Audiobuzz
24d67d07db
Route the pre-existing non-CI image pulls through harbor.bitasylum.org per the
standing rule (harbor.bitasylum.org/<registry>/<namespace>/<image>):
- enrol-broker/Dockerfile: golang:1.23-alpine -> dockerhub/library/...,
smallstep/step-cli:latest -> dockerhub/smallstep/...
- dot1x-bench/docker-compose.yml: smallstep/step-ca + freeradius/freeradius-server
-> dockerhub/<namespace>/...
CI-built git.bitasylum.org/audiobuzz/* images and ${OCI_IMAGE}/${IPXE_IMAGE}
type:image volume mounts are unchanged.
23 lines
1.1 KiB
Docker
23 lines
1.1 KiB
Docker
# fleet-enrol-broker — TPM identity enrolment broker (docs/tpm-enrolment-design.md).
|
|
#
|
|
# Two stages: a reproducible static Go build, then the smallstep `step` CLI image
|
|
# as the runtime base (the production signer shells out to `step ca token` +
|
|
# `step ca sign`). The broker is stdlib-only, so the build needs no module
|
|
# download (GOPROXY=off) and the verity-style reproducibility flags apply.
|
|
#
|
|
# Pin + mirror these base tags through your registry (like the rest of the stack)
|
|
# if the build/serving host has no egress.
|
|
FROM harbor.bitasylum.org/dockerhub/library/golang:1.23-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod .
|
|
COPY *.go wordlist.txt ./
|
|
ENV CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local
|
|
RUN go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o /enrol-broker .
|
|
|
|
FROM harbor.bitasylum.org/dockerhub/smallstep/step-cli:latest
|
|
COPY --from=build /enrol-broker /usr/local/bin/enrol-broker
|
|
# Non-root by default (the step-cli image runs as uid 1000 "step"); the broker
|
|
# binds loopback ports >1024 and only READS the mounted CA root + provisioner
|
|
# password, so no extra privilege is needed.
|
|
ENTRYPOINT ["/usr/local/bin/enrol-broker"]
|