mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
35 lines
1.4 KiB
Docker
35 lines
1.4 KiB
Docker
|
# ── Build stage ──────────────────────────────────────────────
|
||
|
|
# Hard-code --platform to prevent exec format error on ARM Macs.
|
||
|
|
FROM --platform=linux/amd64 rust:1.88-bookworm AS builder
|
||
|
|
WORKDIR /build
|
||
|
|
COPY . .
|
||
|
|
RUN cargo build --release -p sprout-relay \
|
||
|
|
&& strip target/release/sprout-relay
|
||
|
|
|
||
|
|
# ── Runtime stage ────────────────────────────────────────────
|
||
|
|
FROM --platform=linux/amd64 debian:bookworm-slim
|
||
|
|
|
||
|
|
# CAKE: non-root UID 1000 (numeric, not username)
|
||
|
|
RUN groupadd -g 1000 sprout && useradd -u 1000 -g sprout -m sprout
|
||
|
|
|
||
|
|
# CAKE: writable dirs
|
||
|
|
RUN mkdir -p /cache /tmp && chown sprout:sprout /cache /tmp
|
||
|
|
|
||
|
|
# socat for Istio abstract→file socket bridge
|
||
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
|
|
ca-certificates socat && rm -rf /var/lib/apt/lists/*
|
||
|
|
|
||
|
|
COPY --from=builder /build/target/release/sprout-relay /code/sprout-relay
|
||
|
|
COPY script/start /code/start
|
||
|
|
RUN chmod +x /code/start
|
||
|
|
|
||
|
|
# CAKE: required Envoy env vars (overridden at runtime by CAKE).
|
||
|
|
ENV ENVOY_ADMIN_SOCKET_PATH="@envoy-admin.sock" \
|
||
|
|
ENVOY_INGRESS_PORT="20001" \
|
||
|
|
ENVOY_HTTP_EGRESS_SOCKET_PATH="@egress.sock" \
|
||
|
|
ENVOY_DATADOG_PORT="3030" \
|
||
|
|
CASH_FRAMEWORK="rust"
|
||
|
|
|
||
|
|
USER 1000
|
||
|
|
ENTRYPOINT ["/code/start"]
|