Story Crater Bot
b0ce2fb67c
- Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit SHA stamped via VERSION build arg. - .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the runner declares only the "docker" label. Verify job on every push; image build and push gated to main. - Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran. - deployment.yaml: image from the Forgejo registry, forgejo-registry pull secret, runAsUser 65532 to match distroless nonroot. - kustomization.yaml: pin the tag in one place. Promoting a build is a one-line newTag bump, never :latest.
47 lines
1.5 KiB
Docker
47 lines
1.5 KiB
Docker
# Multi-stage build for the API gateway.
|
|
#
|
|
# The runtime stage is distroless/static: no shell, no package manager, no libc.
|
|
# That is deliberate — see tasks/6.1-hardened-image.md. It also means the binary
|
|
# must be fully static, hence CGO_ENABLED=0.
|
|
|
|
FROM golang:1.25-bookworm AS build
|
|
|
|
WORKDIR /src
|
|
|
|
# Copy the module files first so dependency download is cached independently of
|
|
# source changes. The gateway is stdlib + yaml.v3 only, so this is fast either way.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# VERSION is stamped in by CI as the commit SHA so a running pod can be traced
|
|
# back to an exact commit.
|
|
ARG VERSION=dev
|
|
|
|
# -trimpath strips local filesystem paths from the binary.
|
|
# -w -s drop DWARF and the symbol table; nothing debugs off the production image.
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-ldflags="-w -s -X main.version=${VERSION}" \
|
|
-o /out/gateway ./cmd/gateway
|
|
|
|
# Run the test suite inside the build so a broken commit cannot produce an image.
|
|
# Separate stage: it is skipped unless targeted, keeping the default build fast.
|
|
# CGO_ENABLED=1 here on purpose: the race detector requires cgo, so this cannot
|
|
# reuse the static build's flags.
|
|
FROM build AS test
|
|
RUN go vet ./... && CGO_ENABLED=1 go test ./... -race
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
# 65532 is distroless's "nonroot" user. It matches runAsUser in the Deployment's
|
|
# securityContext; if one changes, both must.
|
|
USER 65532:65532
|
|
|
|
COPY --from=build /out/gateway /gateway
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["/gateway"]
|