -d "$d" ] && echo "  carried over: $d"
125# Run from the volume, where the state it reuses lives. `just` is not in this
126# image and is not worth an apt line for one call: the recipe is a wrapper
127# around the toolchain, and this is that wrapper.
128tools/toolchain.sh exec -- bash -euo pipefail -c '
129    cd flutter
130    clojure -Sdeps "{:mvn/local-repo \\"$FRQ_M2\\"}" -M:cljd compile
131    flutter build linux --debug'
133echo "built:"
134du -sh flutter/build
136# Flutter keeps its settings under XDG_CONFIG_HOME and its own caches under
137# XDG_CACHE_HOME. Both point into the volume so a second run finds what the
138# first one decided. Set here rather than in the command so a shell into this
139# container gets them too.
140env     = { XDG_CACHE_HOME = "/devshell/frq-desktop.toolchain/.cache", XDG_CONFIG_HOME = "/devshell/frq-desktop.toolchain/.config", FRQ_TOOLCHAIN = "/devshell/frq-desktop.toolchain" }

Six verbs, and the last of the nix 2e24e64 nandi 17h ago	1	[container]
	2	name = "frq-dev"
	3	description = "the Flutter desktop build, incremental, from a pinned toolchain"
	4	# `debian:13-slim` and not `arch-nix`: there is no nix in this container any
	5	# more, and no flake left in the tree for it to enter. The build is
	6	# `just build desktop`, which gets Flutter, a JDK, the Clojure CLI and Nim out
	7	# of `tools/toolchain.sh` by pinned sha256 -- so what the image owes it is the
	8	# C and GTK half Flutter's Linux target links against, and nothing else.
	9	registry = "debian:13-slim"
	10	# A Sandbox, not a Function: runs on a real VM, and the command is
	11	# the sandbox's own process so it dies when the command does.
	12	runtime = "sandbox"
	13
	14	[build]
	15	# The container lives inside the repo it builds, so the copy is rooted two
	16	# levels up and `.` is the whole tree.
	17	context = "../.."
	18	include = ["."]
	19	# The whole image build, and it is one apt line. What used to be here -- a nix
	20	# store to populate and a devShell to print into /etc/devshell.sh, so that a
	21	# shell attached to this container was the devShell -- is gone with the nix
	22	# it was for. The toolchain script now plays that part, and it lives on the
	23	# volume rather than in a layer.
	24	#
	25	# The first half is what the toolchain itself needs: git, because Flutter
	26	# shells out to it against its own SDK checkout and refuses to run without
	27	# one; unzip and xz-utils for the tarballs; ca-certificates so curl can verify
	28	# what it fetches; rsync for the sync below.
	29	#
	30	# The second half is Flutter's Linux target: CMake, Ninja and pkg-config drive
	31	# the build, GTK 3 is what the runner links, and a C toolchain compiles both
	32	# that and whatever `nim c` is asked for. libssl is Nim's: nim.cfg is
	33	# `-d:ssl`, and std/net resolves -lssl and -lcrypto through dynlib at run time.
	34	setup = [
	35	"apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git rsync tar unzip xz-utils && rm -rf /var/lib/apt/lists/*",
	36	"apt-get update && apt-get install -y --no-install-recommends build-essential clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libssl-dev && rm -rf /var/lib/apt/lists/*",
	37	]
	38	# The build state a local checkout carries: 395MB of a 441MB repo, uploaded on
	39	# every start and wanted by nothing out there. Flutter builds into a volume of
	40	# its own, and the clojure caches are this machine's.
	41	ignore = [
	42	"flutter/build", "flutter/.home", "flutter/.dart_tool",
	43	"flutter/.clojuredart", "flutter/.cpcache",
	44	# The ClojureDart compiler's output. Uploading a laptop's copy would make
	45	# the rsync below overwrite the one the last container compiled, and every
	46	# file whose content differed would look new to the compiler and to
	47	# Flutter -- the incremental build undone by the thing meant to feed it.
	48	"flutter/lib/cljd-out",
	49	# The toolchain, which is a gigabyte of Flutter SDK and lives on the
	50	# volume out here.
	51	".toolchain",
	52	".cpcache", "result", "build", ".git",
	53	# An editor's linter rewrites this while the upload is reading it, and
	54	# Modal fails the whole run with "was modified during build process".
	55	".clj-kondo",
	56	]
	57
	58	# One volume now, where there were two: the nix binary cache went with nix.
	59	# `devshell` is the working state of an incremental loop, shared by every
	60	# container that has one -- each gets its own directory under it, named for
	61	# what it belongs to, so `web` and `flutter-desktop` never write the
	62	# same tree. Modal Volumes have no locking, so those directory names are the
	63	# only thing keeping them apart, and two runs of the same container must not
	64	# overlap.
65	[volumes]
66	devshell = "/devshell"
67
68	[resources]
69	cpu = 8
70	memory = 16384
71	timeout = 3600
72
73	[run]
74	workdir = "/app"
75	# Source in, toolchain out of the volume, build in place. None of it
76	# evaluates anything: the old command spent its first minutes entering a
77	# devShell, printing an environment, caching that environment against
78	# flake.lock and copying a nix closure back afterwards, all to arrive at a
79	# PATH. A PATH is what `tools/toolchain.sh env` prints, out of a directory
80	# already on the volume.
81	#
82	# An incremental build is the point, and `nix build` could not give one: a
83	# derivation is all-or-nothing, so any edit is a fresh sandbox and a fresh
84	# compile of everything. Here the toolchain supplies the compiler and
85	# `flutter build` decides what is stale -- which is the whole reason
86	# `just build desktop` exists as the working-tree loop.
87	command = """
88	set -e
89	SHELL_DIR=/devshell/frq-desktop
90
91	# Beside the working tree and NOT inside it: the rsync below runs with
92	# --delete, so anything under $SHELL_DIR that is not in /app is removed on
93	# every run. A cache kept in there would be deleted moments before it was
94	# consulted.
95	export FRQ_TOOLCHAIN=/devshell/frq-desktop.toolchain
96	mkdir -p "$SHELL_DIR" "$FRQ_TOOLCHAIN"
97
98	echo "sync: /app -> $SHELL_DIR"
99	# rsync and not cp, with --checksum and not mtimes: Modal copies the source in
100	# with fresh timestamps every run, so a plain copy looks entirely new to
101	# Flutter and rebuilds the lot. --checksum compares content and leaves the
102	# unchanged files' timestamps alone, which is the whole basis of the
103	# incremental build.
104	#
105	# The excludes are the state we are here to keep -- overwriting them from /app
106	# would defeat the volume.
107	rsync -a --checksum --delete \
108	--exclude 'flutter/.home/' \
109	--exclude 'flutter/.clojuredart/' \
110	--exclude 'flutter/build/' \
111	--exclude 'flutter/lib/cljd-out/' \
112	--exclude 'flutter/.dart_tool/' \
113	--exclude '.toolchain/' \
114	--exclude '.git' \
115	/app/ "$SHELL_DIR/"
116
117	cd "$SHELL_DIR"
118	# What survived from the last run, by presence and not by size: `du` here
119	# walked the pub cache, the toolchain and every object of the last build over
120	# a network volume, for numbers nobody acts on.
121	for d in "$FRQ_TOOLCHAIN" flutter/.clojuredart flutter/lib/cljd-out flutter/build; do
122	[ -d "$d" ] && echo " carried over: $d"
123	done
124
125	# Run from the volume, where the state it reuses lives. `just` is not in this
126	# image and is not worth an apt line for one call: the recipe is a wrapper
127	# around the toolchain, and this is that wrapper.
128	tools/toolchain.sh exec -- bash -euo pipefail -c '
129	cd flutter
130	clojure -Sdeps "{:mvn/local-repo \\"$FRQ_M2\\"}" -M:cljd compile
131	flutter build linux --debug'
132
133	echo "built:"
134	du -sh flutter/build
135	"""
136	# Flutter keeps its settings under XDG_CONFIG_HOME and its own caches under
137	# XDG_CACHE_HOME. Both point into the volume so a second run finds what the
138	# first one decided. Set here rather than in the command so a shell into this
139	# container gets them too.
140	env = { XDG_CACHE_HOME = "/devshell/frq-desktop.toolchain/.cache", XDG_CONFIG_HOME = "/devshell/frq-desktop.toolchain/.config", FRQ_TOOLCHAIN = "/devshell/frq-desktop.toolchain" }