30 lines
1.6 KiB
Docker
30 lines
1.6 KiB
Docker
ARG ALPINE_BASE=alpine:3.20
|
|
ARG GO_BASE=golang:1.25
|
|
# The route-proxy module's runtime image: the reference reverse proxy compiled into a container.
|
|
#
|
|
# **The proxy source sits beside this module.** The canonical proxy, the contract written as something
|
|
# that runs, lives in this same repository, mesh-controller, at examples/route-proxy (novox/hq 08-connectivity
|
|
# §3), and the repository is the build context (a module lives whole in one repository, novox/hq ADR 0420),
|
|
# so this Dockerfile compiles ./examples/route-proxy from the repository root. The build seat hands it only
|
|
# that program's build source, its import closure, go.mod, go.sum and the vendored packages it uses
|
|
# (novox/hq ADR 0267, the artifact's `compiles`), so a merge elsewhere in the repository does not
|
|
# move this image, and a COPY of anything outside it fails by name.
|
|
#
|
|
# docker build -f modules/route-proxy/Dockerfile -t mesh-route-proxy:development .
|
|
#
|
|
# The mesh pins the digest of what this produces; the committed module.json carries the placeholder
|
|
# digest every mesh-built image does, replaced at publish.
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false -ldflags=-buildid= -o /mesh-route-proxy ./examples/route-proxy
|
|
|
|
# A small runtime with the public CA roots the ACME client needs to reach a real authority, and run
|
|
# as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.
|
|
FROM ${ALPINE_BASE}
|
|
RUN apk add --no-cache ca-certificates
|
|
COPY --from=build /mesh-route-proxy /usr/local/bin/mesh-route-proxy
|
|
ENTRYPOINT ["/usr/local/bin/mesh-route-proxy"]
|