jochen
c23be73d4d
The controller is a Go program and was the one piece of the mesh's own Go code still shipped and run as an image (novox/hq issue 213; ADR 0188 §1: a module's own code is bundles; §3: a service bundle is a process). The manifest now builds one Go bundle, `controller`, and runs it as the process `mesh-controller` (`./mesh-controller serve`) under an account the module declares. What the container gave it, replaced: - host network: a process is on the host's network; nothing it reads names a container network - user 65534: the account `mesh-controller`, which owns its secrets and its state directory - the eight mounts: the env names the host paths the mesh already places (the store, broker and bus files under the state directory, the broker's certificate under /var/lib/mesh-broker-tls); the `broker` mount was read by nothing and is gone with the others - `container-runtime` is no longer required on its machine Its preparation is the same binary with `prepare`, as a run-once process, and the process `replaces` the container `server`: the host keeps the container answering until the process is running (mesh-host). Needs the previous commit live in the running controller, and the host's `replaces` on the controller's machine, before it is registered. No image is built by the mesh any more. The Dockerfile stays for genesis and the lab (`make image`, its Go base now pinned in the Makefile).
37 lines
1.6 KiB
Docker
37 lines
1.6 KiB
Docker
ARG GO_BASE=golang:1.25-alpine
|
|
# The control plane's image — for genesis and the lab only. The mesh runs the controller as a Go
|
|
# bundle the host starts as a process (module.json; novox/hq issue 213), and builds no image of it.
|
|
#
|
|
# novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
|
|
# machine where no mesh exists yet, and run before there is anything to check it against. So it
|
|
# holds the program and nothing else — no shell, no package manager, no libc, nothing with a CVE
|
|
# feed of its own. What a person has to audit before trusting a first node is one binary.
|
|
#
|
|
# There are no CA certificates in here on purpose. Nothing it does today makes an outbound TLS
|
|
# connection to a public name: it reaches PostgreSQL on the machine it was raised on, and the
|
|
# broker is verified against a fingerprint pinned in a token rather than against a public root
|
|
# (novox/hq ADR 0004). Adding them "just in case" would put a trust store in the one image whose
|
|
# whole argument is that it contains nothing to reason about.
|
|
|
|
FROM ${GO_BASE} AS build
|
|
WORKDIR /src
|
|
|
|
# Dependencies first, so a change to the source does not refetch them.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
ARG VERSION=development
|
|
RUN CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags "-s -w -X main.version=${VERSION}" \
|
|
-o /mesh-controller ./cmd/mesh-controller
|
|
|
|
FROM scratch
|
|
COPY --from=build /mesh-controller /mesh-controller
|
|
|
|
# Numeric because there is no /etc/passwd to look a name up in. Nothing here needs to be root:
|
|
# it opens outbound connections and writes nothing to its own filesystem.
|
|
USER 65534:65534
|
|
|
|
ENTRYPOINT ["/mesh-controller"]
|