2022-03-31 18:48:52 +00:00
|
|
|
# syntax=docker/dockerfile:1
|
2021-01-15 17:23:36 +00:00
|
|
|
|
2022-01-14 18:49:22 +00:00
|
|
|
# Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
|
2020-08-09 17:04:05 +00:00
|
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
|
2022-04-13 20:35:06 +00:00
|
|
|
FROM golang:1.18.1 as build-env
|
2020-07-17 03:52:53 +00:00
|
|
|
|
2020-07-06 23:54:04 +00:00
|
|
|
WORKDIR /work
|
2021-01-15 17:23:36 +00:00
|
|
|
COPY . .
|
|
|
|
ARG GOPROXY
|
2020-08-12 20:57:27 +00:00
|
|
|
|
2020-08-06 00:43:24 +00:00
|
|
|
# Build the executable binary (CGO_ENABLED=0 means static linking)
|
2021-01-15 17:23:36 +00:00
|
|
|
# Pass in GOCACHE (build cache) and GOMODCACHE (module cache) so they
|
|
|
|
# can be re-used between image builds.
|
|
|
|
RUN \
|
|
|
|
--mount=type=cache,target=/cache/gocache \
|
|
|
|
--mount=type=cache,target=/cache/gomodcache \
|
|
|
|
mkdir out && \
|
2021-07-26 16:18:43 +00:00
|
|
|
export GOCACHE=/cache/gocache GOMODCACHE=/cache/gomodcache CGO_ENABLED=0 GOOS=linux GOARCH=amd64 && \
|
2021-11-03 14:26:13 +00:00
|
|
|
go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-concierge-kube-cert-agent ./cmd/pinniped-concierge-kube-cert-agent/... && \
|
|
|
|
go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-server ./cmd/pinniped-server/... && \
|
2021-07-26 16:18:43 +00:00
|
|
|
ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-concierge && \
|
|
|
|
ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-supervisor && \
|
|
|
|
ln -s /usr/local/bin/pinniped-server /usr/local/bin/local-user-authenticator
|
|
|
|
|
|
|
|
# Use a distroless runtime image with CA certificates, timezone data, and not much else.
|
2022-04-14 14:51:17 +00:00
|
|
|
FROM gcr.io/distroless/static:nonroot@sha256:2556293984c5738fc75208cce52cf0a4762c709cf38e4bf8def65a61992da0ad
|
2021-07-26 16:18:43 +00:00
|
|
|
|
|
|
|
# Copy the server binary from the build-env stage.
|
|
|
|
COPY --from=build-env /usr/local/bin /usr/local/bin
|
2020-08-12 20:57:27 +00:00
|
|
|
|
2021-11-17 00:43:51 +00:00
|
|
|
# Document the default server ports for the various server apps
|
2022-03-24 22:46:10 +00:00
|
|
|
EXPOSE 8443 8444 10250
|
2020-11-02 16:57:05 +00:00
|
|
|
|
|
|
|
# Run as non-root for security posture
|
2021-10-25 20:21:54 +00:00
|
|
|
# Use the same non-root user as https://github.com/GoogleContainerTools/distroless/blob/fc3c4eaceb0518900f886aae90407c43be0a42d9/base/base.bzl#L9
|
|
|
|
# This is a workaround for https://github.com/GoogleContainerTools/distroless/issues/718
|
|
|
|
USER 65532:65532
|
2020-08-12 20:57:27 +00:00
|
|
|
|
|
|
|
# Set the entrypoint
|
2021-07-26 16:18:43 +00:00
|
|
|
ENTRYPOINT ["/usr/local/bin/pinniped-server"]
|