Dockerfiles from templates

.github/actions/build/action.yaml

@@ -14,10 +14,10 @@ inputs:
     description: "Pandoc version to build."
     default: main
     type: string
-  dockerfile:
-    description: "Dockerfile to build"
-    required: true
-    type: string
+  no_cache:
+    description: "Don't use the cache when building"
+    default: false
+    type: boolean
   target:
     description: "Dockerfile target"
     type: string
@@ -32,63 +32,50 @@ runs:
     - name: Env variables
       shell: bash
       run: |
-        if [ "${{ inputs.pandoc_version }}" = 'edge' ]; then
-            printf 'PANDOC_COMMIT=main\n' >> $GITHUB_ENV
-        else
-            printf 'PANDOC_COMMIT=${{inputs.pandoc_version}}\n' >> $GITHUB_ENV
-        fi
-        TEST_IMAGE=${{
+        printf 'TEST_IMAGE=%s\n' ${{
           format('pandoc/test:{0}-{1}-{2}',
             inputs.image_type,
             inputs.base_system,
             inputs.pandoc_version
-          ) }}
-        printf 'TEST_IMAGE<<EOF\n%s\nEOF\n' "$TEST_IMAGE" >> $GITHUB_ENV
-
-    - name: Meta
-      id: meta
-      uses: ./.github/actions/meta
-      with:
-        images: |
-          pandoc/${{ inputs.image_type }}
-          ghcr.io/pandoc/${{ inputs.image_type }}
-        pandoc_version: ${{ env.PANDOC_COMMIT }}
-        build_stack: ${{ inputs.base_system }}
+          ) }} >> $GITHUB_ENV
 
     - name: Build
       if: >-
         ${{ inputs.build_stack != 'static' || inputs.image_type == 'minimal' }}
-      uses: docker/build-push-action@v6
+      uses: docker/bake-action@v6
       with:
-        context: '.'
-        file: ${{ inputs.dockerfile }}
+        files: docker-bake.json
         load: true
+        no-cache: ${{ inputs.no_cache }}
         pull: true
         push: false
-        target: ${{ inputs.target }}
-        tags: ${{ env.TEST_IMAGE }}
-        build-args: ${{ steps.meta.outputs.build_args }}
+        set: |
+          *.platform=linux/amd64
+          *.tags=${{ env.TEST_IMAGE }}
+        source: '.'
+        targets: ${{ inputs.base_system }}-${{ inputs.image_type }}
+        workdir: ${{ inputs.pandoc_version }}
 
     - name: Test
       shell: bash
       run: make test-${{ inputs.image_type }} IMAGE=${{ env.TEST_IMAGE }}
 
-    - name: Push
+    - name: Build arm64 and push
       if: >-
         ${{ inputs.build_stack != 'static' || inputs.image_type == 'minimal' }}
-      uses: docker/build-push-action@v6
+      uses: docker/bake-action@v6
       with:
-        context: '.'
-        file: ${{ inputs.dockerfile }}
-        labels: ${{ steps.meta.outputs.labels }}
+        files: docker-bake.json
+        no-cache: ${{ inputs.no_cache }}
         pull: true
         push: true
-        target: ${{ inputs.target }}
-        tags: ${{ steps.meta.outputs.tags }}
-        build-args: ${{ steps.meta.outputs.build_args }}
         # LaTeX doesn't work for Alpine on arm64.
-        platforms: ${{
-          ( inputs.base_system == 'alpine' &&
-            (inputs.image_type == 'latex' || inputs.image_type == 'extra') )
-          && 'linux/amd64'
-          || 'linux/amd64,linux/arm64' }}
+        set: |
+          *.platform=${{
+            ( inputs.base_system == 'alpine' &&
+              (inputs.image_type == 'latex' || inputs.image_type == 'extra') )
+            && 'linux/amd64'
+            || 'linux/amd64,linux/arm64' }}
+        source: '.'
+        targets: ${{ inputs.base_system }}-${{ inputs.image_type }}
+        workdir: ${{ inputs.pandoc_version }}

.github/workflows/addon.yaml

@@ -12,6 +12,9 @@ on:
       base_system:
         type: string
         default: alpine
+      no_cache:
+        type: boolean
+        default: false
     secrets:
       DOCKER_HUB_USERNAME:
         required: true
@@ -37,6 +40,9 @@ on:
           - alpine
           - ubuntu
         default: alpine
+      no_cache:
+        type: boolean
+        default: false
 
 jobs:
   build:
@@ -47,6 +53,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install current pandoc
+        uses: pandoc/actions/setup@v1
+
+      - name: Generate Dockerfiles
+        run: >-
+          pandoc lua pandock.lua generate \
+              ${{ inputs.pandoc_version }} \
+              ${{ inputs.base_system }} \
+              ${{ inputs.addon }}
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -73,4 +89,4 @@ jobs:
           image_type: ${{ inputs.addon }}
           base_system: ${{ inputs.base_system }}
           pandoc_version: ${{ inputs.pandoc_version }}
-          dockerfile: ${{ inputs.base_system }}/${{ inputs.addon }}/Dockerfile
+          no_cache: ${{ inputs.no_cache }}

.github/workflows/build.yaml

@@ -12,8 +12,8 @@ on:
     inputs:
       pandoc_version:
         description: >-
-          Pandoc version; must be either `main` or a release number
-        default: main
+          Version; must be either `edge` or the number of a pandoc release
+        default: edge
         type: string
       base_system:
         description: Docker base system
@@ -75,7 +75,19 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install current pandoc
+        uses: pandoc/actions/setup@v1
+
+      - name: Generate Dockerfiles
+        run: >-
+          pandoc lua pandock.lua generate \
+              ${{ inputs.pandoc_version }} \
+              ${{ inputs.base_system }} \
+              ${{ inputs.addon }}
+
 
       - name: Login to Docker Hub
         uses: docker/login-action@v3
@@ -104,8 +116,7 @@ jobs:
           image_type: minimal
           base_system: ${{ matrix.stack }}
           pandoc_version: ${{ matrix.version }}
-          dockerfile: ${{ matrix.stack }}/Dockerfile
-          target: ${{ matrix.stack }}-minimal
+          target: minimal
 
       - name: core
         uses: ./.github/actions/build
@@ -114,8 +125,7 @@ jobs:
           image_type: core
           base_system: ${{ matrix.stack }}
           pandoc_version: ${{ matrix.version }}
-          dockerfile: ${{ matrix.stack }}/Dockerfile
-          target: ${{ matrix.stack }}-core
+          target: core
 
   typst:
     name: Typst (${{ matrix.stack }})

.github/workflows/dockerhub-description.yaml

@@ -33,9 +33,7 @@ jobs:
       - name: Short description
         id: config
         run: |
-          printf 'short_description=%s\n' \
-            "$(pandoc lua docs/scripts/short-description.lua \
-                      ${{ matrix.image }})" \
+          pandoc lua pandock.lua short-description "${{ matrix.image }})" \
             >> $GITHUB_OUTPUT
 
 

alpine/Dockerfile → alpine/Dockerfile.tmpl

@@ -1,8 +1,12 @@
 # Base ##################################################################
-ARG base_image_version=3.20
-FROM alpine:$base_image_version AS alpine-builder-base
+ARG base_image_version=${base_image_version}
+FROM alpine:$$base_image_version AS builder-base
 WORKDIR /app
 
+# We're already very specific about the version of the alpine image, so
+# it seems reasonable not to require specific package versions.
+#
+# hadolint ignore=DL3018
 RUN apk --no-cache add \
         alpine-sdk \
         bash \
@@ -21,40 +25,37 @@ RUN apk --no-cache add \
 
 # Setup and configure cabal
 ENV CABAL_CONFIG=/root/.config/cabal/config
-COPY cabal.root.config $CABAL_CONFIG
 
-RUN cabal --version \
+RUN cabal user-config init \
+  && cabal --version \
   && ghc --version \
   && cabal update
 
 # Builder ###############################################################
-FROM alpine-builder-base AS alpine-builder
-ARG pandoc_commit=main
-RUN git clone --branch=$pandoc_commit --depth=1 --quiet \
-  https://github.com/jgm/pandoc /usr/src/pandoc
+FROM builder-base AS builder
+RUN git clone --branch=${pandoc_commit} --depth=1 --quiet \
+  https://github.com/jgm/pandoc /app
 
-COPY ./alpine/freeze/pandoc-$pandoc_commit.project.freeze \
-     /usr/src/pandoc/cabal.project.freeze
-
-# Install Haskell dependencies
-WORKDIR /usr/src/pandoc
 # Add pandoc-crossref to project
-ARG without_crossref=
-RUN test -n "$without_crossref" || \
-    printf "extra-packages: pandoc-crossref\n" > cabal.project.local;
-
-# Additional projects to compile alongside pandoc
-ARG extra_packages="pandoc-cli pandoc-crossref"
+RUN printf "extra-packages: pandoc-crossref\n" > cabal.project.local;
 
 # Build pandoc and pandoc-crossref. The `allow-newer` is required for
 # when pandoc-crossref has not been updated yet, but we want to build
 # anyway.
-RUN cabal update && cabal build \
-      --allow-newer 'lib:pandoc' \
-      --disable-tests \
-      --disable-bench \
-      --jobs \
-      . $extra_packages
+RUN cabal build \
+        --jobs \
+        --disable-tests \
+        --disable-bench \
+        --enable-split-sections \
+        --enable-executable-stripping \
+        --upgrade-dependencies \
+        --allow-newer='lib:pandoc' \
+        --ghc-options='-O1 -optc-Os -optl=-pthread -fPIC -j' \
+        --ghc-options='+RTS -M4G -A128m -n2m -RTS' \
+$for(cabal.constraints)$
+        --constraint='${it}' \
+$endfor$
+        . pandoc-cli pandoc-crossref
 
 # Cabal's exec stripping doesn't seem to work reliably, let's do it here.
 RUN find dist-newstyle \
@@ -63,12 +64,12 @@ RUN find dist-newstyle \
          -exec cp '{}' /usr/local/bin/ ';'
 
 # Minimal ###############################################################
-FROM alpine:$base_image_version AS alpine-minimal
+FROM alpine:${base_image_version} AS minimal
 ARG pandoc_version=edge
 LABEL maintainer='Albert Krewinkel <albert+pandoc@tarleb.com>'
 LABEL org.pandoc.maintainer='Albert Krewinkel <albert+pandoc@tarleb.com>'
 LABEL org.pandoc.author="John MacFarlane"
-LABEL org.pandoc.version="$pandoc_version"
+LABEL org.pandoc.version="${pandoc_version}"
 
 # Set user data directory
 ENV XDG_DATA_HOME=/usr/local/share
@@ -77,11 +78,13 @@ ENV XDG_DATA_HOME=/usr/local/share
 WORKDIR /data
 ENTRYPOINT ["/usr/local/bin/pandoc"]
 
-COPY --from=alpine-builder \
+COPY --from=builder \
   /usr/local/bin/pandoc \
   /usr/local/bin/
 
 # Add pandoc symlinks
+#
+# hadolint ignore=DL3018
 RUN ln -s /usr/local/bin/pandoc /usr/local/bin/pandoc-lua && \
     ln -s /usr/local/bin/pandoc /usr/local/bin/pandoc-server && \
 # Install runtime dependencies
@@ -90,16 +93,17 @@ RUN ln -s /usr/local/bin/pandoc /usr/local/bin/pandoc-lua && \
         libffi \
         lua5.4 && \
 # Create user data directory
-    mkdir -p "$XDG_DATA_HOME"/pandoc
+    mkdir -p "$$XDG_DATA_HOME"/pandoc
 
 # Core ##################################################################
-FROM alpine-minimal AS alpine-core
-COPY --from=alpine-builder \
+FROM minimal AS core
+COPY --from=builder \
   /usr/local/bin/pandoc-crossref \
   /usr/local/bin/
 
 # Additional packages frequently used during conversions
 # NOTE: `libsrvg`, pandoc uses `rsvg-convert` for working with svg images.
 # FIXME: Alpine 3.17 and later ships the binary in the rsvg-convert package.
+# hadolint ignore=DL3018
 RUN apk --no-cache add librsvg; \
     apk --no-cache add rsvg-convert || true