jcoffey-dev
e11fdae372
Dockerfile.relay builds inbuxa-relay alone, as a static musl binary, into a FROM-scratch image of about 12 MB: the binary, the CA roots and a state directory, run as uid 2001 with cap_net_bind_service only, and INBUXA_RELAY_CONTAINER set so the relay doesn't upgrade itself. A release tag builds it on whichever forge builds, under the server's tags, after checking that the image prints this version and holds no server binary (RL-T24). The release gets the two binaries, taken out of the image, in SHA256SUMS with the server's. Gitea's relay-sign job then signs them with the RELAY_RELEASE_KEY secret and attaches the .sig files; without the secret it warns and signs nothing. tools/release/new-relay-keys.sh makes the CI key and an offline backup key and prints only their public halves. resources/systemd has the unit for a host install: binary in /opt/inbuxa-relay/bin, owned by the relay's user so upgrades can replace it, Restart=always, sandboxed.
41 lines
1.8 KiB
Docker
41 lines
1.8 KiB
Docker
# inbuxa Relay's image (relay spec, RL-31): the inbuxa-relay binary and
|
|
# nothing of the server. It is a static musl build, built natively for the
|
|
# platform asked for (each architecture has its own runner), so the binary
|
|
# taken out of this image for a Release runs on any Linux of that
|
|
# architecture.
|
|
#
|
|
# docker buildx build -f Dockerfile.relay --platform linux/amd64 .
|
|
#
|
|
# The image runs as an unprivileged user (2001), may bind ports 25 and 443 and
|
|
# nothing more, and keeps its state in /var/lib/inbuxa-relay. It sets
|
|
# INBUXA_RELAY_CONTAINER, so the relay reports selfUpgrade: false and an
|
|
# upgrade is a new image (RL-29). On its first run it joins with
|
|
# INBUXA_RELAY_JOIN_TOKEN.
|
|
#
|
|
# Docker Hub images, pulled through Google's mirror, as in Dockerfile.
|
|
FROM mirror.gcr.io/library/rust:1-alpine3.22 AS builder
|
|
RUN apk add --no-cache musl-dev build-base cmake perl libcap ca-certificates
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN cargo build --release --locked -p inbuxa-relay && \
|
|
install -m 0755 target/release/inbuxa-relay /inbuxa-relay && \
|
|
# Static, or it won't run on a host without musl
|
|
! ldd /inbuxa-relay 2>/dev/null | grep -q '=>' && \
|
|
# Set here: the copy below keeps it
|
|
setcap 'cap_net_bind_service=+ep' /inbuxa-relay && \
|
|
mkdir -m 0700 /state
|
|
|
|
# The binary and the CA roots, nothing else (RL-30): no shell, no package
|
|
# manager. The user is a number, as there is no /etc/passwd.
|
|
FROM scratch
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=builder /inbuxa-relay /usr/local/bin/inbuxa-relay
|
|
COPY --from=builder --chown=2001:2001 /state /var/lib/inbuxa-relay
|
|
USER 2001:2001
|
|
WORKDIR /var/lib/inbuxa-relay
|
|
VOLUME ["/var/lib/inbuxa-relay"]
|
|
ENV INBUXA_RELAY_CONTAINER=1
|
|
EXPOSE 25 443
|
|
ENTRYPOINT ["/usr/local/bin/inbuxa-relay"]
|
|
CMD ["run", "--state", "/var/lib/inbuxa-relay"]
|