-
Notifications
You must be signed in to change notification settings - Fork 0
Build and deploy skysim from the repository, world included #9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| # skysim as it is deployed: the binary plus the world it flies in. | ||
| # | ||
| # The plain Dockerfile deliberately ships no tiles — worlds are cooked separately so a | ||
| # new city does not mean a new image, and locally they are mounted. The deployed ECS | ||
| # services have no volume mounts, though, so the world has to travel with the image: | ||
| # without it skysim starts flat, every route sweep answers "no building data", and the | ||
| # overwatch coordinator refuses to launch anything at all. | ||
| # | ||
| # The buildspec fetches the cooked world into world-tiles/ before this runs. It creates | ||
| # the directory either way, so a build with no world still produces a working simulator | ||
| # rather than failing on a missing COPY. | ||
| FROM skyhub-skysim:build | ||
|
|
||
| COPY world-tiles/ /opt/skysim/tiles/ | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| # Build skysim and deploy it to the ECS service for this environment. | ||
| # | ||
| # Two things differ from the other services in this account, both deliberate: | ||
| # | ||
| # * x86_64, not ARM. The skysim task definitions are X86_64 on both dev and prod, and | ||
| # an image built for the wrong architecture fails at task start rather than at build. | ||
| # * The world is fetched from S3 and baked in. See Dockerfile.ecr. | ||
| # | ||
| # WORLD_S3_URI and IMAGE_NAME come from the CodeBuild project's environment, so the same | ||
| # buildspec serves dev and prod. | ||
| version: 0.2 | ||
|
|
||
| phases: | ||
| install: | ||
| commands: | ||
| - nohup /usr/local/bin/dockerd --host=unix:///var/run/docker.sock --host=tcp://127.0.0.1:2375 & | ||
| - timeout 15 sh -c "until docker info; do echo .; sleep 1; done" | ||
| - echo Logging in to Amazon ECR... | ||
| - export ECR_URI="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com" | ||
| - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ECR_URI | ||
| pre_build: | ||
| commands: | ||
| # Always present, possibly empty: a missing directory would fail the COPY, and a | ||
| # simulator with no buildings is still a working simulator. | ||
| - mkdir -p world-tiles | ||
| - | | ||
| if [ -n "$WORLD_S3_URI" ]; then | ||
| echo "Fetching cooked world from $WORLD_S3_URI" | ||
| aws s3 cp "$WORLD_S3_URI" /tmp/world.tgz | ||
| tar -xzf /tmp/world.tgz -C world-tiles | ||
| echo "world: $(ls world-tiles | wc -l) file(s)" | ||
| else | ||
| echo "WORLD_S3_URI is unset — building with no buildings" | ||
| fi | ||
|
Comment on lines
+25
to
+34
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== files ==\n'
git ls-files | rg '^(buildspec\.yml|Dockerfile\.ecr|src/main\.cpp|.*TileStreamer.*|.*tile.*stream.*|.*ecs.*|.*task.*json)$' || true
printf '\n== buildspec.yml ==\n'
nl -ba buildspec.yml | sed -n '1,120p'
printf '\n== Dockerfile.ecr ==\n'
nl -ba Dockerfile.ecr | sed -n '1,220p'
printf '\n== search for index.json / tiles references ==\n'
rg -n --hidden --glob '!**/.git/**' 'index\.json|world-tiles|--tiles|TileStreamer|tile_dir|tiles missing|zero-loaded|no-world|WORLD_S3_URI' .Repository: ID-Robots/skysim Length of output: 328 🏁 Script executed: #!/bin/bash
set -euo pipefail
nl -ba buildspec.yml | sed -n '20,60p'Repository: ID-Robots/skysim Length of output: 194 🏁 Script executed: #!/bin/bash
set -euo pipefail
pwd
ls -1Repository: ID-Robots/skysim Length of output: 298 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== buildspec.yml ==\n'
sed -n '1,120p' buildspec.yml
printf '\n== Dockerfile.ecr ==\n'
sed -n '1,220p' Dockerfile.ecr
printf '\n== src/main.cpp ==\n'
sed -n '1,240p' src/main.cpp
printf '\n== src/terrain/tile_streamer.h ==\n'
sed -n '1,220p' src/terrain/tile_streamer.h
printf '\n== src/terrain/tile_streamer.cpp ==\n'
sed -n '1,260p' src/terrain/tile_streamer.cppRepository: ID-Robots/skysim Length of output: 19958 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== main tile startup ==\n'
grep -n -A80 -B40 'TileStreamer\|--tiles\|tiles' src/main.cpp
printf '\n== all --tiles references ==\n'
rg -n --hidden --glob '!**/.git/**' -- '--tiles|TileStreamer|index\.json|world-tiles|/opt/skysim/tiles' .Repository: ID-Robots/skysim Length of output: 37963 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '1,120p' docker-entrypoint.sh
printf '\n== relevant docs ==\n'
sed -n '35,70p' docs/SKYHUB_INTEGRATION.md
printf '\n== README tiles section ==\n'
sed -n '115,145p' README.mdRepository: ID-Robots/skysim Length of output: 5223 Keep the no-world image from exporting 🤖 Prompt for AI Agents |
||
| build: | ||
| commands: | ||
| - echo "Building skysim" | ||
| - docker build --cache-from $IMAGE_NAME:latest -t skyhub-skysim:build . | ||
| - docker build -f Dockerfile.ecr -t $IMAGE_NAME:latest . | ||
| - docker tag $IMAGE_NAME:latest $IMAGE_NAME:$CODEBUILD_RESOLVED_SOURCE_VERSION | ||
| post_build: | ||
| commands: | ||
| # Both tags, so a deployment can be traced back to the commit that produced it. | ||
| - docker push -a $IMAGE_NAME | ||
| - aws ecs update-service --service $ECS_SERVICE --force-new-deployment --cluster $ECS_CLUSTER --region $AWS_DEFAULT_REGION | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
wc -l buildspec.yml
sed -n '1,120p' buildspec.yml | cat -nRepository: ID-Robots/skysim Length of output: 2598 🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n "ecs wait|services-stable|update-service" .Repository: ID-Robots/skysim Length of output: 302 Wait for the ECS deployment to stabilize. 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Run the ECS workload as a non-root user.
This image inherits the base image’s default user and contains no
USERinstruction, so the simulator runs as root. Create/select a non-root user in the base or runtime image, setUSER, and verify that the binary and/opt/skysim/tilesremain readable.🤖 Prompt for AI Agents
Source: Linters/SAST tools