-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathDockerfile
More file actions
51 lines (45 loc) · 1.83 KB
/
Copy pathDockerfile
File metadata and controls
51 lines (45 loc) · 1.83 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# Stage 1: build React frontend
FROM node:20-alpine AS frontend
WORKDIR /app/web
COPY web/package*.json ./
RUN npm ci
COPY web/ ./
# Output goes directly into internal/web/dist (Vite configured for this)
COPY internal/web/ ../internal/web/
RUN npm run build
# Stage 2: build Go binaries
FROM golang:1.25-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=frontend /app/internal/web/dist ./internal/web/dist
ARG VERSION=v1.1.0
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.version=${VERSION}" -o /aptify ./cmd/server
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.version=${VERSION}" -o /aptify-cli ./cmd/aptify-cli
# Stage 3: minimal runtime image (server only)
FROM alpine:3.20
# Install runtime dependencies:
# ca-certificates — TLS root CAs
# tzdata — timezone data
# wget — used by HEALTHCHECK
# su-exec — lightweight setuid helper for privilege drop in entrypoint
RUN apk --no-cache add ca-certificates tzdata wget su-exec && \
# Create a dedicated non-root service account.
addgroup -S aptify && \
adduser -S aptify -G aptify -h /app -s /sbin/nologin
WORKDIR /app
COPY --from=builder /aptify .
# CLI binary is available in the builder stage and can be extracted:
# docker create --name tmp <image> && docker cp tmp:/aptify-cli . && docker rm tmp
COPY --from=builder /aptify-cli /usr/local/bin/aptify-cli
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh && chown -R aptify:aptify /app
VOLUME ["/data"]
ENV DATA_DIR=/data
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD wget -qO- http://localhost:8080/health || exit 1
# entrypoint.sh runs as root to fix /data ownership, then drops to the
# aptify user via su-exec before executing the aptify binary.
ENTRYPOINT ["/entrypoint.sh"]