68 lines
1.9 KiB
Docker
68 lines
1.9 KiB
Docker
# Build stage
|
|
FROM golang:1.23-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Install build dependencies (gcc/g++/musl-dev required for CGO + SQLite)
|
|
RUN apk add --no-cache git ca-certificates tzdata gcc g++ musl-dev
|
|
|
|
# Copy go mod files
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download && go mod verify
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Build arguments for versioning
|
|
ARG VERSION=dev
|
|
ARG BUILD_TIME
|
|
ARG GIT_COMMIT
|
|
|
|
# Build the server with ldflags for version info
|
|
# CGO_ENABLED=1 required for SQLite; static linking keeps the binary self-contained
|
|
RUN CGO_ENABLED=1 GOOS=linux go build \
|
|
-a -installsuffix cgo \
|
|
-tags "sqlite_omit_load_extension" \
|
|
-ldflags "-w -s -linkmode external -extldflags \"-static\" \
|
|
-X main.version=${VERSION} \
|
|
-X main.buildTime=${BUILD_TIME} \
|
|
-X main.gitCommit=${GIT_COMMIT}" \
|
|
-o server ./cmd/server
|
|
|
|
# Final stage - distroless with ca-certificates for TLS
|
|
FROM gcr.io/distroless/static:nonroot
|
|
|
|
# Copy CA certificates from builder for TLS connections
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
|
|
|
|
# Non-root user (distroless nonroot user)
|
|
USER 65532:65532
|
|
|
|
# Copy binary
|
|
COPY --from=builder --chown=65532:65532 /app/server /server
|
|
|
|
# Copy Web UI files
|
|
COPY --from=builder --chown=65532:65532 /app/web /app/web
|
|
|
|
# Copy prevention rules for syncing
|
|
COPY --from=builder --chown=65532:65532 /app/.guardrails/prevention-rules /app/docs
|
|
|
|
# Expose ports
|
|
# 8080 - MCP server
|
|
# 8081 - Web UI
|
|
# 8082 - Health/metrics (optional separation)
|
|
EXPOSE 8080 8081
|
|
|
|
# No HEALTHCHECK in Dockerfile - use container orchestrator health checks
|
|
# This avoids the issue of running the binary incorrectly
|
|
# For Docker Compose/Kubernetes, use:
|
|
# healthcheck:
|
|
# test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8081/health/live"]
|
|
# interval: 30s
|
|
# timeout: 5s
|
|
# retries: 3
|
|
# start_period: 10s
|
|
|
|
ENTRYPOINT ["/server"]
|