42 lines
1.5 KiB
Docker
42 lines
1.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Standalone Rust/Axum OCSP responder.
|
|
#
|
|
# The final image is scratch: the binary is a statically linked musl
|
|
# executable and the only file besides it is the CA bundle needed for
|
|
# outbound HTTPS to S3. Configuration, CA certificates and delegated signer
|
|
# material are mounted at runtime.
|
|
|
|
FROM rust:1-alpine AS builder
|
|
|
|
RUN apk add --no-cache build-base musl-dev perl ca-certificates file binutils \
|
|
&& rustup target add x86_64-unknown-linux-musl
|
|
|
|
WORKDIR /app
|
|
COPY ocsp-responder/Cargo.toml ocsp-responder/Cargo.lock ./
|
|
COPY ocsp-responder/src ./src
|
|
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/app/target \
|
|
RUSTFLAGS="-C target-feature=+crt-static" \
|
|
cargo build --release --locked --target x86_64-unknown-linux-musl \
|
|
&& strip target/x86_64-unknown-linux-musl/release/kca-ocsp-responder \
|
|
&& file target/x86_64-unknown-linux-musl/release/kca-ocsp-responder \
|
|
| grep -Eq "statically linked|static-pie linked" \
|
|
&& cp target/x86_64-unknown-linux-musl/release/kca-ocsp-responder /kca-ocsp-responder
|
|
|
|
FROM scratch
|
|
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=builder /kca-ocsp-responder /kca-ocsp-responder
|
|
|
|
ENV OCSP_CONFIG=/etc/ocsp/responder.yaml \
|
|
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
|
|
|
|
USER 65532:65532
|
|
EXPOSE 2560
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
|
|
CMD ["/kca-ocsp-responder", "--healthcheck"]
|
|
|
|
ENTRYPOINT ["/kca-ocsp-responder"]
|