jcoffey-dev
30df055e39
#27 let the build context see vendor/, but the Dockerfile cooks the dependencies before it copies the tree, from a recipe that carries only the workspace's manifests. [patch.crates-io] points sieve-rs at vendor/, so the cook failed the same way: failed to read /build/vendor/sieve-rs/Cargo.toml. That's why 2026.9.24.2's publish failed. The builder stage now copies vendor/ before cooking; a local build got past it into compiling the dependencies. context-check.py now also checks that each patched path is copied into the cooking stage before the cook, and fails on the Dockerfile as it was.
51 lines
2.7 KiB
Docker
51 lines
2.7 KiB
Docker
FROM --platform=$BUILDPLATFORM docker.io/lukemathwalker/cargo-chef:latest-rust-slim-trixie@sha256:38dfdbf4fda95c516f873f33032e490baa988b75f7d83c7d12f788f770785b36 AS chef
|
|
WORKDIR /build
|
|
|
|
FROM --platform=$BUILDPLATFORM chef AS planner
|
|
COPY . .
|
|
RUN cargo chef prepare --recipe-path /recipe.json
|
|
|
|
FROM --platform=$BUILDPLATFORM chef AS builder
|
|
ARG TARGETPLATFORM
|
|
RUN case "${TARGETPLATFORM}" in \
|
|
"linux/arm64") echo "aarch64-unknown-linux-gnu" > /target.txt && echo "-C linker=aarch64-linux-gnu-gcc" > /flags.txt ;; \
|
|
"linux/amd64") echo "x86_64-unknown-linux-gnu" > /target.txt && echo "-C linker=x86_64-linux-gnu-gcc" > /flags.txt ;; \
|
|
*) exit 1 ;; \
|
|
esac
|
|
RUN export DEBIAN_FRONTEND=noninteractive && \
|
|
apt-get update && \
|
|
apt-get install -yq --no-install-recommends build-essential libclang-19-dev \
|
|
g++-aarch64-linux-gnu binutils-aarch64-linux-gnu \
|
|
g++-x86-64-linux-gnu binutils-x86-64-linux-gnu
|
|
RUN rustup target add "$(cat /target.txt)"
|
|
COPY --from=planner /recipe.json /recipe.json
|
|
# inbuxa: [patch.crates-io] points sieve-rs at vendor/, and the recipe only
|
|
# carries the workspace's own manifests, so cooking the dependencies needs the
|
|
# vendored crate itself (the context allows it since #27; this puts it here).
|
|
COPY vendor/ vendor/
|
|
RUN RUSTFLAGS="$(cat /flags.txt)" cargo chef cook --target "$(cat /target.txt)" --release --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats" --recipe-path /recipe.json
|
|
COPY . .
|
|
RUN RUSTFLAGS="$(cat /flags.txt)" cargo build --target "$(cat /target.txt)" --release -p inbuxa --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats"
|
|
RUN mv "/build/target/$(cat /target.txt)/release" "/output"
|
|
|
|
FROM docker.io/debian:trixie-slim
|
|
RUN export DEBIAN_FRONTEND=noninteractive && \
|
|
apt-get update && \
|
|
apt-get install -yq --no-install-recommends ca-certificates curl libcap2-bin && \
|
|
rm -rf /var/lib/apt/lists/* && \
|
|
groupadd -r -g 2000 inbuxa && \
|
|
useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M inbuxa && \
|
|
mkdir -p /etc/inbuxa /var/lib/inbuxa && \
|
|
chown inbuxa:inbuxa /etc/inbuxa /var/lib/inbuxa
|
|
COPY --from=builder --chmod=0755 /output/inbuxa /usr/local/bin/inbuxa
|
|
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/inbuxa
|
|
USER inbuxa
|
|
WORKDIR /var/lib/inbuxa
|
|
VOLUME ["/etc/inbuxa", "/var/lib/inbuxa"]
|
|
EXPOSE 443 25 110 587 465 143 993 995 4190 8080
|
|
ENV INBUXA_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$INBUXA_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
|
|
ENTRYPOINT ["/usr/local/bin/inbuxa"]
|
|
CMD ["--config", "/etc/inbuxa/config.json"]
|