53 lines
1.8 KiB
Docker
53 lines
1.8 KiB
Docker
# --- Stage 1: Build the binary ---
|
|
FROM rust:1.85-bookworm AS builder
|
|
|
|
WORKDIR /usr/src/nx9-auth
|
|
|
|
# 1. Pre-build dependencies for caching
|
|
COPY Cargo.toml Cargo.lock ./
|
|
# Create dummy main.rs, lib.rs, and src/bin/bench.rs to compile dependencies first
|
|
RUN mkdir -p src/bin src/security src/identity src/db src/api src/audit src/config src/middleware src/error && \
|
|
echo "fn main() {}" > src/main.rs && \
|
|
echo "fn main() {}" > src/bin/bench.rs && \
|
|
echo "" > src/lib.rs && \
|
|
cargo build --release && \
|
|
rm -rf src/
|
|
|
|
# 2. Copy the actual source files and build
|
|
COPY . .
|
|
# Touch main.rs, lib.rs and src/bin/bench.rs to force cargo to rebuild them with the actual contents
|
|
RUN touch src/main.rs src/lib.rs src/bin/bench.rs && \
|
|
cargo build --release
|
|
|
|
# --- Stage 2: Run the binary ---
|
|
FROM debian:bookworm-slim AS runtime
|
|
|
|
# Install CA certificates, curl (for healthcheck), and SQLite CLI
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends ca-certificates curl sqlite3 && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create a non-root group and user
|
|
RUN groupadd -g 10001 nx9-auth && \
|
|
useradd -u 10001 -g nx9-auth -m -s /usr/sbin/nologin nx9-auth
|
|
|
|
# Create standard system directories (system mode)
|
|
RUN mkdir -p /etc/nx9-auth /var/lib/nx9-auth /var/log/nx9-auth /var/backups/nx9-auth && \
|
|
chown -R nx9-auth:nx9-auth /etc/nx9-auth /var/lib/nx9-auth /var/log/nx9-auth /var/backups/nx9-auth
|
|
|
|
# Copy the compiled release binary from builder
|
|
COPY --from=builder /usr/src/nx9-auth/target/release/nx9-auth /usr/local/bin/nx9-auth
|
|
|
|
# Switch to the non-root user
|
|
USER nx9-auth
|
|
|
|
# Set standard environment variables
|
|
ENV NX9_AUTH_CONFIG=/etc/nx9-auth/config.toml
|
|
|
|
# Expose server port
|
|
EXPOSE 8655
|
|
|
|
# Set entrypoint
|
|
ENTRYPOINT ["/usr/local/bin/nx9-auth"]
|
|
CMD ["serve"]
|