35 lines
1.1 KiB
Docker
35 lines
1.1 KiB
Docker
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
|
|
# Resolve dependencies before copying source. Do not run `go mod tidy` here.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY cmd ./cmd
|
|
COPY internal ./internal
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath -ldflags="-s -w" \
|
|
-o /out/neuralhunt-client ./cmd/client
|
|
|
|
FROM alpine:3.24
|
|
RUN apk add --no-cache su-exec \
|
|
&& adduser -D -h /home/app app \
|
|
&& mkdir -p /app /identity \
|
|
&& chown -R app:app /app /identity
|
|
WORKDIR /app
|
|
|
|
COPY --from=build /out/neuralhunt-client /app/neuralhunt-client
|
|
COPY docker/worker-entrypoint.sh /usr/local/bin/neuralhunt-worker-entrypoint
|
|
RUN chmod 0555 /usr/local/bin/neuralhunt-worker-entrypoint
|
|
|
|
# The entrypoint starts as root only long enough to normalize ownership of the
|
|
# named identity volume. It immediately execs the client as the unprivileged
|
|
# `app` user. Customer Service grants only the bootstrap capabilities required
|
|
# for this transition (CHOWN, DAC_OVERRIDE, SETUID, SETGID).
|
|
USER root
|
|
ENV HOME=/home/app
|
|
VOLUME ["/identity"]
|
|
ENTRYPOINT ["/usr/local/bin/neuralhunt-worker-entrypoint"]
|
|
CMD ["-help"]
|