30 lines
1.1 KiB
Docker
30 lines
1.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Standalone Rust/Axum OCSP responder. It has no database or KCA master-key
|
|
# access; configuration and signer material are mounted at runtime.
|
|
|
|
FROM rust:1-slim-bookworm AS builder
|
|
WORKDIR /app
|
|
COPY ocsp-responder/Cargo.toml ocsp-responder/Cargo.lock ./
|
|
COPY ocsp-responder/src ./src
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/app/target \
|
|
cargo build --release --locked \
|
|
&& cp /app/target/release/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN addgroup --system ocsp \
|
|
&& adduser --system --ingroup ocsp --no-create-home ocsp \
|
|
&& mkdir -p /etc/ssl/certs
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
|
|
COPY --from=builder /usr/local/bin/kca-ocsp-responder /usr/local/bin/kca-ocsp-responder
|
|
|
|
ENV OCSP_CONFIG=/etc/ocsp/responder.yaml
|
|
USER ocsp
|
|
EXPOSE 2560
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
|
|
CMD ["/usr/local/bin/kca-ocsp-responder", "--healthcheck"]
|
|
|
|
CMD ["/usr/local/bin/kca-ocsp-responder"]
|