48 lines
1.6 KiB
Docker
48 lines
1.6 KiB
Docker
# Build stage
|
|
#
|
|
# Context is still the repository root, not server/, because the runtime stage
|
|
# copies default_steps/ from it.
|
|
#
|
|
# vantage-shared is a private module, so every step that resolves it needs a
|
|
# credential. It arrives as a BuildKit secret rather than a build arg: an arg
|
|
# is baked into the builder layer's history, and this one is a Gitea token.
|
|
FROM golang:1.26 AS builder
|
|
|
|
WORKDIR /src
|
|
|
|
ENV GOPRIVATE=gitea.hostxtra.co.uk/*
|
|
|
|
# Manifests first so the dependency layer caches independently of source edits.
|
|
COPY server/go.mod server/go.sum ./server/
|
|
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
|
|
cd server && go mod download
|
|
|
|
COPY server/ ./server/
|
|
|
|
ARG VERSION=dev
|
|
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
|
|
cd server && CGO_ENABLED=0 GOOS=linux go build \
|
|
-ldflags="-s -w -X main.Version=${VERSION}" -o /vantage-server ./cmd
|
|
|
|
# Staged so the scratch image below can have a /tmp. It cannot mkdir one
|
|
# itself - scratch has no shell - and os.MkdirTemp fails outright without it.
|
|
RUN mkdir -p /staging/tmp && chmod 1777 /staging/tmp
|
|
|
|
# Runtime stage
|
|
FROM scratch
|
|
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
|
|
# vulndb unpacks the ~50MB trivy-db here. Without it the scheduler stops at
|
|
# "temp dir: stat /tmp: no such file or directory" and no scanning happens,
|
|
# while everything else in the process runs perfectly well.
|
|
COPY --from=builder /staging/tmp /tmp
|
|
COPY --from=builder /vantage-server /vantage-server
|
|
|
|
COPY default_steps/ /opt/default-steps/
|
|
ENV VANTAGE_DEFAULT_STEPS_DIR=/opt/default-steps
|
|
|
|
EXPOSE 8080 9090
|
|
|
|
ENTRYPOINT ["/vantage-server"]
|