ZDDC
40d9956e54
- release-image.sh now defaults to alpha (was stable). Active dev no longer silently advances :stable; that tag only moves on a deliberate `sh release-image.sh <ver> stable`. Same cascade logic, reordered default. Updated AGENTS.md and zddc/README.md sections accordingly. - zddc/Containerfile: dropped the "see .woodpecker.yml" comment since that file no longer exists; pointed the docs to release-image.sh. - build.sh: dropped the "CI builds the runtime container directly" parenthetical; the cross-compiled host-binaries build is the only thing that step actually produces. Why alpha as the default: caught it during active development — :stable kept advancing every release because the script defaulted there. Solo workflow + alpha default = `:stable` is a deliberate gesture, not a side-effect. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
102 lines
4.6 KiB
Docker
102 lines
4.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Multi-stage build with three useful targets:
|
|
#
|
|
# --target binaries — scratch image holding cross-compiled binaries.
|
|
# Use `podman build --target binaries -o dist/ .`
|
|
# to extract zddc-server-{linux,darwin,windows}-*
|
|
# to the host. No image published from this stage.
|
|
#
|
|
# --target server — alpine-based runtime. Default target. Published
|
|
# as codeberg.org/varasys/zddc-server:vX.Y.Z.
|
|
#
|
|
# Build context expectations (when targeting `server`):
|
|
# dist/web/index.html and dist/web/archive.html must exist —
|
|
# produced by `sh build.sh` from the repo root. The release flow
|
|
# (`release-image.sh` at the repo root) runs build.sh first and
|
|
# then invokes `podman build --target server`.
|
|
#
|
|
|
|
# ─── Stage 1: build ──────────────────────────────────────────────────────────
|
|
FROM docker.io/library/golang:1.24-alpine AS builder
|
|
|
|
WORKDIR /src
|
|
|
|
# git is required by go mod for VCS dependencies
|
|
RUN apk add --no-cache git
|
|
|
|
# Skip sum DB checks (allows building with empty/partial go.sum)
|
|
ENV GONOSUMDB=* GOPRIVATE=* GOPROXY=direct
|
|
|
|
# Copy source
|
|
COPY . .
|
|
|
|
# Build linux/amd64 (used by the runtime image and Linux hosts)
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" \
|
|
-o /out/zddc-server-linux-amd64 ./cmd/zddc-server
|
|
|
|
# Cross-compile for macOS (Intel and Apple Silicon)
|
|
RUN CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -trimpath -ldflags="-s -w" \
|
|
-o /out/zddc-server-darwin-amd64 ./cmd/zddc-server
|
|
|
|
RUN CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags="-s -w" \
|
|
-o /out/zddc-server-darwin-arm64 ./cmd/zddc-server
|
|
|
|
# Cross-compile for Windows
|
|
RUN CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags="-s -w" \
|
|
-o /out/zddc-server-windows-amd64.exe ./cmd/zddc-server
|
|
|
|
# ─── Stage 2: export binaries ─────────────────────────────────────────────────
|
|
# Use `podman build --target binaries -o dist/ .` to extract binaries to the host.
|
|
# No base image needed — this stage only exists to hold the output files.
|
|
FROM scratch AS binaries
|
|
COPY --from=builder /out/ /
|
|
|
|
# ─── Stage 3: runtime (published image) ─────────────────────────────────────
|
|
FROM docker.io/library/alpine:3.20 AS server
|
|
|
|
LABEL org.opencontainers.image.title="zddc-server" \
|
|
org.opencontainers.image.description="HTTP server for ZDDC archives — ACL via .zddc files, virtual archive index, audit logging" \
|
|
org.opencontainers.image.source="https://codeberg.org/VARASYS/ZDDC" \
|
|
org.opencontainers.image.documentation="https://zddc.varasys.io/zddc-server.html" \
|
|
org.opencontainers.image.licenses="AGPL-3.0-only" \
|
|
org.opencontainers.image.vendor="VARASYS"
|
|
|
|
# wget is in the base image (busybox); explicitly install ca-certificates
|
|
# so outbound HTTPS (e.g. an upstream auth check) works if the operator
|
|
# adds anything later. Keep the install footprint minimal.
|
|
RUN apk add --no-cache ca-certificates && rm -rf /var/cache/apk/*
|
|
|
|
# Non-root user. UID/GID are deliberately fixed so volume permissions are
|
|
# predictable across hosts.
|
|
RUN addgroup -S -g 1000 zddc && adduser -S -u 1000 -G zddc zddc
|
|
|
|
# Binary
|
|
COPY --from=builder /out/zddc-server-linux-amd64 /usr/local/bin/zddc-server
|
|
|
|
# Bundled landing + archive tools — useful for self-contained demos and as
|
|
# a fallback web root. Set ZDDC_ROOT=/opt/zddc-server/web to serve only
|
|
# these (no external data). For real archives, mount the data tree at
|
|
# /srv (the default ZDDC_ROOT below).
|
|
COPY dist/web/index.html /opt/zddc-server/web/index.html
|
|
COPY dist/web/archive.html /opt/zddc-server/web/archive.html
|
|
|
|
# Conventional mount point for the served archive. Operators mount their
|
|
# data here (Azure Files, NFS, hostPath, …). Override with ZDDC_ROOT.
|
|
VOLUME /srv
|
|
|
|
USER zddc
|
|
|
|
# Default config: data mount at /srv. Override at run time as needed.
|
|
# Other env vars (ZDDC_TLS_CERT, ZDDC_EMAIL_HEADER, ZDDC_CORS_ORIGIN, …)
|
|
# are intentionally not defaulted — see zddc/README.md.
|
|
ENV ZDDC_ROOT=/srv
|
|
|
|
EXPOSE 8443
|
|
|
|
# Liveness probe for `docker run` users. Kubernetes deployments override
|
|
# this with their own livenessProbe / readinessProbe.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD wget --no-check-certificate -q --spider https://localhost:8443/ || exit 1
|
|
|
|
ENTRYPOINT ["/usr/local/bin/zddc-server"]
|