Docker & CI

Oidis projects use Docker containers for CI/CD. Each project has a builder container that runs the full pipeline: install, test, build, and optionally deploy.

Directory Structure

source/docker/Io/Oidis/[LibraryName]/Builder/
├── Dockerfile      # Container definition
├── build.sh        # CI pipeline script
└── builder.yml     # Docker Compose configuration

Hub projects add extra directories:

• Image/ — Runtime container (FROM oidis/oidis-ubuntu-base)
• Services/ — Apache, MongoDB, Nginx, etc.

Solution projects typically have only Builder/.

Dockerfile

FROM oidis/oidis-builder-toolchain:latest

# Copy project files
COPY . /workspace

# CRLF normalization (Windows compatibility)
RUN sed -i 's/\r//g' /workspace/source/docker/Io/Oidis/*/Builder/build.sh

# Entry point
CMD ["./build.sh"]

The oidis/oidis-builder-toolchain image contains Node.js, npm, the Oidis CLI, and all build dependencies.

build.sh — CI Pipeline

The build script runs the complete pipeline with --solution=shared:

#!/bin/bash
set -e

# 1. Validate encryption key (if deploy is enabled)
if [ "$DEPLOY_DISABLED" != "1" ] && [ -z "$ENCRYPTION_KEY" ]; then
    echo "ERROR: ENCRYPTION_KEY required for deployment"
    exit 1
fi

# 2. Git credentials setup
echo "$GIT_CRED" > ~/.git-cred
git config --global credential.helper store

# 3. Install dependencies
oidis install --solution=shared

# 4. Run tests with coverage
oidis test coverage --solution=shared

# 5. Build (EAP profile)
oidis rebuild-eap --solution=shared

# 6. Optional: Integrity check
./build/target/cmd/OidisProject.sh --integrity-check

# 7. Conditional deploy
if [ "$DEPLOY_DISABLED" != "1" ]; then
    # AES-256-CBC encryption
    openssl enc -aes-256-cbc -salt -pbkdf2 \
        -in build/output/package.tar.gz \
        -out build/output/package.tar.gz.enc \
        -pass pass:"$ENCRYPTION_KEY"

    oidis target-deploy:prod --solution=shared
fi

Pipeline Steps

1. Validate — Ensure required secrets are present
2. Git credentials — Set up authentication for dependency cloning
3. Install — Resolve JSONP configs, clone dependencies, npm install
4. Test — Unit tests, linting, copyright checks, coverage report
5. Build — Compile TypeScript, bundle frontend, process SCSS
6. Integrity check — Verify the built artifact is runnable
7. Deploy — Encrypt and upload the build artifact

builder.yml — Docker Compose

version: '3'
services:
  builder:
    build:
      context: ../../../..
      dockerfile: source/docker/Io/Oidis/ProjectName/Builder/Dockerfile
    volumes:
      - .git:/workspace/.git
      - bin/project:/workspace/bin/project
      - resource:/workspace/resource
      - source:/workspace/source
      - test:/workspace/test
      - package.conf.jsonp:/workspace/package.conf.jsonp
      - LICENSE.txt:/workspace/LICENSE.txt
      - README.md:/workspace/README.md
      - build/reports:/workspace/build/reports
    environment:
      - GIT_CRED
      - ENCRYPTION_KEY
      - PROFILE
      - DEPLOY_DISABLED
      - OIDIS_CI_RUN
      - OIDIS_NO_TEST_FAIL

Environment Variables

Variable	Purpose	Required
GIT_CRED	Git credentials for dependency cloning	Yes
ENCRYPTION_KEY	AES key for package encryption	For deploy
PROFILE	Build profile (prod / eap / dev)	No
DEPLOY_DISABLED	Skip deployment (1 = skip)	No
OIDIS_CI_RUN	CI context flag	No
OIDIS_NO_TEST_FAIL	Continue on test failure	No

Build Reports

Test results and coverage reports are written to build/reports/, which is mounted as a volume. CI systems can collect these for dashboard display.

Security: Package Encryption

Before deployment, the build artifact is encrypted with AES-256-CBC:

openssl enc -aes-256-cbc -salt -pbkdf2 \
    -in package.tar.gz \
    -out package.tar.gz.enc \
    -pass pass:"$ENCRYPTION_KEY"

The encrypted package is then uploaded via oidis target-deploy:prod. The target server decrypts it during deployment.

---

See also: Build Solutions | JSONP System | Testing