110 lines
3.1 KiB
Docker
110 lines
3.1 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# Override these in CI with immutable digests when you are ready to pin them fully.
|
|
ARG GO_IMAGE=golang:1.26.2-alpine3.22
|
|
ARG RUNTIME_IMAGE=gcr.io/distroless/static-debian12:nonroot
|
|
|
|
FROM ${GO_IMAGE} AS build-base
|
|
|
|
WORKDIR /src
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOOS=linux \
|
|
GOFLAGS=-buildvcs=false
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
|
|
--mount=type=cache,target=/root/.cache/go-build,sharing=locked \
|
|
go mod download && go mod verify
|
|
|
|
FROM build-base AS healthcheck-build
|
|
|
|
COPY cmd/healthcheck/ ./cmd/healthcheck/
|
|
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
|
|
--mount=type=cache,target=/root/.cache/go-build,sharing=locked \
|
|
go build \
|
|
-trimpath \
|
|
-ldflags="-s -w" \
|
|
-o /out/healthcheck \
|
|
./cmd/healthcheck
|
|
|
|
FROM build-base AS worker-build
|
|
|
|
COPY cmd/worker/ ./cmd/worker/
|
|
COPY internal/ ./internal/
|
|
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
|
|
--mount=type=cache,target=/root/.cache/go-build,sharing=locked \
|
|
go build \
|
|
-trimpath \
|
|
-ldflags="-s -w" \
|
|
-o /out/wucher-worker \
|
|
./cmd/worker
|
|
RUN mkdir -p /out/.local/emails && touch /out/.local/emails/.keep
|
|
|
|
FROM build-base AS file-worker-build
|
|
|
|
COPY cmd/worker/ ./cmd/worker/
|
|
COPY internal/ ./internal/
|
|
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
|
|
--mount=type=cache,target=/root/.cache/go-build,sharing=locked \
|
|
go build \
|
|
-trimpath \
|
|
-ldflags="-s -w" \
|
|
-o /out/wucher-file-worker \
|
|
./cmd/worker
|
|
|
|
FROM build-base AS api-build
|
|
|
|
ARG VERSION=unknown
|
|
ARG COMMIT=unknown
|
|
ARG BUILD_TIME=unknown
|
|
|
|
COPY cmd/api/ ./cmd/api/
|
|
COPY internal/ ./internal/
|
|
COPY docs/docs.go ./docs/docs.go
|
|
RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
|
|
--mount=type=cache,target=/root/.cache/go-build,sharing=locked \
|
|
go build \
|
|
-trimpath \
|
|
-ldflags="-s -w -X 'wucher/internal/buildinfo.Version=${VERSION}' -X 'wucher/internal/buildinfo.Commit=${COMMIT}' -X 'wucher/internal/buildinfo.BuildTime=${BUILD_TIME}'" \
|
|
-o /out/wucher-api \
|
|
./cmd/api
|
|
|
|
FROM ${RUNTIME_IMAGE} AS runtime-base
|
|
|
|
WORKDIR /app
|
|
|
|
FROM runtime-base AS worker
|
|
|
|
COPY --from=healthcheck-build --chown=nonroot:nonroot /out/healthcheck /app/healthcheck
|
|
COPY --from=worker-build --chown=nonroot:nonroot /out/wucher-worker /app/wucher-worker
|
|
COPY --from=worker-build --chown=nonroot:nonroot /out/.local/emails/ /app/.local/emails/
|
|
|
|
ENV WORKER_JOB=email
|
|
|
|
USER nonroot:nonroot
|
|
|
|
ENTRYPOINT ["/app/wucher-worker"]
|
|
|
|
FROM runtime-base AS file-worker
|
|
|
|
COPY --from=healthcheck-build --chown=nonroot:nonroot /out/healthcheck /app/healthcheck
|
|
COPY --from=file-worker-build --chown=nonroot:nonroot /out/wucher-file-worker /app/wucher-file-worker
|
|
|
|
ENV WORKER_JOB=file_processing
|
|
|
|
USER nonroot:nonroot
|
|
|
|
ENTRYPOINT ["/app/wucher-file-worker"]
|
|
|
|
FROM runtime-base AS api
|
|
|
|
COPY --from=healthcheck-build --chown=nonroot:nonroot /out/healthcheck /app/healthcheck
|
|
COPY --from=api-build --chown=nonroot:nonroot /out/wucher-api /app/wucher-api
|
|
|
|
USER nonroot:nonroot
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["/app/wucher-api"]
|