refactor: update Docker build context and paths in CI configuration and documentation

Modified the CI workflow to include the `--allow=fs.read` flag for Docker build commands, allowing access to the repository context. Updated the `docker-bake.hcl` file to reflect the correct paths for Dockerfiles, ensuring consistency with the new structure. Adjusted the README to clarify the changes in build commands and paths, enhancing overall documentation accuracy.

.gitea/workflows/ci.yaml

@@ -225,13 +225,13 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
           CACHE_REF_WEB: ""
-          # buildx bake: context ../.. (корень репо) — на доверенном CI отключаем fs entitlement gate
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: Web (evobgp-web, evobgp-web-all) — один npm ci (кэш) + два nginx-тега.
@@ -274,7 +274,8 @@ jobs:
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: BIRD2 (evobgp-bird2).
@@ -318,4 +319,5 @@ jobs:
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push

deploy/docker/README.md

@@ -28,11 +28,11 @@ export REGISTRY=git.shts.su/<owner>
 export IMAGE_TAG=latest
 export SHORT_SHA=$(git rev-parse --short HEAD)
 sh write-bake-override.sh
-docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images
-docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl go-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl web-images
 ```
 
-**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl`. В workflow задано `BUILDX_BAKE_ENTITLEMENTS_FS=0`, чтобы bake мог читать `context = "../.."` (корень репозитория). Локально при той же ошибке: `docker buildx bake --allow=fs.read=* …` или `export BUILDX_BAKE_ENTITLEMENTS_FS=0`.
+В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо). **CI:** `write-bake-override.sh` + `--allow=fs.read=$GITHUB_WORKSPACE` в `.gitea/workflows/ci.yaml`.
 
 Один образ (legacy):
 

deploy/docker/docker-bake.hcl

@@ -1,4 +1,6 @@
-# Единая сборка образов EvoBGP для CI (buildx bake из deploy/docker/).
+# Единая сборка образов EvoBGP (buildx bake: -f deploy/docker/docker-bake.hcl).
+# context = "../.." — корень репозитория (относительно этого файла).
+# dockerfile — путь от корня репозитория (относительно context).
 # Переменные: REGISTRY, IMAGE_TAG, CACHE_REF_GO, CACHE_REF_WEB
 
 variable "REGISTRY" {
@@ -70,7 +72,7 @@ group "web-images" {
 
 target "go-deps" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "deps"
   platforms  = ["linux/amd64"]
   cache-from = go-cache-from()
@@ -79,7 +81,7 @@ target "go-deps" {
 
 target "go-build-all" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "build-all"
   platforms  = ["linux/amd64"]
   contexts = {
@@ -91,7 +93,7 @@ target "go-build-all" {
 
 target "go-birdc" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "birdc"
   platforms  = ["linux/amd64"]
   cache-from = go-cache-from()
@@ -100,7 +102,7 @@ target "go-birdc" {
 
 target "_go-runtime" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "runtime"
   platforms  = ["linux/amd64"]
   contexts = {
@@ -112,7 +114,7 @@ target "_go-runtime" {
 
 target "_go-runtime-birdc" {
   context    = "../.."
-  dockerfile = "gobinary/Dockerfile"
+  dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "runtime-birdc"
   platforms  = ["linux/amd64"]
   contexts = {
@@ -179,7 +181,7 @@ target "evobgp-node" {
 
 target "evobgp-agent" {
   context    = "../.."
-  dockerfile = "evobgp-agent/Dockerfile"
+  dockerfile = "deploy/docker/evobgp-agent/Dockerfile"
   platforms  = ["linux/amd64"]
   contexts = {
     build-all = "target:go-build-all"
@@ -193,7 +195,7 @@ target "evobgp-agent" {
 
 target "web-deps" {
   context    = "../.."
-  dockerfile = "evobgp-web/Dockerfile"
+  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   target     = "deps"
   platforms  = ["linux/amd64"]
   cache-from = web-cache-from()
@@ -202,7 +204,7 @@ target "web-deps" {
 
 target "evobgp-web" {
   context    = "../.."
-  dockerfile = "evobgp-web/Dockerfile"
+  dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   platforms  = ["linux/amd64"]
   contexts = {
     deps = "target:web-deps"
@@ -221,7 +223,7 @@ target "evobgp-web-all" {
 
 target "evobgp-bird2" {
   context    = "../.."
-  dockerfile = "bird2/Dockerfile"
+  dockerfile = "deploy/docker/bird2/Dockerfile"
   platforms  = ["linux/amd64"]
   tags       = image-tags("evobgp-bird2")
 }