jochen
ef3e5ae9b0
mesh/merge-gate head ef3e5ae9b0dc merged into trunk 1d244d5aa24e — pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus…
mesh/repo-check head ef3e5ae9b0dc merged into trunk 1d244d5aa24e — pass: its merge-check.sh passed
mesh/delivery delivered
The genesis image copies the whole clone with .git, so its controller carried the commit it was built at, as the bundles did.
46 lines
2.5 KiB
Docker
46 lines
2.5 KiB
Docker
# The Go it builds with, pinned here because genesis builds this file with no arguments (novox/hq
|
|
# issue 223) — the Makefile passes the same digest. A tag older than go.mod asks for is how
|
|
# `make image` broke once before (issue 146).
|
|
ARG GO_BASE=golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c
|
|
# The control plane's image — for genesis and the lab only. The mesh runs the controller as a Go
|
|
# bundle the host starts as a process (module.json; novox/hq issue 213), and builds no image of it.
|
|
# Genesis builds this file and raises it as the container the process replaces on the first push
|
|
# (mesh-host internal/bootstrap, novox/hq issue 223).
|
|
#
|
|
# novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
|
|
# machine where no mesh exists yet, and run before there is anything to check it against. So it
|
|
# holds the program and nothing else — no shell, no package manager, no libc, nothing with a CVE
|
|
# feed of its own. What a person has to audit before trusting a first node is one binary.
|
|
#
|
|
# There are no CA certificates in here on purpose. Nothing it does today makes an outbound TLS
|
|
# connection to a public name: it reaches PostgreSQL on the machine it was raised on, and the
|
|
# broker is verified against a fingerprint pinned in a token rather than against a public root
|
|
# (novox/hq ADR 0004). Adding them "just in case" would put a trust store in the one image whose
|
|
# whole argument is that it contains nothing to reason about.
|
|
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
|
|
# **Nothing is fetched** (novox/hq to-be 45 Phase 1): every dependency is in vendor/, committed, so
|
|
# the image builds from this repository alone — the host's validator among them, whose module no
|
|
# public proxy is asked for. Dependencies first, so a change to the source does not re-copy them.
|
|
COPY go.mod go.sum ./
|
|
COPY vendor/ vendor/
|
|
|
|
# `COPY . .` brings `.git` along, so Go is told not to stamp the commit: the version is said by -X, and a
|
|
# rebuild of an unchanged program is the same bytes (novox/hq ADR 0267 rule 6, issue 363).
|
|
COPY . .
|
|
ARG VERSION=development
|
|
RUN CGO_ENABLED=0 GOFLAGS=-mod=vendor GOPROXY=off go build -trimpath -buildvcs=false \
|
|
-ldflags "-s -w -X main.version=${VERSION}" \
|
|
-o /mesh-controller ./cmd/mesh-controller
|
|
|
|
FROM scratch
|
|
COPY --from=build /mesh-controller /mesh-controller
|
|
|
|
# Numeric because there is no /etc/passwd to look a name up in. Nothing here needs to be root:
|
|
# it opens outbound connections and writes nothing to its own filesystem.
|
|
USER 65534:65534
|
|
|
|
ENTRYPOINT ["/mesh-controller"]
|