34 lines
1.2 KiB
Docker
34 lines
1.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# --- Build stage -----------------------------------------------------------
|
|
FROM golang:1.25-alpine AS build
|
|
WORKDIR /src
|
|
|
|
# Cache modules independently of source.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
# CGO disabled → a fully static binary (boltdb is pure Go), so it runs on scratch.
|
|
# The command lives in ./cmd/nostermd; internal/* holds the relay packages.
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/nostermd ./cmd/nostermd
|
|
# Stage an empty data dir we can copy in with the correct nonroot ownership.
|
|
RUN mkdir -p /out/data
|
|
|
|
# --- Runtime stage ---------------------------------------------------------
|
|
FROM gcr.io/distroless/static-debian12:nonroot AS runtime
|
|
|
|
# Binary + a data dir pre-owned by the distroless nonroot uid (65532), so the
|
|
# unprivileged process can write the boltdb file to the mounted volume.
|
|
COPY --from=build --chown=65532:65532 /out/nostermd /nostermd
|
|
COPY --from=build --chown=65532:65532 /out/data /data
|
|
|
|
# Persisted event storage (mount a volume here in production).
|
|
VOLUME ["/data"]
|
|
ENV RELAY_DATA_DIR=/data \
|
|
RELAY_ADDR=:3334
|
|
|
|
USER 65532:65532
|
|
EXPOSE 3334
|
|
ENTRYPOINT ["/nostermd"]
|