woggioni
ed90a2a5a6
CI / Build and push docker image (push) Successful in 7m1s
Build the backend as a fully static musl binary (rust:1-alpine + x86_64-unknown-linux-musl) and run it in a scratch image with only the binary and the compiled frontend: 32 MB instead of ~110 MB, no shell, package manager or libc, running as the numeric user 10001:10001. The binary moves to /usr/local/bin/tavolo so `tavolo migrate` and `tavolo serve` resolve on PATH in compose and Kubernetes. TLS for OIDC and Postgres validates against Mozilla's roots embedded in the binary by webpki-roots, so no certificate files are needed; the OTLP client is built without a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http:// (documented). The Docker HEALTHCHECK is removed since scratch has no curl: Kubernetes probes /api/health over HTTP and Compose gates on its dependency checks. `strip = "symbols"` trims the release binary. Validated with docker compose up --build: migrations, sessions, lobby creation, the OIDC discovery redirect and the SPA all work, proving musl DNS resolution for the postgres/redis/mockoauth service names.
95 lines
4.2 KiB
Docker
95 lines
4.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Multi-stage build for the tavolo stack (Rust/Axum backend +
|
|
# Sycamore/WASM frontend). The Docker build context is the REPOSITORY ROOT
|
|
# (see docker-compose.yml) so this single image assembles both parts:
|
|
#
|
|
# web-builder rust + trunk -> compiles web/ into web/dist
|
|
# rust-builder rust (alpine) -> compiles server/ into a static musl binary
|
|
# runtime scratch -> static binary + compiled frontend
|
|
#
|
|
# The runtime is a scratch image: the backend is a fully static musl binary,
|
|
# embeds its sqlx migrations and serves /static, /assets and the SPA shell
|
|
# itself, so no shell, package manager or libc is needed.
|
|
#
|
|
# TLS trust model: the OIDC client (reqwest 0.12) and Postgres (sqlx) validate
|
|
# against Mozilla's roots embedded in the binary by the webpki-roots crate, so
|
|
# no certificate files exist in the image. The OTLP exporter is built without
|
|
# a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http:// (terminate TLS
|
|
# in front of the collector if needed).
|
|
#
|
|
# There is deliberately no HEALTHCHECK (no curl in scratch): Kubernetes
|
|
# probes /api/health over HTTP, and Compose gates on its dependency checks.
|
|
#
|
|
# Build and run it with (from the repository root):
|
|
# docker compose up --build
|
|
|
|
# --- Web builder -------------------------------------------------------------
|
|
FROM rust:1-slim-bookworm AS web-builder
|
|
|
|
ARG TRUNK_VERSION=0.21.14
|
|
# The build environment blocks plain HTTP: force the apt mirrors to HTTPS.
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
{ sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list 2>/dev/null || true; } \
|
|
&& { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; } \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates \
|
|
&& curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
|
|
| tar -xz -C /usr/local/bin \
|
|
&& rustup target add wasm32-unknown-unknown
|
|
|
|
WORKDIR /web
|
|
|
|
# Card images are committed in the repository (CC0 woodcut napoletane deck);
|
|
# web/fetch-cards.sh can regenerate them.
|
|
COPY web/Cargo.toml web/Cargo.lock web/index.html web/style.css web/theme.css web/Trunk.toml ./
|
|
COPY web/assets ./assets
|
|
# Vendored Bootstrap (MIT) loaded by index.html; kept out of the CDN so the
|
|
# image builds and runs without network access.
|
|
COPY web/vendor ./vendor
|
|
COPY web/src ./src
|
|
|
|
# --public-url makes trunk emit asset URLs under /static, the prefix the
|
|
# server mounts in the runtime image. Dev builds (trunk serve) keep the
|
|
# default "/" public URL.
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/web/target \
|
|
trunk build --release --public-url /static/
|
|
|
|
# --- Rust builder (static musl) ----------------------------------------------
|
|
FROM rust:1-alpine AS rust-builder
|
|
|
|
# ring (the only C dependency) compiles with the musl toolchain from build-base.
|
|
RUN apk add --no-cache build-base
|
|
|
|
WORKDIR /build
|
|
|
|
COPY server/Cargo.toml server/Cargo.lock ./
|
|
COPY server/crates ./crates
|
|
|
|
# The target directory lives in a cache mount (so repeated builds reuse it)
|
|
# and the binary is copied out of the mount into the image layer.
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/build/target \
|
|
cargo build --release --locked --target x86_64-unknown-linux-musl \
|
|
&& cp target/x86_64-unknown-linux-musl/release/tavolo /tavolo
|
|
|
|
# --- Runtime (scratch) --------------------------------------------------------
|
|
FROM scratch
|
|
|
|
# Fully static musl binary; no libc, shell or package manager in the image.
|
|
# Installed on PATH so `tavolo migrate` / `tavolo serve` work as commands.
|
|
COPY --from=rust-builder --chmod=755 /tavolo /usr/local/bin/tavolo
|
|
# The compiled single-page application: hashed js/wasm/css under /static and
|
|
# the card images under /assets (mounted by the server from STATIC_DIR).
|
|
COPY --from=web-builder /web/dist /app/web/dist
|
|
|
|
ENV STATIC_DIR=/app/web/dist
|
|
|
|
# Numeric user: scratch has no /etc/passwd and Kubernetes verifies runAsNonRoot.
|
|
USER 10001:10001
|
|
|
|
EXPOSE 8080
|
|
|
|
CMD ["tavolo", "serve"]
|