Build static musl OCSP image in Gitea Actions

ocsp-responder/Dockerfile

@@ -1,29 +1,41 @@
 # syntax=docker/dockerfile:1
-# Standalone Rust/Axum OCSP responder. It has no database or KCA master-key
-# access; configuration and signer material are mounted at runtime.
+# Standalone Rust/Axum OCSP responder.
+#
+# The final image is scratch: the binary is a statically linked musl
+# executable and the only file besides it is the CA bundle needed for
+# outbound HTTPS to S3. Configuration, CA certificates and delegated signer
+# material are mounted at runtime.
+
+FROM rust:1-alpine AS builder
+
+RUN apk add --no-cache build-base musl-dev perl ca-certificates file binutils \
+ && rustup target add x86_64-unknown-linux-musl
 
-FROM rust:1-slim-bookworm AS builder
 WORKDIR /app
 COPY ocsp-responder/Cargo.toml ocsp-responder/Cargo.lock ./
 COPY ocsp-responder/src ./src
+
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/app/target \
-    cargo build --release --locked \
- && cp /app/target/release/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder
+    RUSTFLAGS="-C target-feature=+crt-static" \
+    cargo build --release --locked --target x86_64-unknown-linux-musl \
+ && strip target/x86_64-unknown-linux-musl/release/kca-ocsp-responder \
+ && file target/x86_64-unknown-linux-musl/release/kca-ocsp-responder \
+    | grep -Eq "statically linked|static-pie linked" \
+ && cp target/x86_64-unknown-linux-musl/release/kca-ocsp-responder /kca-ocsp-responder
+
+FROM scratch
 
-FROM debian:bookworm-slim
-RUN addgroup --system ocsp \
- && adduser --system --ingroup ocsp --no-create-home ocsp \
- && mkdir -p /etc/ssl/certs
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /kca-ocsp-responder /kca-ocsp-responder
 
-COPY --from=builder /usr/local/bin/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder
+ENV OCSP_CONFIG=/etc/ocsp/responder.yaml \
+    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
 
-ENV OCSP_CONFIG=/etc/ocsp/responder.yaml
-USER ocsp
+USER 65532:65532
 EXPOSE 2560
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
-  CMD ["/usr/local/bin/kca-ocsp-responder", "--healthcheck"]
+  CMD ["/kca-ocsp-responder", "--healthcheck"]
 
-CMD ["/usr/local/bin/kca-ocsp-responder"]
+ENTRYPOINT ["/kca-ocsp-responder"]