main docker-bake.hcl
Antonio Mika  ·  2026-10-11
  1variable "REGISTRY" {
  2  default = "ghcr.io"
  3}
  4
  5# Tag names without the image, separated by newlines or commas.
  6variable "TAGS" {
  7  default = "latest"
  8}
  9
 10# Set to "true" in GitHub Actions to read and write the layer cache.
 11variable "GHA_CACHE" {
 12  default = ""
 13}
 14
 15function "tags" {
 16  params = [image]
 17  result = formatlist("${REGISTRY}/${image}:%s", compact(split(",", replace(TAGS, "\n", ","))))
 18}
 19
 20# Each image gets its own scope so builds don't overwrite each other's cache.
 21function "cache_from" {
 22  params = [scope]
 23  result = GHA_CACHE == "true" ? ["type=gha,scope=${scope}"] : []
 24}
 25
 26function "cache_to" {
 27  params = [scope]
 28  result = GHA_CACHE == "true" ? ["type=gha,scope=${scope},mode=max"] : []
 29}
 30
 31# Filled in with labels by docker/metadata-action.
 32target "docker-metadata-action" {}
 33
 34target "_common" {
 35  inherits  = ["docker-metadata-action"]
 36  context   = "."
 37  platforms = ["linux/amd64", "linux/arm64"]
 38}
 39
 40group "default" {
 41  targets = ["apps", "auth-web", "pico-ssh", "pgs-cdn", "pgs-standalone"]
 42}
 43
 44target "apps" {
 45  name     = "${app}-${kind}"
 46  matrix = {
 47    app  = ["prose", "pastes", "pgs", "feeds", "pipe"]
 48    kind = ["web", "ssh"]
 49  }
 50  inherits   = ["_common"]
 51  target     = "release-${kind}"
 52  args       = { APP = app }
 53  tags       = tags("picosh/pico/${app}-${kind}")
 54  cache-from = cache_from("${app}-${kind}")
 55  cache-to   = cache_to("${app}-${kind}")
 56}
 57
 58target "auth-web" {
 59  inherits   = ["_common"]
 60  target     = "release-web"
 61  args       = { APP = "auth" }
 62  tags       = tags("picosh/pico/auth-web")
 63  cache-from = cache_from("auth-web")
 64  cache-to   = cache_to("auth-web")
 65}
 66
 67target "pico-ssh" {
 68  inherits   = ["_common"]
 69  target     = "release-ssh"
 70  args       = { APP = "pico" }
 71  tags       = tags("picosh/pico/pico-ssh")
 72  cache-from = cache_from("pico-ssh")
 73  cache-to   = cache_to("pico-ssh")
 74}
 75
 76target "pgs-cdn" {
 77  inherits   = ["_common"]
 78  dockerfile = "Dockerfile.cdn"
 79  target     = "release-web"
 80  tags       = tags("picosh/pico/pgs-cdn")
 81  cache-from = cache_from("pgs-cdn")
 82  cache-to   = cache_to("pgs-cdn")
 83}
 84
 85target "pgs-standalone" {
 86  inherits   = ["_common"]
 87  dockerfile = "Dockerfile.standalone"
 88  target     = "release"
 89  tags       = tags("picosh/pgs")
 90  cache-from = cache_from("pgs-standalone")
 91  cache-to   = cache_to("pgs-standalone")
 92}
 93
 94# caddy and bouncer have their own workflows, so they stay out of the default group.
 95target "caddy" {
 96  inherits   = ["_common"]
 97  context    = "./caddy"
 98  tags       = tags("picosh/pico/caddy")
 99  cache-from = cache_from("caddy")
100  cache-to   = cache_to("caddy")
101}
102
103target "bouncer" {
104  inherits   = ["_common"]
105  context    = "./bouncer"
106  tags       = tags("picosh/pico/bouncer")
107  cache-from = cache_from("bouncer")
108  cache-to   = cache_to("bouncer")
109}