mirror of
https://github.com/cfal/shoes.git
synced 2026-11-06 16:14:11 +00:00
cfal
1140fd94aa
Build the locked workspace with Rust 1.95 and ship only the binary, CA certificates, and complete license notices in a Debian runtime. Keep local credentials and unrelated files outside the build context. Add a Linux container smoke test covering configuration, real proxy traffic, notice integrity, restricted runtime permissions, and graceful shutdown.
30 lines
773 B
Docker
30 lines
773 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
FROM rust:1.95-bookworm AS build
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends cmake && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
ENV CARGO_BUILD_JOBS=1
|
|
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY tests/support/ tests/support/
|
|
COPY src/ src/
|
|
|
|
RUN cargo build --locked --release --bin shoes
|
|
|
|
FROM debian:bookworm-slim AS runtime
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=build /build/target/release/shoes /usr/local/bin/shoes
|
|
COPY LICENSE THIRD_PARTY_NOTICES.md /usr/share/doc/shoes/
|
|
COPY licenses/ /usr/share/doc/shoes/licenses/
|
|
|
|
WORKDIR /etc/shoes
|
|
USER 65532:65532
|
|
ENTRYPOINT ["/usr/local/bin/shoes"]
|
|
CMD ["/etc/shoes/config.yaml"]
|