jochen
e1f5d4fdf0
The controller imports mesh-host/validate through a replace onto the forge that holds it, and every build — the build agent's go build in a fresh toolchain container, the Dockerfile's go mod download — would have fetched it through the public proxy and checksum database at build time: a merge breaking main on the network, the class Phase 1 removes. vendor/ is committed; go builds from it with nothing fetched, and refuses to build when it and go.mod disagree, so a pin moved without go mod vendor fails at once. The Dockerfile copies vendor/ and builds with GOPROXY=off.
44 lines
2.3 KiB
Docker
44 lines
2.3 KiB
Docker
# The Go it builds with, pinned here because genesis builds this file with no arguments (novox/hq
|
|
# issue 223) — the Makefile passes the same digest. A tag older than go.mod asks for is how
|
|
# `make image` broke once before (issue 146).
|
|
ARG GO_BASE=golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
|
|
# The control plane's image — for genesis and the lab only. The mesh runs the controller as a Go
|
|
# bundle the host starts as a process (module.json; novox/hq issue 213), and builds no image of it.
|
|
# Genesis builds this file and raises it as the container the process replaces on the first push
|
|
# (mesh-host internal/bootstrap, novox/hq issue 223).
|
|
#
|
|
# novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
|
|
# machine where no mesh exists yet, and run before there is anything to check it against. So it
|
|
# holds the program and nothing else — no shell, no package manager, no libc, nothing with a CVE
|
|
# feed of its own. What a person has to audit before trusting a first node is one binary.
|
|
#
|
|
# There are no CA certificates in here on purpose. Nothing it does today makes an outbound TLS
|
|
# connection to a public name: it reaches PostgreSQL on the machine it was raised on, and the
|
|
# broker is verified against a fingerprint pinned in a token rather than against a public root
|
|
# (novox/hq ADR 0004). Adding them "just in case" would put a trust store in the one image whose
|
|
# whole argument is that it contains nothing to reason about.
|
|
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
|
|
# **Nothing is fetched** (novox/hq to-be 45 Phase 1): every dependency is in vendor/, committed, so
|
|
# the image builds from this repository alone — the host's validator among them, whose module no
|
|
# public proxy is asked for. Dependencies first, so a change to the source does not re-copy them.
|
|
COPY go.mod go.sum ./
|
|
COPY vendor/ vendor/
|
|
|
|
COPY . .
|
|
ARG VERSION=development
|
|
RUN CGO_ENABLED=0 GOFLAGS=-mod=vendor GOPROXY=off go build -trimpath \
|
|
-ldflags "-s -w -X main.version=${VERSION}" \
|
|
-o /mesh-controller ./cmd/mesh-controller
|
|
|
|
FROM scratch
|
|
COPY --from=build /mesh-controller /mesh-controller
|
|
|
|
# Numeric because there is no /etc/passwd to look a name up in. Nothing here needs to be root:
|
|
# it opens outbound connections and writes nothing to its own filesystem.
|
|
USER 65534:65534
|
|
|
|
ENTRYPOINT ["/mesh-controller"]
|