210 lines
9.4 KiB
INI
210 lines
9.4 KiB
INI
# syntax=docker/dockerfile:1
|
|
# check=skip=FromPlatformFlagConstDisallowed,RedundantTargetPlatform
|
|
|
|
# *****************
|
|
# Base image for planner & builder
|
|
# *****************
|
|
FROM --platform=$BUILDPLATFORM rust:slim-trixie AS base
|
|
|
|
ENV DEBIAN_FRONTEND="noninteractive" \
|
|
BINSTALL_DISABLE_TELEMETRY=true \
|
|
CARGO_TERM_COLOR=always \
|
|
CARGO_NET_RETRY=10 \
|
|
CARGO_NET_GIT_FETCH_WITH_CLI=true \
|
|
LANG=C.UTF-8 \
|
|
TZ=UTC \
|
|
TERM=xterm-256color \
|
|
AWS_LC_SYS_PREBUILT_NASM=1
|
|
# With zig, we only need libclang and make. ca-certificates is required for curl
|
|
# to verify HTTPS downloads (zig tarballs, FoundationDB debs, crates.io, etc).
|
|
RUN \
|
|
--mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
rm -f /etc/apt/apt.conf.d/docker-clean && \
|
|
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
|
|
apt-get update && \
|
|
apt-get install -yq --no-install-recommends ca-certificates curl git jq xz-utils make libclang-19-dev
|
|
RUN \
|
|
ZIG_VERSION=0.17.0 && \
|
|
case "$(uname -m)" in \
|
|
x86_64) ZIG_SHA256=1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026 ;; \
|
|
aarch64) ZIG_SHA256=9e8d11661d4ae3bd57702a3832781e23ad151dde5798e16a5ccd503f65234ff8 ;; \
|
|
*) exit 1 ;; \
|
|
esac && \
|
|
curl --retry 5 -fsSLo /tmp/zig.tar.xz "https://ziglang.org/download/${ZIG_VERSION}/zig-$(uname -m)-linux-${ZIG_VERSION}.tar.xz" && \
|
|
echo "${ZIG_SHA256} /tmp/zig.tar.xz" | sha256sum -c - && \
|
|
tar -J -x -C /usr/local -f /tmp/zig.tar.xz && \
|
|
rm /tmp/zig.tar.xz && \
|
|
ln -s "/usr/local/zig-$(uname -m)-linux-${ZIG_VERSION}/zig" /usr/local/bin/zig && \
|
|
zig version
|
|
# Install cargo-binstall
|
|
RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
|
|
# Install cargo-chef & sccache & cargo-zigbuild
|
|
RUN cargo binstall --no-confirm [email protected] [email protected]
|
|
RUN cargo install --locked --git https://github.com/rust-cross/cargo-zigbuild --rev d9f7fd32fbac13cc26d23847835f7f23a5ed3a25 cargo-zigbuild
|
|
|
|
# *****************
|
|
# Planner
|
|
# *****************
|
|
FROM base AS planner
|
|
WORKDIR /app
|
|
COPY . .
|
|
# Generate recipe file
|
|
RUN cargo chef prepare --recipe-path recipe.json
|
|
|
|
# *****************
|
|
# Builder
|
|
# *****************
|
|
FROM base AS builder
|
|
WORKDIR /app
|
|
COPY --from=planner /app/recipe.json recipe.json
|
|
ARG TARGET
|
|
ARG BUILD_ENV
|
|
ARG GLIBC_VERSION=2.28
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
# Install toolchain and specify some env variables
|
|
RUN \
|
|
rustup set profile minimal && \
|
|
rustup target add ${TARGET} && \
|
|
mkdir -p artifact && \
|
|
touch /env-cargo && \
|
|
if [[ "${TARGET}" == *-gnu* ]]; then \
|
|
echo "export BUILD_TARGET=${TARGET}.${GLIBC_VERSION}" >> /env-cargo; \
|
|
mkdir -p target && \
|
|
ln -s "${TARGET}" "target/${TARGET}.${GLIBC_VERSION}"; \
|
|
else \
|
|
echo "export BUILD_TARGET=${TARGET}" >> /env-cargo; \
|
|
fi && \
|
|
if [ ! -z "${BUILD_ENV}" ]; then \
|
|
echo "export ${BUILD_ENV}" >> /env-cargo; \
|
|
echo "Setting up ${BUILD_ENV}"; \
|
|
fi && \
|
|
if [[ "${TARGET}" == *gnu ]]; then \
|
|
base_arch="${TARGET%%-*}"; \
|
|
case "$base_arch" in \
|
|
x86_64) \
|
|
echo "export FDB_ARCH=amd64" >> /env-cargo; \
|
|
;; \
|
|
aarch64) \
|
|
echo "export FDB_ARCH=aarch64" >> /env-cargo; \
|
|
;; \
|
|
*) \
|
|
exit 1; \
|
|
;; \
|
|
esac; \
|
|
target_var="${TARGET^^}"; \
|
|
echo "export FDB_RUSTFLAGS_VAR=CARGO_TARGET_${target_var//-/_}_RUSTFLAGS" >> /env-cargo; \
|
|
fi
|
|
# Install FoundationDB (pinned to latest 7.4.x; Apple publishes 7.4 as
|
|
# prereleases on GitHub, so the release list is fetched without the
|
|
# prerelease filter and narrowed by tag name).
|
|
ARG FDB_VERSION_RANGE="7.4"
|
|
RUN \
|
|
--mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
|
|
source /env-cargo && \
|
|
if [ ! -z "${FDB_ARCH}" ]; then \
|
|
auth=() && \
|
|
if [ -n "${GITHUB_TOKEN}" ]; then auth=(-H "Authorization: Bearer ${GITHUB_TOKEN}"); fi && \
|
|
fdb_url="$(curl --retry 5 -fLs "${auth[@]}" 'https://api.github.com/repos/apple/foundationdb/releases?per_page=100' | jq --arg FDB_ARCH "$FDB_ARCH" --arg RANGE "${FDB_VERSION_RANGE}" -r '[.[] | select(.tag_name | startswith($RANGE + "."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url')" && \
|
|
[ -n "${fdb_url}" ] && \
|
|
curl --retry 5 -fLso fdb-client.deb "${fdb_url}" && \
|
|
mkdir -p /fdb && \
|
|
dpkg -x fdb-client.deb /fdb && \
|
|
mv /fdb/usr/include/foundationdb /usr/include && \
|
|
mv /fdb/usr/lib/libfdb_c.so /usr/lib && \
|
|
rm -rf fdb-client.deb /fdb; \
|
|
fi
|
|
# Cargo-chef Cache layer
|
|
RUN \
|
|
--mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
|
|
--mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
|
|
--mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
source /env-cargo && \
|
|
if [ ! -z "${FDB_ARCH}" ]; then \
|
|
env "${FDB_RUSTFLAGS_VAR}=-L /usr/lib" cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${BUILD_TARGET} -p inbuxa --no-default-features --features "foundationdb s3 redis nats"; \
|
|
fi
|
|
RUN \
|
|
--mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
|
|
--mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
|
|
--mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
source /env-cargo && \
|
|
cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${BUILD_TARGET} -p inbuxa --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats"
|
|
# Copy the source code
|
|
COPY . .
|
|
ENV RUSTC_WRAPPER="sccache" \
|
|
SCCACHE_GHA_ENABLED=true
|
|
# Build FoundationDB version
|
|
RUN \
|
|
--mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
|
|
--mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
|
|
--mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
source /env-cargo && \
|
|
if [ ! -z "${FDB_ARCH}" ]; then \
|
|
env "${FDB_RUSTFLAGS_VAR}=-L /usr/lib" cargo zigbuild --release --target ${BUILD_TARGET} -p inbuxa --no-default-features --features "foundationdb s3 redis nats" && \
|
|
mv /app/target/${TARGET}/release/inbuxa /app/artifact/inbuxa-foundationdb; \
|
|
fi
|
|
# Build generic version
|
|
RUN \
|
|
--mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
|
|
--mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
|
|
--mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
source /env-cargo && \
|
|
cargo zigbuild --release --target ${BUILD_TARGET} -p inbuxa --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats" && \
|
|
mv /app/target/${TARGET}/release/inbuxa /app/artifact/inbuxa
|
|
|
|
# *****************
|
|
# Binary stage
|
|
# *****************
|
|
FROM scratch AS binaries
|
|
COPY --from=builder /app/artifact /
|
|
|
|
# *****************
|
|
# Runtime image for GNU targets
|
|
# *****************
|
|
FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim AS gnu
|
|
RUN export DEBIAN_FRONTEND=noninteractive && \
|
|
apt-get update && \
|
|
apt-get install -yq --no-install-recommends ca-certificates curl tzdata libcap2-bin && \
|
|
rm -rf /var/lib/apt/lists/* && \
|
|
groupadd -r -g 2000 inbuxa && \
|
|
useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M inbuxa && \
|
|
mkdir -p /etc/inbuxa /var/lib/inbuxa && \
|
|
chown inbuxa:inbuxa /etc/inbuxa /var/lib/inbuxa
|
|
COPY --from=builder --chmod=0755 /app/artifact/inbuxa /usr/local/bin/inbuxa
|
|
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/inbuxa
|
|
USER inbuxa
|
|
WORKDIR /var/lib/inbuxa
|
|
VOLUME ["/etc/inbuxa", "/var/lib/inbuxa"]
|
|
EXPOSE 443 25 110 587 465 143 993 995 4190 8080
|
|
ENV INBUXA_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$INBUXA_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
|
|
ENTRYPOINT ["/usr/local/bin/inbuxa"]
|
|
CMD ["--config", "/etc/inbuxa/config.json"]
|
|
|
|
# *****************
|
|
# Runtime image for musl targets
|
|
# *****************
|
|
FROM --platform=$TARGETPLATFORM alpine AS musl
|
|
RUN apk add --update --no-cache ca-certificates curl tzdata libcap && \
|
|
rm -rf /var/cache/apk/* && \
|
|
addgroup -S -g 2000 inbuxa && \
|
|
adduser -S -D -H -u 2000 -G inbuxa -s /sbin/nologin inbuxa && \
|
|
mkdir -p /etc/inbuxa /var/lib/inbuxa && \
|
|
chown inbuxa:inbuxa /etc/inbuxa /var/lib/inbuxa
|
|
COPY --from=builder --chmod=0755 /app/artifact/inbuxa /usr/local/bin/inbuxa
|
|
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/inbuxa
|
|
USER inbuxa
|
|
WORKDIR /var/lib/inbuxa
|
|
VOLUME ["/etc/inbuxa", "/var/lib/inbuxa"]
|
|
EXPOSE 443 25 110 587 465 143 993 995 4190 8080
|
|
ENV INBUXA_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$INBUXA_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
|
|
ENTRYPOINT ["/usr/local/bin/inbuxa"]
|
|
CMD ["--config", "/etc/inbuxa/config.json"]
|