feat(dependencies): add @redocly/cli and update CI workflows

- Added `@redocly/cli` version 1.34.5 to `package.json` and `pnpm-lock.yaml` for OpenAPI linting.
- Updated CI workflows to reflect changes in job names and processes, including adjustments to the `publish` job in the CD workflow.
- Enhanced documentation to clarify the new CI/CD processes and Docker build configurations.

deploy/docker/README.md

@@ -2,29 +2,38 @@
 
 ## CI (Gitea Actions)
 
-Сборка образов — **`docker buildx bake`** (`deploy/docker/docker-bake.hcl`), не отдельные `docker build`.
+Сборка образов — **`docker buildx bake`** ([docker-bake.hcl](docker-bake.hcl)), не отдельные `docker build`.
 
-**Publish:** push в `main` после quality gates — job **release** в [.gitea/workflows/ci.yaml](../.gitea/workflows/ci.yaml): semantic-release + bake с `VERSION` из релиза.
+**Publish:** push в `main` после quality gates — workflow [CD](../../.gitea/workflows/cd.yaml) job **publish**: semantic-release + зеркало base-образов + bake с `VERSION` из релиза.
 
-Локально BuildKit также кэширует `/go/pkg/mod` и `~/.cache/go-build` через `RUN --mount=type=cache`.
+Bake читает переменные из **окружения** (`REGISTRY`, `IMAGE_TAG`, `CACHE_REF_*`, `BASE_*`). Скрипт [write-bake-override.sh](write-bake-override.sh) — опциональный helper для локальной отладки.
 
-| Было | Стало |
-|------|--------|
-| 8× `go mod download` + 8× `go build` (разные BIN) | 1× download + 1× компиляция всех `cmd/*` |
-| 2× сборка BIRD из исходников (api, all) | 1× stage `birdc`, копируется в runtime |
-| 2× `npm ci` (web, web-all) | 1× `web-deps` + 1× `web-build` + два nginx-образа (общий артефакт) |
-| 8 runner'ов с checkout/login | 1 job `docker-go`, 1 job `docker-web` |
+BuildKit кэширует `/go/pkg/mod`, `~/.cache/go-build` и pnpm store через `RUN --mount=type=cache`. На CI mounts живут, пока named builder `evobgp` не удаляют (`cleanup: false`).
 
-Кэш registry (переменные bake):
+### Слои и runtime
 
-- `git.shx.one/<owner>/evobgp-buildcache:go-buildcache` — **запись** только из target `go-build-all`
-- `git.shx.one/<owner>/evobgp-buildcache:web-buildcache` — **запись** только из target `web-build`
+| Образ | Runtime base | Заметка |
+|-------|----------------|---------|
+| scheduler, ingest, render, deploy, node | `gcr.io/distroless/static-debian12:nonroot` | static Go (`CGO_ENABLED=0`), без shell |
+| api, all | `debian:bookworm-slim` + `birdc` | только клиент birdc, без демона `bird` |
+| agent | тот же Ubuntu+bird2, что bird2 | общие слои с `evobgp-bird2` |
+| bird2 | Ubuntu Noble + пакет bird2 | |
+| web, web-all | `nginx:1.27-alpine` | `worker_processes 1` |
 
-Остальные bake-target’ы только `cache-from` (чтение). Параллельный `cache-to` в один ref ломает manifest в registry (`content descriptor … not found`).
+Сборка Go: `golang:1.24-alpine`. Context режется корневым [.dockerignore](../../.dockerignore).
 
-Локально BuildKit также кэширует `/go/pkg/mod` и `~/.cache/go-build` через `RUN --mount=type=cache`.
+### Кэш registry
 
-Если CI падает на «not found» после смены схемы кэша — один раз удалите теги `evobgp-buildcache:go-buildcache` и `:web-buildcache` в registry и пересоберите.
+- `git.shx.one/<owner>/evobgp-buildcache:go-buildcache` — **запись** только из `go-build-all`
+- `git.shx.one/<owner>/evobgp-buildcache:web-buildcache` — **запись** только из `web-build`
+- `git.shx.one/<owner>/evobgp-buildcache:birdc-buildcache` — **запись** только из `go-birdc`
+- `git.shx.one/<owner>/evobgp-buildcache:base-*` — зеркало FROM-образов (`mirror-base-images.sh`), без rebuild
+
+`pull = false` в bake: не перекачивать FROM, если слой уже в builder. Не запускайте `docker system prune -a` на runner.
+
+Параллельный `cache-to` в один ref ломает manifest (`content descriptor … not found`).
+
+Если CI падает на «not found» после смены схемы кэша — один раз удалите теги `evobgp-buildcache:*` в registry и пересоберите.
 
 ## Локальная сборка
 
@@ -37,20 +46,24 @@ export IMAGE_TAG=latest
 export SHORT_SHA=$(git rev-parse --short HEAD)
 export VERSION=dev
 export BUILD_TIME=
-sh write-bake-override.sh
-docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl go-images
-docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl -f docker-bake.override.hcl web-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl go-images
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl web-images
 ```
 
-В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо). **CI:** `write-bake-override.sh` + `--allow=fs.read=$GITHUB_WORKSPACE` в `.gitea/workflows/ci.yaml`.
+Проверка манифеста без сборки:
 
-Один образ (legacy):
+```bash
+docker buildx bake --allow=fs.read=../.. -f docker-bake.hcl --print default
+```
+
+В `docker-bake.hcl`: `context = "../.."` (корень репо), `dockerfile = "deploy/docker/…"` (путь от корня репо).
+
+Один образ (legacy, target `build-all`):
 
 ```bash
 docker build -f deploy/docker/gobinary/Dockerfile \
   --target build-all \
-  --build-arg BIN=evobgp-api \
-  -t evobgp-api:local .
+  -t evobgp-build-all:local .
 ```
 
-Runtime-образы в bake ожидают stage `build-all` (через bake contexts), не отдельный `--build-arg BIN` на старый target `build`.
+Runtime-образы в bake ожидают stage `build-all` (через bake contexts).

deploy/docker/bird2/Dockerfile

@@ -1,10 +1,17 @@
+# syntax=docker/dockerfile:1.7
 # BIRD из репозитория Ubuntu (Noble 24.04 LTS) — актуальнее пакета Debian bookworm.
-# Сборка из корня репозитория: docker build -f deploy/docker/bird2/Dockerfile .
-# Зеркало ECR Public вместо прямого pull с Docker Hub.
-FROM public.ecr.aws/docker/library/ubuntu:noble
-RUN apt-get update \
-	&& apt-get install -y --no-install-recommends bird2 \
-	&& rm -rf /var/lib/apt/lists/*
+# Stage bird2-base общий с evobgp-agent (одинаковые слои на speaker-VPS).
+ARG BASE_UBUNTU=public.ecr.aws/docker/library/ubuntu:noble
+
+FROM ${BASE_UBUNTU} AS bird2-base
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends bird2 ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+FROM bird2-base AS bird2
 COPY deploy/bird/bird.conf /etc/bird/bird.conf
 RUN mkdir -p /etc/bird/bird.d
 EXPOSE 179

deploy/docker/docker-bake.hcl

@@ -1,7 +1,6 @@
 # Единая сборка образов EvoBGP (buildx bake: -f deploy/docker/docker-bake.hcl).
 # context = "../.." — корень репозитория (относительно этого файла).
-# dockerfile — путь от корня репозитория (относительно context).
-# Переменные: REGISTRY, IMAGE_TAG, CACHE_REF_GO, CACHE_REF_WEB
+# Переменные Bake читаются из окружения (см. docs.docker.com/build/bake/variables/).
 
 variable "REGISTRY" {
   default = "git.shx.one/evobgp"
@@ -35,14 +34,40 @@ variable "CACHE_REF_WEB" {
   default = ""
 }
 
+variable "CACHE_REF_BIRDC" {
+  default = ""
+}
+
+variable "BASE_GOLANG" {
+  default = "public.ecr.aws/docker/library/golang:1.24-alpine"
+}
+
+variable "BASE_DEBIAN" {
+  default = "public.ecr.aws/docker/library/debian:bookworm-slim"
+}
+
+variable "BASE_DISTROLESS" {
+  default = "gcr.io/distroless/static-debian12:nonroot"
+}
+
+variable "BASE_NODE" {
+  default = "public.ecr.aws/docker/library/node:22-alpine"
+}
+
+variable "BASE_NGINX" {
+  default = "public.ecr.aws/docker/library/nginx:1.27-alpine"
+}
+
+variable "BASE_UBUNTU" {
+  default = "public.ecr.aws/docker/library/ubuntu:noble"
+}
+
 function "go-cache-from" {
   params = []
   result = notequal("", CACHE_REF_GO) ? ["type=registry,ref=${CACHE_REF_GO}"] : []
 }
 
-# Экспорт кэша — только go-build-all / web-build (один writer на ref).
-# Несколько target с cache-to в один ref и mode=max дают гонку в registry
-# (content descriptor not found при параллельном bake).
+# Экспорт кэша — один writer на ref (параллельный cache-to в один ref ломает manifest).
 function "go-cache-to-export" {
   params = []
   result = notequal("", CACHE_REF_GO) ? ["type=registry,ref=${CACHE_REF_GO},mode=max"] : []
@@ -58,6 +83,16 @@ function "web-cache-to-export" {
   result = notequal("", CACHE_REF_WEB) ? ["type=registry,ref=${CACHE_REF_WEB},mode=max"] : []
 }
 
+function "birdc-cache-from" {
+  params = []
+  result = notequal("", CACHE_REF_BIRDC) ? ["type=registry,ref=${CACHE_REF_BIRDC}"] : []
+}
+
+function "birdc-cache-to-export" {
+  params = []
+  result = notequal("", CACHE_REF_BIRDC) ? ["type=registry,ref=${CACHE_REF_BIRDC},mode=max"] : []
+}
+
 group "default" {
   targets = ["go-images", "web-images", "evobgp-bird2"]
 }
@@ -75,26 +110,38 @@ group "go-images" {
   ]
 }
 
-# web-deps / web-build — только зависимости (contexts), без tags; при --push в группе не указывать.
 group "web-images" {
   targets = ["evobgp-web", "evobgp-web-all"]
 }
 
+target "_common" {
+  platforms = ["linux/amd64"]
+  pull      = false
+}
+
+target "_go-bases" {
+  args = {
+    BASE_GOLANG     = BASE_GOLANG
+    BASE_DEBIAN     = BASE_DEBIAN
+    BASE_DISTROLESS = BASE_DISTROLESS
+  }
+}
+
 # --- Go: go mod download → все cmd/* → birdc (один раз) → runtime-образы ---
 
 target "go-deps" {
+  inherits   = ["_common", "_go-bases"]
   context    = "../.."
   dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "deps"
-  platforms  = ["linux/amd64"]
   cache-from = go-cache-from()
 }
 
 target "go-build-all" {
+  inherits   = ["_common", "_go-bases"]
   context    = "../.."
   dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "build-all"
-  platforms  = ["linux/amd64"]
   args = {
     VERSION    = VERSION
     GIT_SHA    = notequal("", SHA_FULL) ? SHA_FULL : SHORT_SHA
@@ -108,18 +155,19 @@ target "go-build-all" {
 }
 
 target "go-birdc" {
+  inherits   = ["_common", "_go-bases"]
   context    = "../.."
   dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "birdc"
-  platforms  = ["linux/amd64"]
-  cache-from = go-cache-from()
+  cache-from = birdc-cache-from()
+  cache-to   = birdc-cache-to-export()
 }
 
 target "_go-runtime" {
+  inherits   = ["_common", "_go-bases"]
   context    = "../.."
   dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "runtime"
-  platforms  = ["linux/amd64"]
   contexts = {
     build-all = "target:go-build-all"
   }
@@ -127,15 +175,15 @@ target "_go-runtime" {
 }
 
 target "_go-runtime-birdc" {
+  inherits   = ["_common", "_go-bases"]
   context    = "../.."
   dockerfile = "deploy/docker/gobinary/Dockerfile"
   target     = "runtime-birdc"
-  platforms  = ["linux/amd64"]
   contexts = {
     build-all = "target:go-build-all"
     birdc     = "target:go-birdc"
   }
-  cache-from = go-cache-from()
+  cache-from = concat(go-cache-from(), birdc-cache-from())
 }
 
 function "image-tags" {
@@ -198,32 +246,51 @@ target "evobgp-node" {
   tags     = image-tags("evobgp-node")
 }
 
+target "evobgp-bird2-base" {
+  inherits   = ["_common"]
+  context    = "../.."
+  dockerfile = "deploy/docker/bird2/Dockerfile"
+  target     = "bird2-base"
+  args = {
+    BASE_UBUNTU = BASE_UBUNTU
+  }
+}
+
 target "evobgp-agent" {
+  inherits   = ["_common"]
   context    = "../.."
   dockerfile = "deploy/docker/evobgp-agent/Dockerfile"
-  platforms  = ["linux/amd64"]
   contexts = {
-    build-all = "target:go-build-all"
+    build-all  = "target:go-build-all"
+    bird2-base = "target:evobgp-bird2-base"
   }
   cache-from = go-cache-from()
   tags       = image-tags("evobgp-agent")
 }
 
-# --- Web: npm ci (кэш) → build → nginx ---
+# --- Web ---
 
 target "web-deps" {
+  inherits   = ["_common"]
   context    = "../.."
   dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   target     = "deps"
-  platforms  = ["linux/amd64"]
+  args = {
+    BASE_NODE  = BASE_NODE
+    BASE_NGINX = BASE_NGINX
+  }
   cache-from = web-cache-from()
 }
 
 target "web-build" {
+  inherits   = ["_common"]
   context    = "../.."
   dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   target     = "build"
-  platforms  = ["linux/amd64"]
+  args = {
+    BASE_NODE  = BASE_NODE
+    BASE_NGINX = BASE_NGINX
+  }
   contexts = {
     deps = "target:web-deps"
   }
@@ -232,34 +299,49 @@ target "web-build" {
 }
 
 target "evobgp-web" {
+  inherits   = ["_common"]
   context    = "../.."
   dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   target     = "web"
-  platforms  = ["linux/amd64"]
   contexts = {
     web-artifacts = "target:web-build"
   }
-  args       = { EVOBGP_UPSTREAM = "evobgp-api" }
+  args = {
+    EVOBGP_UPSTREAM = "evobgp-api"
+    BASE_NODE       = BASE_NODE
+    BASE_NGINX      = BASE_NGINX
+  }
   cache-from = web-cache-from()
   tags       = image-tags("evobgp-web")
 }
 
 target "evobgp-web-all" {
+  inherits   = ["_common"]
   context    = "../.."
   dockerfile = "deploy/docker/evobgp-web/Dockerfile"
   target     = "web"
-  platforms  = ["linux/amd64"]
   contexts = {
     web-artifacts = "target:web-build"
   }
-  args       = { EVOBGP_UPSTREAM = "evobgp-all" }
+  args = {
+    EVOBGP_UPSTREAM = "evobgp-all"
+    BASE_NODE       = BASE_NODE
+    BASE_NGINX      = BASE_NGINX
+  }
   cache-from = web-cache-from()
   tags       = image-tags("evobgp-web-all")
 }
 
 target "evobgp-bird2" {
+  inherits   = ["_common"]
   context    = "../.."
   dockerfile = "deploy/docker/bird2/Dockerfile"
-  platforms  = ["linux/amd64"]
-  tags       = image-tags("evobgp-bird2")
+  target     = "bird2"
+  args = {
+    BASE_UBUNTU = BASE_UBUNTU
+  }
+  contexts = {
+    bird2-base = "target:evobgp-bird2-base"
+  }
+  tags = image-tags("evobgp-bird2")
 }

deploy/docker/evobgp-agent/Dockerfile

@@ -1,9 +1,6 @@
 # syntax=docker/dockerfile:1.7
-# Агент: бинарь из общего build-all (docker-bake.hcl → contexts.build-all), bird2 из apt.
-FROM public.ecr.aws/docker/library/ubuntu:noble
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends bird2 ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
+# Агент: бинарь из bake context build-all, runtime = тот же bird2-base, что evobgp-bird2.
+FROM bird2-base
 ARG BIN=evobgp-agent
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp-agent
 WORKDIR /etc/bird

deploy/docker/evobgp-web/Dockerfile

@@ -1,9 +1,10 @@
 # syntax=docker/dockerfile:1.7
 # React + Vite статическая панель EvoBGP + nginx.
 # Финальный stage `web` ожидает bake-контекст web-artifacts (= target:web-build).
-# Сборка ведётся из корня репозитория (context = "../.." в docker-bake.hcl).
+ARG BASE_NODE=public.ecr.aws/docker/library/node:22-alpine
+ARG BASE_NGINX=public.ecr.aws/docker/library/nginx:1.27-alpine
 
-FROM public.ecr.aws/docker/library/node:22-alpine AS deps
+FROM ${BASE_NODE} AS deps
 WORKDIR /repo
 RUN corepack enable && corepack prepare [email protected] --activate
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
@@ -16,11 +17,13 @@ FROM deps AS build
 COPY tsconfig.base.json ./
 COPY apps/web/ ./apps/web/
 COPY packages/ui/ ./packages/ui/
-RUN pnpm --filter @evobgp/web run build
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
+    pnpm --filter @evobgp/web run build
 
-FROM public.ecr.aws/docker/library/nginx:1.27-alpine AS web
+FROM ${BASE_NGINX} AS web
 ARG EVOBGP_UPSTREAM=evobgp-api
 COPY deploy/docker/evobgp-web/nginx.conf /tmp/nginx-default.conf
 RUN sed -e "s/evobgp-api/${EVOBGP_UPSTREAM}/g" /tmp/nginx-default.conf > /etc/nginx/conf.d/default.conf \
-    && rm -f /tmp/nginx-default.conf
+    && rm -f /tmp/nginx-default.conf \
+    && sed -i 's/^[[:space:]]*worker_processes[[:space:]]*auto;/worker_processes 1;/' /etc/nginx/nginx.conf
 COPY --from=web-artifacts /repo/apps/web/dist /usr/share/nginx/html

deploy/docker/evobgp-web/nginx.conf

@@ -4,6 +4,7 @@ server {
     root /usr/share/nginx/html;
     gzip on;
     gzip_types text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 256;
 
     # Docker embedded DNS: без resolver nginx кэширует IP upstream при старте —
     # после recreate evobgp-all остаётся 502 (connection refused на старый IP).

deploy/docker/gobinary/Dockerfile

@@ -1,19 +1,23 @@
 # syntax=docker/dockerfile:1.7
 # Универсальная сборка бинарей cmd/* (ARG BIN) или всех сразу (target build-all).
-# INSTALL_BIRDC=1 — birdc из stage birdc (собирается один раз, переиспользуется api/all).
+# Воркеры (runtime): distroless static. api/all (runtime-birdc): debian-slim + birdc.
 # CI: docker buildx bake -f deploy/docker/docker-bake.hcl
-FROM public.ecr.aws/docker/library/golang:1.24-bookworm AS deps
+ARG BASE_GOLANG=public.ecr.aws/docker/library/golang:1.24-alpine
+ARG BASE_DEBIAN=public.ecr.aws/docker/library/debian:bookworm-slim
+ARG BASE_DISTROLESS=gcr.io/distroless/static-debian12:nonroot
+
+FROM ${BASE_GOLANG} AS deps
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     go mod download
 
 FROM deps AS build-all
-COPY . .
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
-RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
     set -eux; \
     mkdir -p /out; \
@@ -29,12 +33,12 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
 
 # Один бинарь (локальная сборка); в CI — build-all + runtime.
 FROM deps AS build
-COPY . .
 ARG BIN=evobgp-api
 ARG VERSION=dev
 ARG GIT_SHA=unknown
 ARG BUILD_TIME=
-RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.cache/go-build,sharing=locked \
     CGO_ENABLED=0 go build -trimpath \
       -ldflags="-s -w \
@@ -43,29 +47,33 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
         -X evobgp/internal/version.BuildTime=${BUILD_TIME}" \
       -o /out/evobgp "./cmd/${BIN}"
 
-FROM public.ecr.aws/docker/library/debian:bookworm-slim AS birdc
+FROM ${BASE_DEBIAN} AS birdc
 ARG BIRD_VERSION=2.14
 COPY deploy/docker/bird/bird-from-source.sh /tmp/bird-from-source.sh
-RUN chmod +x /tmp/bird-from-source.sh \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && chmod +x /tmp/bird-from-source.sh \
     && BIRD_VERSION="${BIRD_VERSION}" /tmp/bird-from-source.sh \
     && rm -f /tmp/bird-from-source.sh
 
-FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-FROM runtime-base AS runtime
+# scheduler / ingest / render / deploy / node — static Go, без shell.
+FROM ${BASE_DISTROLESS} AS runtime
 ARG BIN=evobgp-api
 COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
-COPY scripts/firewall /opt/evobgp/scripts/firewall
-ENV EVOBGP_FIREWALL_SCRIPTS=/opt/evobgp/scripts/firewall
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/evobgp"]
 
-FROM runtime AS runtime-birdc
-# birdc: динамическая линковка readline + ncurses (debian bookworm).
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends libreadline8 libncurses6 \
+# api / all — birdc (readline + ncurses). Только клиент birdc, без демона bird.
+FROM ${BASE_DEBIAN} AS runtime-birdc
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates libreadline8 libncurses6 \
     && rm -rf /var/lib/apt/lists/*
-COPY --from=birdc /usr/local/sbin/bird /usr/local/sbin/birdc /usr/local/sbin/
+ARG BIN=evobgp-api
+COPY --from=build-all /out/${BIN} /usr/local/bin/evobgp
+COPY --from=birdc /usr/local/sbin/birdc /usr/local/sbin/birdc
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/evobgp"]

deploy/docker/mirror-base-images.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+# Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
+# Требует: docker login в REGISTRY host, docker buildx.
+# REGISTRY=git.shx.one/<owner>  (без суффикса /evobgp-buildcache)
+set -eu
+REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
+CACHE_REPO="${REGISTRY}/evobgp-buildcache"
+
+mirror() {
+  src="$1"
+  tag="$2"
+  echo "mirror ${src} -> ${CACHE_REPO}:${tag}"
+  docker buildx imagetools create --tag "${CACHE_REPO}:${tag}" "${src}"
+}
+
+mirror "public.ecr.aws/docker/library/golang:1.24-alpine" "base-golang-1.24-alpine"
+mirror "public.ecr.aws/docker/library/debian:bookworm-slim" "base-debian-bookworm-slim"
+mirror "public.ecr.aws/docker/library/node:22-alpine" "base-node-22-alpine"
+mirror "public.ecr.aws/docker/library/nginx:1.27-alpine" "base-nginx-1.27-alpine"
+mirror "public.ecr.aws/docker/library/ubuntu:noble" "base-ubuntu-noble"
+mirror "gcr.io/distroless/static-debian12:nonroot" "base-distroless-static-debian12-nonroot"
+
+echo "BASE_GOLANG=${CACHE_REPO}:base-golang-1.24-alpine"
+echo "BASE_DEBIAN=${CACHE_REPO}:base-debian-bookworm-slim"
+echo "BASE_NODE=${CACHE_REPO}:base-node-22-alpine"
+echo "BASE_NGINX=${CACHE_REPO}:base-nginx-1.27-alpine"
+echo "BASE_UBUNTU=${CACHE_REPO}:base-ubuntu-noble"
+echo "BASE_DISTROLESS=${CACHE_REPO}:base-distroless-static-debian12-nonroot"

deploy/docker/write-bake-override.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env sh
-# Writes docker-bake.override.hcl for CI (buildx without --var support).
+# Optional helper for local bake when env-based Bake variables are inconvenient.
+# CI задаёт те же имена переменных в окружении и вызывает bake без этого файла.
 set -eu
 OUT="${1:-docker-bake.override.hcl}"
 REGISTRY="${REGISTRY:?REGISTRY required}"
@@ -10,30 +11,29 @@ VERSION="${VERSION:-dev}"
 BUILD_TIME="${BUILD_TIME:-}"
 CACHE_REF_GO="${CACHE_REF_GO:-}"
 CACHE_REF_WEB="${CACHE_REF_WEB:-}"
+CACHE_REF_BIRDC="${CACHE_REF_BIRDC:-}"
+BASE_GOLANG="${BASE_GOLANG:-}"
+BASE_DEBIAN="${BASE_DEBIAN:-}"
+BASE_DISTROLESS="${BASE_DISTROLESS:-}"
+BASE_NODE="${BASE_NODE:-}"
+BASE_NGINX="${BASE_NGINX:-}"
+BASE_UBUNTU="${BASE_UBUNTU:-}"
 cat >"$OUT" <<EOF
 # Generated by deploy/docker/write-bake-override.sh — do not commit.
-variable "REGISTRY" {
-  default = "${REGISTRY}"
-}
-variable "IMAGE_TAG" {
-  default = "${IMAGE_TAG}"
-}
-variable "SHORT_SHA" {
-  default = "${SHORT_SHA}"
-}
-variable "SHA_FULL" {
-  default = "${SHA_FULL}"
-}
-variable "VERSION" {
-  default = "${VERSION}"
-}
-variable "BUILD_TIME" {
-  default = "${BUILD_TIME}"
-}
-variable "CACHE_REF_GO" {
-  default = "${CACHE_REF_GO}"
-}
-variable "CACHE_REF_WEB" {
-  default = "${CACHE_REF_WEB}"
-}
+variable "REGISTRY" { default = "${REGISTRY}" }
+variable "IMAGE_TAG" { default = "${IMAGE_TAG}" }
+variable "SHORT_SHA" { default = "${SHORT_SHA}" }
+variable "SHA_FULL" { default = "${SHA_FULL}" }
+variable "VERSION" { default = "${VERSION}" }
+variable "BUILD_TIME" { default = "${BUILD_TIME}" }
+variable "CACHE_REF_GO" { default = "${CACHE_REF_GO}" }
+variable "CACHE_REF_WEB" { default = "${CACHE_REF_WEB}" }
+variable "CACHE_REF_BIRDC" { default = "${CACHE_REF_BIRDC}" }
 EOF
+# BASE_* — только если заданы (иначе bake берёт default из docker-bake.hcl).
+if [ -n "$BASE_GOLANG" ]; then printf 'variable "BASE_GOLANG" { default = "%s" }\n' "$BASE_GOLANG" >>"$OUT"; fi
+if [ -n "$BASE_DEBIAN" ]; then printf 'variable "BASE_DEBIAN" { default = "%s" }\n' "$BASE_DEBIAN" >>"$OUT"; fi
+if [ -n "$BASE_DISTROLESS" ]; then printf 'variable "BASE_DISTROLESS" { default = "%s" }\n' "$BASE_DISTROLESS" >>"$OUT"; fi
+if [ -n "$BASE_NODE" ]; then printf 'variable "BASE_NODE" { default = "%s" }\n' "$BASE_NODE" >>"$OUT"; fi
+if [ -n "$BASE_NGINX" ]; then printf 'variable "BASE_NGINX" { default = "%s" }\n' "$BASE_NGINX" >>"$OUT"; fi
+if [ -n "$BASE_UBUNTU" ]; then printf 'variable "BASE_UBUNTU" { default = "%s" }\n' "$BASE_UBUNTU" >>"$OUT"; fi