chore(docker): fix & rewrite Node Dockerfiles

The new versions of these are designed to properly take advantage of pnpm and to
also minimize output size.

The builder image no longer is built on layers starting with just the
package.json files.  The reason for this is that with pnpm's content-addressed
store and the docker buildkit cache mounts, rebuilding the layers adds only
trivial overhead if dependencies haven't changed, and removing the Docker
layering to attempt to cache images with just node modules reduces complexity
significantly.

The runner image is now based on alpine and is drastically smaller.  We use
`pnpm export` (or, in the case of nextjs, we use standalone builds) to populate
the runner images with only the necessary packages and dependencies to further
reduce image sizes.

Author: cprussin

.github/workflows/push-price-pusher-image.yml

@@ -39,7 +39,8 @@ jobs:
       - uses: aws-actions/amazon-ecr-login@v1
         id: ecr_login
       - run: |
-          DOCKER_BUILDKIT=1 docker build -t lerna -f Dockerfile.lerna .
+          DOCKER_BUILDKIT=1 docker build -t builder -f Dockerfile.builder .
+          DOCKER_BUILDKIT=1 docker build -t runner -f Dockerfile.runner .
           DOCKER_BUILDKIT=1 docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f apps/price_pusher/Dockerfile .
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
         env:

.github/workflows/push-xc-admin-image.yml renamed to .github/workflows/push-xc-admin-crank-executor-image.yml

@@ -29,8 +29,9 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build docker image
         run: |
-          DOCKER_BUILDKIT=1 docker build -t lerna -f Dockerfile.lerna .
-          DOCKER_BUILDKIT=1 docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} -f governance/xc_admin/Dockerfile .
+          DOCKER_BUILDKIT=1 docker build -t builder -f Dockerfile.builder .
+          DOCKER_BUILDKIT=1 docker build -t runner -f Dockerfile.runner .
+          DOCKER_BUILDKIT=1 docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} -f governance/xc_admin/packages/crank_executor/Dockerfile .
       - name: Push docker image
         run: |
           docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}

.github/workflows/push-xc-admin-frontend-image.yml

@@ -28,7 +28,8 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build docker image
         run: |
-          DOCKER_BUILDKIT=1 docker build -t lerna -f Dockerfile.lerna .
+          DOCKER_BUILDKIT=1 docker build -t builder -f Dockerfile.builder .
+          DOCKER_BUILDKIT=1 docker build -t runner -f Dockerfile.runner .
           DOCKER_BUILDKIT=1 docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} \
             --build-arg NEXT_PUBLIC_RPC_POOL_TOKEN=${{ secrets.NEXT_PUBLIC_RPC_POOL_TOKEN }} \
             -f governance/xc_admin/packages/xc_admin_frontend/Dockerfile .

Dockerfile.builder

@@ -0,0 +1,7 @@
+FROM node:18.20-slim@sha256:1da7652745e9ba5de396e436aa086588ea50d532540fa3147fbc1957c43a46ab as builder
+WORKDIR /usr/src/pyth
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable
+COPY ./ .
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile

Dockerfile.lerna

@@ -0,0 +1,5 @@
+FROM node:18.20-alpine@sha256:6937be95129321422103452e2883021cc4a96b63c32d7947187fcb25df84fc3f as runner
+WORKDIR /srv
+ENV NODE_ENV production
+RUN addgroup --system --gid 1001 pyth && adduser --system --uid 1001 pyth -g pyth && chown pyth:pyth .
+USER pyth

Dockerfile.runner

@@ -1,22 +1,11 @@
-# Defined in Dockerfile.lerna
-FROM lerna:latest
-
-USER root
-
-WORKDIR /home/node/
-USER 1000
-
-# local dependencies
-COPY --chown=1000:1000 target_chains/ethereum/sdk/solidity target_chains/ethereum/sdk/solidity
-COPY --chown=1000:1000 target_chains/sui/sdk/js target_chains/sui/sdk/js
-COPY --chown=1000:1000 price_service/client/js price_service/client/js
-COPY --chown=1000:1000 price_service/sdk/js price_service/sdk/js
-COPY --chown=1000:1000 target_chains/solana/sdk/js target_chains/solana/sdk/js
-
-COPY --chown=1000:1000 apps/price_pusher apps/price_pusher
-
+# Defined in Dockerfile.builder
+FROM builder AS price-pusher-builder
+RUN apt-get update && apt-get install -y git
 RUN pnpm exec lerna run build --scope="@pythnetwork/price-pusher" --include-dependencies
+RUN pnpm deploy --filter @pythnetwork/price-pusher --prod /srv/price-pusher
 
-WORKDIR /home/node/apps/price_pusher
 
-ENTRYPOINT [ "pnpm", "run", "start" ]
+# Defined in Dockerfile.runner
+FROM runner as price-pusher
+COPY --from=price-pusher-builder --chown=pyth:pyth /srv/price-pusher ./
+CMD [ "node", "lib/index.js" ]

apps/price_pusher/Dockerfile

@@ -1,9 +1,10 @@
 services:
   price-pusher:
-    # Use this to build the price pusher from source. A dependency of the pusher docker
-    # image is the pyth-crosschain monorepo lerna docker image. Build lerna image
-    # using the following command from the repo root:
-    # `docker buildx build -f Dockerfile.lerna -t lerna .`
+    # Use this to build the price pusher from source. The pusher docker image
+    # depends on the pyth-crosschain monorepo builder and runner docker
+    # images. Build the images using the following commands from the repo root:
+    # `docker buildx build -f Dockerfile.builder -t builder .`
+    # `docker buildx build -f Dockerfile.runner -t runner .`
     #
     # Please note that the docker build from source only works in x86_64 platforms
     # and doesn't work on arm platforms (like Apple M1/M2).

apps/price_pusher/docker-compose.beta.sample.yaml

@@ -1,9 +1,10 @@
 services:
   price-pusher:
-    # Use this to build the price pusher from source. A dependency of the pusher docker
-    # image is the pyth-crosschain monorepo lerna docker image. Build lerna image
-    # using the following command from the repo root:
-    # `docker buildx build -f Dockerfile.lerna -t lerna .`
+    # Use this to build the price pusher from source. The pusher docker image
+    # depends on the pyth-crosschain monorepo builder and runner docker
+    # images. Build the images using the following commands from the repo root:
+    # `docker buildx build -f Dockerfile.builder -t builder .`
+    # `docker buildx build -f Dockerfile.runner -t runner .`
     #
     # Please note that the docker build from source only works in x86_64 platforms
     # and doesn't work on arm platforms (like Apple M1/M2).