perf(ci): accelerate native Docker dependencies

Dockerfile

@@ -1,25 +1,36 @@
-ARG NODE_IMAGE=node:22-bookworm-slim
+ARG NODE_IMAGE=docker.m.daocloud.io/library/node:22-bookworm-slim
-ARG PYTHON_IMAGE=python:3.12-slim-bookworm
+ARG PYTHON_IMAGE=docker.m.daocloud.io/library/python:3.12-slim-bookworm
+ARG PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
+ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 FROM ${NODE_IMAGE} AS frontend-build
+ARG NPM_REGISTRY
 WORKDIR /src/frontend
 COPY frontend/package.json frontend/package-lock.json ./
-RUN npm ci
+RUN npm ci --registry="$NPM_REGISTRY"
 COPY frontend/ ./
 RUN npm run build
 
 FROM ${PYTHON_IMAGE} AS wheel-build
+ARG PIP_INDEX_URL
 WORKDIR /src
 COPY pyproject.toml README.md ./
 COPY backend/ ./backend/
-RUN python -m pip install --no-cache-dir 'hatchling>=1.25,<2' \
+RUN python -m pip install --no-cache-dir --index-url "$PIP_INDEX_URL" 'hatchling>=1.25,<2' \
     && python -m hatchling build -t wheel -d /wheels
 
 FROM ${PYTHON_IMAGE}
+ARG PIP_INDEX_URL
+ARG DEBIAN_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/debian
+ARG DEBIAN_SECURITY_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/debian-security
 ARG PGVECTOR_VERSION=0.8.6
 ARG PGVECTOR_PACKAGE_VERSION_URL=0.8.6-1.pgdg12%2B1
 ARG PGVECTOR_SHA256=b27ff894d1e2d23ebd7528fcb986923391977cbd5c5379ed74527875246854ca
-RUN apt-get update \
+RUN sed -i \
+      -e "s|http://deb.debian.org/debian-security|$DEBIAN_SECURITY_MIRROR|g" \
+      -e "s|http://deb.debian.org/debian|$DEBIAN_MIRROR|g" \
+      /etc/apt/sources.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true \
+    && apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates curl ffmpeg postgresql-15 postgresql-client-15 rclone tini \
     && curl --fail --location --retry 4 --retry-all-errors \
       "https://apt.postgresql.org/pub/repos/apt/pool/main/p/pgvector/postgresql-15-pgvector_${PGVECTOR_PACKAGE_VERSION_URL}_amd64.deb" \
@@ -30,7 +41,8 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 COPY requirements/runtime-core.txt /opt/imagefind/runtime-core.txt
 COPY --from=wheel-build /wheels/imagefind-*.whl /opt/imagefind/
-RUN python -m pip install --no-cache-dir -r /opt/imagefind/runtime-core.txt /opt/imagefind/imagefind-*.whl \
+RUN python -m pip install --no-cache-dir --index-url "$PIP_INDEX_URL" \
+      -r /opt/imagefind/runtime-core.txt /opt/imagefind/imagefind-*.whl \
     && useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin imagefind
 COPY --from=frontend-build /src/frontend/dist/ /opt/imagefind/frontend/
 COPY scripts/docker-entrypoint.sh /usr/local/bin/imagefind-entrypoint

Jenkinsfile

@@ -129,7 +129,8 @@ pipeline {
                 withCredentials([usernamePassword(credentialsId: "${NODE_CREDENTIALS}", usernameVariable: 'JENKINS_NODE_USERNAME', passwordVariable: 'JENKINS_NODE_PASSWORD')]) {
                     sh '''
                         set -euo pipefail
-                        DOCKER_BUILDKIT=0 ./scripts/ci-docker.sh build --network host --no-cache \
+                        DOCKER_BUILDKIT=0 ./scripts/ci-docker.sh build --network host \
+                          --build-arg PIP_INDEX_URL="$PIP_INDEX_URL" \
                           --build-arg HTTP_PROXY="$HTTP_PROXY_URL" --build-arg HTTPS_PROXY="$HTTP_PROXY_URL" \
                           --build-arg NO_PROXY="$NO_PROXY_HOSTS" -t "$IMAGE_REF" .
                         smoke_name="imagefind-smoke-$BUILD_NUMBER"

tests/test_fnos_dependency_script.py

@@ -19,3 +19,13 @@ def test_native_amd64_pipeline_does_not_boot_buildx() -> None:
     assert 'test "$(uname -m)" = x86_64' in pipeline
     assert "DOCKER_BUILDKIT=0 ./scripts/ci-docker.sh build" in pipeline
     assert "buildx" not in pipeline
+    assert "--no-cache" not in pipeline
+
+
+def test_docker_build_uses_domestic_dependency_mirrors() -> None:
+    dockerfile = (Path(__file__).parents[1] / "Dockerfile").read_text()
+    assert "docker.m.daocloud.io/library/node" in dockerfile
+    assert "docker.m.daocloud.io/library/python" in dockerfile
+    assert "mirrors.tuna.tsinghua.edu.cn/debian" in dockerfile
+    assert "registry.npmmirror.com" in dockerfile
+    assert '--index-url "$PIP_INDEX_URL"' in dockerfile