Audiobuzz
688ff1aa88
Route the gcr.io distroless runtime image through the Harbor mirror (harbor.bitasylum.org/gcr.io/distroless/static-debian12:nonroot) per the standing rule, completing the fleet-manager Dockerfile's base-image mirroring.
44 lines
2.0 KiB
Docker
44 lines
2.0 KiB
Docker
# fleet-manager — server-side fleet control plane + embedded admin SPA.
|
|
#
|
|
# Two stages: build the Svelte SPA (node) → dist/, then compile the Go binary
|
|
# with the SPA embedded (`-tags embedspa`). The gRPC .pb.go stubs are committed,
|
|
# so no protoc is needed here. Ships as a small static distroless image; the same
|
|
# binary also serves the `register-admin` subcommand.
|
|
#
|
|
# docker build -t fleet-manager serving/fleet-manager
|
|
|
|
# ---- 1. build the SPA ------------------------------------------------------
|
|
FROM harbor.bitasylum.org/dockerhub/library/node:24-alpine AS ui
|
|
WORKDIR /ui
|
|
COPY ui/package.json ui/package-lock.json ./
|
|
RUN npm ci --no-audit --no-fund
|
|
COPY ui/ ./
|
|
RUN npm run build # -> /ui/dist
|
|
|
|
# ---- 2. build the Go binary (SPA embedded) --------------------------------
|
|
FROM harbor.bitasylum.org/dockerhub/library/golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
COPY --from=ui /ui/dist ./ui/dist
|
|
ENV CGO_ENABLED=0 GOTOOLCHAIN=local
|
|
RUN go build -tags embedspa -trimpath -buildvcs=false \
|
|
-ldflags '-s -w -buildid=' -o /fleet-manager .
|
|
# Seed dir whose ownership a FRESH named volume inherits via Docker's copy-up, so
|
|
# the nonroot runtime (uid 65532) can write inventory/admins/enroll.key under
|
|
# /data without a manual chown. (An ALREADY-created root-owned volume must still
|
|
# be chowned or recreated once — see DEPLOY.md.)
|
|
RUN mkdir -p /data-seed && touch /data-seed/.keep
|
|
|
|
# ---- 3. minimal runtime ----------------------------------------------------
|
|
# distroless/static: static binary + ca-certificates + tzdata, non-root by
|
|
# default (uid 65532). The data dir (inventory + admin store + enrol key) is a
|
|
# mounted, writable volume — pre-created here owned by nonroot so a fresh volume
|
|
# inherits that ownership.
|
|
FROM harbor.bitasylum.org/gcr.io/distroless/static-debian12:nonroot
|
|
COPY --from=build /fleet-manager /usr/local/bin/fleet-manager
|
|
COPY --from=build --chown=65532:65532 /data-seed /data
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["/usr/local/bin/fleet-manager"]
|