Docker image

The maintainer-distributed Docker image lets consumers run custom-trimmed wasm builds without setting up emsdk, libclang, and Python locally.

Pulling

docker pull ghcr.io/taucad/opencascade.js:single-threaded

Tags

Pin by digest in production. The bare-name tags (:single-threaded, :multi-threaded, :bindgen-base) are mutable and roll forward with every release. The toolchain does this for you: each published version embeds the resolved digests in generated/images.json and verifies them after pulling. See Reproducible CI.

The legacy :beta, :rolling, and :latest tags are not published by this project. Use a version-pinned tag (e.g. :3.0.0-single-threaded) or the manifest-list digest for explicit version control.

Entrypoint

The driver invokes the image as <engine> run … <image> link <yml>, with the config directory mounted at /src and a scratch directory mounted at /out via OCJS_OUTPUT_DIR. The invocation below is what it constructs — reproduce it by hand only when debugging the image itself:

docker run --rm \
  -v "$(pwd):/src" \
  -v "$(pwd)/out:/out" \
  -e OCJS_OUTPUT_DIR=/out \
  ghcr.io/taucad/opencascade.js@sha256:<digest> \
  link mybuild.yml

The entrypoint dispatches subcommands through npx nx run ocjs:<target> so runs benefit from Nx's content-addressed cache:

Outputs land in /src next to your YAML (OCJS_OUTPUT_DIR=/src default).

Override the entrypoint

docker run --rm -it -v "$(pwd):/src" --entrypoint bash \
  ghcr.io/taucad/opencascade.js:single-threaded

…drops you into a shell with emsdk, libclang, and Python on the PATH.

Multi-arch matrix

main, release, and manually dispatched canary runs ship full manifest lists so Apple Silicon and ARM Linux hosts pull the native architecture transparently. CI links and smokes each image natively and requires every native stage to pass before promotion. The amd64 outputs are the canonical npm package inputs; host-specific compiler output is not compared byte-for-byte across architectures.

OCI labels

Inspect via docker inspect ghcr.io/taucad/opencascade.js:single-threaded:

Cosign signatures

Every published image is signed with cosign via OIDC keyless signing — no rotating private keys, signatures published to the Sigstore Rekor transparency log. Release tags carry one signature on the manifest-list digest that verifies regardless of which arch the consumer pulls.

cosign verify ghcr.io/taucad/opencascade.js:single-threaded \
  --certificate-identity-regexp 'https://github.com/taucad/opencascade\.js/\.github/workflows/docker\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification confirms the image was built by the taucad/opencascade.js GitHub Actions docker.yml workflow and has not been tampered with since publication.

Provenance

cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp 'https://github\.com/taucad/opencascade\.js/\.github/workflows/docker\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/taucad/opencascade.js:single-threaded

The attestation records the source commit, the workflow, and the runner that produced the image.

SBOM

docker buildx imagetools inspect \
  --format '{{ json .SBOM }}' \
  ghcr.io/taucad/opencascade.js:single-threaded

Diff the SBOM across image digests in CI to flag unexpected dep bumps.

Image stages

The Dockerfile is multi-stage with five logical stages, three of which are published:

Each stage is independently rebuildable via docker buildx build --target <stage>. See Bindgen pipeline for how the stages compose with the build pipeline.