Enter git-forge-cloudflareHEADmaster

Runs git-forge on Cloudflare Containers with R2 for durable storage. A
Worker routes every request to one container through a Durable Object.
Inside it, syncd mirrors the data directory to the bucket and restores
it at boot, holding a write until it is durable.

git-forge is neither modified nor vendored: the image builds it from
its own repository at the commit named in forge.rev.

1 files changed, 39 insertions, 0 deletions

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000..73968f6
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,39 @@
+# Two binaries, one image, Alpine in both stages, matching git-forge's own
+# Containerfile.
+#
+# forge/ is vendored by ./fetch-forge before a build and is not committed.
+
+FROM alpine:3.23 AS build
+RUN apk add --no-cache go
+WORKDIR /src
+
+COPY forge/ ./forge/
+COPY go.mod ./syncd/
+COPY *.go ./syncd/
+
+# Static, so the runtime image needs no Go. buildvcs is off because neither tree
+# carries a .git this build should read.
+RUN cd forge && CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-s -w" -o /git-forge .
+RUN cd syncd && CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-s -w" -o /syncd .
+
+FROM alpine:3.23
+# git-daemon is not the daemon here: in Alpine that subpackage is where
+# git-http-backend lives, and without it every clone and push answers 500.
+# tini reaps what git leaves: a detached gc is reparented to PID 1 and would
+# otherwise stay a zombie.
+RUN apk add --no-cache git git-daemon cgit highlight ca-certificates tini
+COPY --from=build /git-forge /usr/local/bin/git-forge
+COPY --from=build /syncd /usr/local/bin/syncd
+# Which git-forge this is; syncd logs it at startup.
+COPY --from=build /src/forge/.rev /etc/git-forge.rev
+
+# Non-root, and the datadir is credential material, so 0700 and one owner.
+RUN adduser -D -H -u 1000 forge \
+	&& install -d -o forge -g forge -m 0700 /var/lib/git-forge
+USER forge
+ENV HOME=/tmp
+
+# No VOLUME: this disk is ephemeral by design and the durable copy is in the
+# bucket. 8081 is syncd; git-forge listens on loopback only.
+EXPOSE 8081
+ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/syncd"]