45 lines
1.4 KiB
Docker
45 lines
1.4 KiB
Docker
# Build stage
|
|
#
|
|
# Context is the repository root.
|
|
#
|
|
# The command stays named vantagectl even though the repository is vantage-ctl:
|
|
# it is what an operator types, and it is in every runbook. Only the paths moved.
|
|
#
|
|
# vantage-shared is a private module, so both steps below need a credential. It
|
|
# arrives as a BuildKit secret rather than a build arg, which would be baked
|
|
# into this stage's layer history.
|
|
FROM golang:1.26 AS builder
|
|
|
|
WORKDIR /src
|
|
|
|
ENV GOPRIVATE=gitea.hostxtra.co.uk/*
|
|
|
|
# Manifests first so the dependency layer caches independently of source edits.
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
|
|
go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
|
|
CGO_ENABLED=0 GOOS=linux go build \
|
|
-ldflags="-s -w -X main.Version=${VERSION}" -o /vantagectl .
|
|
|
|
# Staged so the scratch image below can have a /tmp. It cannot mkdir one
|
|
# itself - scratch has no shell.
|
|
RUN mkdir -p /staging/tmp && chmod 1777 /staging/tmp
|
|
|
|
# Runtime stage
|
|
FROM scratch
|
|
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
|
|
# restore extracts an archive here before verifying its checksums, and backup
|
|
# stages nothing but still inherits os.MkdirTemp's requirements. Without this
|
|
# every restore stops at "temp dir: stat /tmp: no such file or directory".
|
|
COPY --from=builder /staging/tmp /tmp
|
|
COPY --from=builder /vantagectl /vantagectl
|
|
|
|
ENTRYPOINT ["/vantagectl"]
|