bad95c072e
- Upgrade Go used in CI from 1.19.0 to 1.19.1 - Upgrade all go.mod direct dependencies to latest available versions - Upgrade distroless base image to latest available version - Upgrade Go fips compiler to to latest available version Note that upgrading the go-oidc library changed an error message returned by that library, so update the places where tests were expecting that error message.
42 lines
1.8 KiB
Docker
42 lines
1.8 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
FROM golang:1.19.1 as build-env
|
|
|
|
WORKDIR /work
|
|
COPY . .
|
|
ARG GOPROXY
|
|
|
|
# Build the executable binary (CGO_ENABLED=0 means static linking)
|
|
# Pass in GOCACHE (build cache) and GOMODCACHE (module cache) so they
|
|
# can be re-used between image builds.
|
|
RUN \
|
|
--mount=type=cache,target=/cache/gocache \
|
|
--mount=type=cache,target=/cache/gomodcache \
|
|
mkdir out && \
|
|
export GOCACHE=/cache/gocache GOMODCACHE=/cache/gomodcache CGO_ENABLED=0 GOOS=linux GOARCH=amd64 && \
|
|
go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-concierge-kube-cert-agent ./cmd/pinniped-concierge-kube-cert-agent/... && \
|
|
go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-server ./cmd/pinniped-server/... && \
|
|
ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-concierge && \
|
|
ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-supervisor && \
|
|
ln -s /usr/local/bin/pinniped-server /usr/local/bin/local-user-authenticator
|
|
|
|
# Use a distroless runtime image with CA certificates, timezone data, and not much else.
|
|
FROM gcr.io/distroless/static:nonroot@sha256:2a9e2b4fa771d31fe3346a873be845bfc2159695b9f90ca08e950497006ccc2e
|
|
|
|
# Copy the server binary from the build-env stage.
|
|
COPY --from=build-env /usr/local/bin /usr/local/bin
|
|
|
|
# Document the default server ports for the various server apps
|
|
EXPOSE 8443 8444 10250
|
|
|
|
# Run as non-root for security posture
|
|
# Use the same non-root user as https://github.com/GoogleContainerTools/distroless/blob/fc3c4eaceb0518900f886aae90407c43be0a42d9/base/base.bzl#L9
|
|
# This is a workaround for https://github.com/GoogleContainerTools/distroless/issues/718
|
|
USER 65532:65532
|
|
|
|
# Set the entrypoint
|
|
ENTRYPOINT ["/usr/local/bin/pinniped-server"]
|