jschoubben
d94764f001
mesh/merge-gate head d94764f00168 merged into trunk fadf5025cc5a — pass: builds build-agent, route-proxy → ace, g14, novox, shanks; no bus step; every mach…
mesh/repo-check head d94764f00168 merged into trunk fadf5025cc5a — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery stopped: its group fix/a-module-moves-only-when-its-program-changes stopped: novox/mesh-controller@b34055f580d4 failed
mesh/delivery-group group fix/a-module-moves-only-when-its-program-changes delivering: 1 of 2 delivered; novox/mesh-catalog@d94764f00168, stopped for a member …
Go's build ID hashes every input package, so a change mesh-builder never reaches still changed its bytes; without it, a rebuild of the same program is the same file, and the check can say the module is unchanged.
31 lines
1.7 KiB
Docker
31 lines
1.7 KiB
Docker
ARG ALPINE_BASE=alpine:3.20
|
|
ARG GO_BASE=golang:1.25
|
|
# The route-proxy module's runtime image: the reference reverse proxy compiled into a container.
|
|
#
|
|
# **The proxy source is not vendored here.** The canonical proxy — the contract written as something
|
|
# that runs — lives in the mesh-controller repository at examples/route-proxy (novox/hq 08-connectivity
|
|
# §3). This module ships the *packaging*, not a second copy of the contract, so the build context is
|
|
# the mesh-controller repository, and this Dockerfile compiles ./examples/route-proxy from it. The build seat
|
|
# hands it only that program's build source — its import closure, go.mod, go.sum and the vendored packages
|
|
# it uses (novox/hq ADR 0267, the artifact's `compiles`) — so a merge elsewhere in that repository does not
|
|
# move this image, and a COPY of anything outside it fails by name.
|
|
#
|
|
# docker build -f mesh-catalog/modules/route-proxy/Dockerfile \
|
|
# -t mesh-route-proxy:development <path-to>/mesh-controller
|
|
#
|
|
# The mesh pins the digest of what this produces; the committed module.json carries the placeholder
|
|
# digest every mesh-built image does, replaced at publish.
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false -ldflags=-buildid= -o /mesh-route-proxy ./examples/route-proxy
|
|
|
|
# A small runtime with the public CA roots the ACME client needs to reach a real authority, and run
|
|
# as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.
|
|
FROM ${ALPINE_BASE}
|
|
RUN apk add --no-cache ca-certificates
|
|
COPY --from=build /mesh-route-proxy /usr/local/bin/mesh-route-proxy
|
|
ENTRYPOINT ["/usr/local/bin/mesh-route-proxy"]
|