Improve docker workflow

.github/docker/Dockerfile

@@ -0,0 +1,34 @@
+#######################################
+#
+# Build Stage
+#
+#######################################
+FROM golang:1.20-alpine AS build-stage
+
+ENV ESM_SH_VERSION v127
+ENV ESM_SH_GIT_URL https://github.com/esm-dev/esm.sh
+
+RUN apk add --no-cache git
+RUN git clone --branch $ESM_SH_VERSION --depth 1 $ESM_SH_GIT_URL /tmp/esm.sh
+
+WORKDIR /tmp/esm.sh
+RUN CGO_ENABLED=0 GOOS=linux go build -o esmd main.go
+
+#######################################
+#
+# Release Stage
+#
+#######################################
+FROM node:18-alpine AS release-stage
+
+RUN apk update && apk add --no-cache libcap-utils
+RUN npm i -g pnpm
+
+COPY --from=build-stage /tmp/esm.sh/esmd /bin/esmd
+RUN setcap cap_net_bind_service=ep /bin/esmd
+RUN chown node:node /bin/esmd
+
+USER node
+WORKDIR /
+EXPOSE 8080
+CMD ["esmd"]

.github/workflows/docker-push-dev.yml

@@ -0,0 +1,39 @@
+name: Docker push dev
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  dev:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: esm-dev/esm.sh:dev

.github/workflows/docker-push-latest.yml

@@ -2,9 +2,8 @@ name: Docker push latest
 
 on:
   push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+    tags:
+      - v*
 
 jobs:
   latest:
@@ -17,15 +16,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ghcr.io/esm-dev/esm.sh
-          tags: |
-            type=edge
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
 
@@ -43,8 +33,7 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          context: .
+          context: ./.github/docker
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: esm-dev/esm.sh:latest,esm-dev/esm.sh:v127

Dockerfile

@@ -1,19 +1,19 @@
 #######################################
 #
-# Build
+# Build Stage
 #
 #######################################
 FROM golang:1.20-alpine AS build-stage
 
 RUN apk add --no-cache git
-RUN git clone --branch main https://github.com/esm-dev/esm.sh /tmp/esm.sh
+RUN git clone --branch main --depth 1 https://github.com/esm-dev/esm.sh /tmp/esm.sh
 
 WORKDIR /tmp/esm.sh
 RUN CGO_ENABLED=0 GOOS=linux go build -o esmd main.go
 
 #######################################
 #
-# Release
+# Release Stage
 #
 #######################################
 FROM node:18-alpine AS release-stage

HOSTING.md

@@ -63,7 +63,41 @@ your host machine.
 
 ## Deploy with Docker
 
-An example [Dockerfile](./Dockerfile) is found in the root of this project.
+esm.sh provides an official docker image for deployment. You can pull the container image from https://ghcr.io/esm-dev/esm.sh:
+
+```bash
+docker pull ghcr.io/esm-dev/esm.sh:v127   # specific version
+docker pull ghcr.io/esm-dev/esm.sh:latest # latest stable version
+docker pull ghcr.io/esm-dev/esm.sh:dev    # latest dev version
+```
+
+Then run the container:
+
+```bash
+docker run -p 8080:8080 \
+  -e NPM_REGISTRY=https://npmjs.org/registry \
+  -e NPM_TOKEN=xxxxxx \
+  ghcr.io/esm-dev/esm.sh:latest
+```
+
+Available environment variables:
+
+- `CDN_ORIGIN`: The origin of CDN, default is using the origin of the request.
+- `CDN_BASE_PATH`: The base path of CDN, default is "/".
+- `NPM_REGISTRY`: The NPM registry, default is "https://registry.npmjs.org/".
+- `NPM_TOKEN`: The NPM token for private packages.
+- `NPM_REGISTRY_SCOPE`: The NPM registry scope, default is no scope.
+- `NPM_USER`: The NPM user for private packages.
+- `NPM_PASSWORD`: The NPM password for private packages.
+- `SERVER_AUTH_SECRET`: The server auth secret, default is no auth.
+
+You can also create your own Dockerfile with `ghcr.io/esm-dev/esm.sh`:
+
+```dockerfile
+FROM ghcr.io/esm-dev/esm.sh
+ADD ./config.json /etc/esmd/config.json
+CMD ["esmd", "--config", "/etc/esmd/config.json"]
+```
 
 ## Deploy with Cloudflare Workers
 

config.example.jsonc

@@ -36,12 +36,12 @@
   // The log level, default is "info", you can also set it to "debug" to enable debug logs.
   "logLevel": "info",
 
-  // The origin of modules, default is using the origin of the request.
+  // The origin of CDN, default is using the origin of the request.
   // Use to fix origin with reverse proxy, for examle "https://esm.sh"
-  "origin": "",
+  "cdnOrigin": "",
 
-  // The base path of server, default is "/".
-  "basePath": "/",
+  // The base path of CDN, default is "/".
+  "cdnBasePath": "/",
 
   // The npm registry, default is "https://registry.npmjs.org/".
   "npmRegistry": "https://registry.npmjs.org/",
@@ -50,11 +50,12 @@
   // with this scope get downloaded from the registry, default is empty.
   // Default behavior is to fetch all packages from the npm registry.
   "npmRegistryScope": "@my-scope",
+
   // These two fields are used for basic authentication towards a private
   // package registry, default for both is empty.
-  "npmUser": "username",
-  "npmPassword": "password",
-  
+  "npmUser": "",
+  "npmPassword": "",
+
   // The npm token for private packages, default is empty.
   "npmToken": "",
 

server/build.go

@@ -328,7 +328,7 @@ rebuild:
 					func(args api.OnResolveArgs) (api.OnResolveResult, error) {
 						if strings.HasPrefix(args.Path, "file:") {
 							return api.OnResolveResult{
-								Path:     fmt.Sprintf("%s/error.js?type=unsupported-file-dependency&name=%s&importer=%s", cfg.BasePath, strings.TrimPrefix(args.Path, "file:"), task.Pkg),
+								Path:     fmt.Sprintf("%s/error.js?type=unsupported-file-dependency&name=%s&importer=%s", cfg.CdnBasePath, strings.TrimPrefix(args.Path, "file:"), task.Pkg),
 								External: true,
 							}, nil
 						}
@@ -441,7 +441,7 @@ rebuild:
 									}
 								}
 								return api.OnResolveResult{
-									Path:     fmt.Sprintf("%s/error.js?type=unsupported-npm-package&name=%s&importer=%s", cfg.BasePath, specifier, task.Pkg),
+									Path:     fmt.Sprintf("%s/error.js?type=unsupported-npm-package&name=%s&importer=%s", cfg.CdnBasePath, specifier, task.Pkg),
 									External: true,
 								}, nil
 							}
@@ -456,7 +456,7 @@ rebuild:
 
 						if strings.HasSuffix(fullFilepath, ".node") && fileExists(fullFilepath) {
 							return api.OnResolveResult{
-								Path:     fmt.Sprintf("%s/error.js?type=unsupported-node-native-module&name=%s&importer=%s", cfg.BasePath, path.Base(args.Path), task.Pkg),
+								Path:     fmt.Sprintf("%s/error.js?type=unsupported-node-native-module&name=%s&importer=%s", cfg.CdnBasePath, path.Base(args.Path), task.Pkg),
 								External: true,
 							}, nil
 						}
@@ -735,7 +735,7 @@ rebuild:
 					} else if task.Target == "deno" {
 						fmt.Fprintf(header, `import __Process$ from "https://deno.land/std@%s/node/process.ts";%s`, task.Args.denoStdVersion, EOL)
 					} else {
-						fmt.Fprintf(header, `import __Process$ from "%s/v%d/node_process.js";%s`, cfg.BasePath, task.BuildVersion, EOL)
+						fmt.Fprintf(header, `import __Process$ from "%s/v%d/node_process.js";%s`, cfg.CdnBasePath, task.BuildVersion, EOL)
 					}
 				}
 				if ids.Has("__Buffer$") {
@@ -744,7 +744,7 @@ rebuild:
 					} else if task.Target == "deno" {
 						fmt.Fprintf(header, `import { Buffer as __Buffer$ } from "https://deno.land/std@%s/node/buffer.ts";%s`, task.Args.denoStdVersion, EOL)
 					} else {
-						fmt.Fprintf(header, `import { Buffer as __Buffer$ } from "%s/v%d/[email protected]/%s/buffer.mjs";%s`, cfg.BasePath, task.BuildVersion, task.Target, EOL)
+						fmt.Fprintf(header, `import { Buffer as __Buffer$ } from "%s/v%d/[email protected]/%s/buffer.mjs";%s`, cfg.CdnBasePath, task.BuildVersion, task.Target, EOL)
 					}
 				}
 				if ids.Has("__global$") {
@@ -910,11 +910,11 @@ func (task *BuildTask) resolveExternal(specifier string, kind api.ResolveKind) s
 			} else {
 				_, err := embedFS.ReadFile(fmt.Sprintf("server/embed/polyfills/node_%s.js", specifier))
 				if err == nil {
-					importPath = fmt.Sprintf("%s/v%d/node_%s.js", cfg.BasePath, task.BuildVersion, specifier)
+					importPath = fmt.Sprintf("%s/v%d/node_%s.js", cfg.CdnBasePath, task.BuildVersion, specifier)
 				} else {
 					importPath = fmt.Sprintf(
 						"%s/error.js?type=unsupported-node-builtin-module&name=%s&importer=%s",
-						cfg.BasePath,
+						cfg.CdnBasePath,
 						specifier,
 						task.Pkg,
 					)
@@ -961,7 +961,7 @@ func (task *BuildTask) resolveExternal(specifier string, kind api.ResolveKind) s
 			importPath = jsDataUrl(`export const AbortSignal=globalThis.AbortSignal;export const AbortController=globalThis.AbortController;export default AbortController`)
 		case "node-fetch":
 			if task.Target != "node" {
-				importPath = fmt.Sprintf("%s/v%d/node_fetch.js", cfg.BasePath, task.BuildVersion)
+				importPath = fmt.Sprintf("%s/v%d/node_fetch.js", cfg.CdnBasePath, task.BuildVersion)
 			}
 		}
 	}

server/build_helpers.go

@@ -88,7 +88,7 @@ func (task *BuildTask) getImportPath(pkg Pkg, buildArgsPrefix string) string {
 
 	return fmt.Sprintf(
 		"%s/%s/%s@%s/%s%s/%s%s",
-		cfg.BasePath,
+		cfg.CdnBasePath,
 		task.getBuildVersion(pkg),
 		pkg.Name,
 		pkg.Version,