951dd8d26b
Some checks failed
ci / go (push) Has been cancelled
ci / admin-ui (push) Has been cancelled
ci / runtime-sdk (push) Has been cancelled
ci / helm (push) Has been cancelled
ci / openapi (push) Has been cancelled
ci / container (push) Has been cancelled
ci / release-config (push) Has been cancelled
ci / shared styling (push) Has been cancelled
ci / security (push) Has been cancelled
ci / all green (push) Has been cancelled
68 lines
No EOL
2.7 KiB
Text
68 lines
No EOL
2.7 KiB
Text
# syntax=docker/dockerfile:1
|
|
#
|
|
# Release image, built by GoReleaser.
|
|
#
|
|
# This exists alongside the main `Dockerfile` rather than replacing it, because the
|
|
# two answer different questions:
|
|
#
|
|
# * `Dockerfile` builds the frontend, the SDK and the binary from source, so that
|
|
# `docker build .` always produces something runnable from a clean checkout.
|
|
# * `Dockerfile.release` consumes a binary GoReleaser has already cross-compiled,
|
|
# so a release never rebuilds the Go code a second time with different flags
|
|
# from the one that was checksummed, signed and published.
|
|
#
|
|
# The runtime layer is identical to the main Dockerfile's, so a release image and a
|
|
# locally built image differ only in provenance, never in behaviour.
|
|
#
|
|
# GoReleaser assembles the build context with the compiled binary at
|
|
# `go-bananas_linux_{arch}/go-bananas`, and `extra_files` supplies the frontend and
|
|
# SDK bundles. Nothing here compiles anything.
|
|
|
|
ARG ALPINE_VERSION=3.22
|
|
|
|
FROM alpine:${ALPINE_VERSION}
|
|
|
|
ARG VERSION=dev
|
|
ARG TARGETARCH=amd64
|
|
|
|
# curl is present only for the container health check; busybox wget would do, but
|
|
# curl's exit codes are the ones the check reasons about. tzdata is needed because
|
|
# timestamps are rendered in the configured locale.
|
|
RUN apk add --no-cache ca-certificates tzdata curl \
|
|
&& addgroup -g 65532 -S bananas \
|
|
&& adduser -u 65532 -S -G bananas -H -s /sbin/nologin bananas
|
|
|
|
# The build context is generated, so these paths are relative to it rather than to
|
|
# the repository root. TARGETARCH is the Go arch name and matches the directory
|
|
# GoReleaser wrote the binary into.
|
|
COPY go-bananas_linux_${TARGETARCH}/go-bananas /usr/local/bin/go-bananas
|
|
COPY web/dist /srv/web
|
|
COPY sdk/dist /srv/sdk
|
|
|
|
RUN chmod 0755 /usr/local/bin/go-bananas \
|
|
&& mkdir -p /srv/data \
|
|
&& chown -R bananas:bananas /srv
|
|
|
|
USER 65532:65532
|
|
WORKDIR /srv
|
|
|
|
ENV BANANAS_HTTP_ADDR=:8080 \
|
|
BANANAS_STATIC_DIR=/srv/web \
|
|
BANANAS_SDK_DIR=/srv/sdk \
|
|
BANANAS_DATABASE_PATH=/srv/data/go-bananas.db \
|
|
BANANAS_LOG_FORMAT=json
|
|
|
|
EXPOSE 8080
|
|
VOLUME ["/srv/data"]
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
|
|
CMD curl --fail --silent --show-error http://127.0.0.1:8080/healthz || exit 1
|
|
|
|
LABEL org.opencontainers.image.title="go-bananas" \
|
|
org.opencontainers.image.description="Runtime design-token service: author themes, serve them to any application at run time." \
|
|
org.opencontainers.image.version="${VERSION}" \
|
|
org.opencontainers.image.source="https://github.com/urpi/go-bananas" \
|
|
org.opencontainers.image.licenses="MIT" \
|
|
org.opencontainers.image.base.name="docker.io/library/alpine:3.22"
|
|
|
|
ENTRYPOINT ["/usr/local/bin/go-bananas"] |