Rogeeandrogee
a5d244d293
* HH-500: add reproducible production dist bundle * HH-500: make production bundle builds reproducible * HH-500: lock complete runtime APK closure --------- Co-authored-by: Rogee <rogee@ipao.vip>
114 lines
4.5 KiB
Docker
114 lines
4.5 KiB
Docker
# GoChat Dockerfile — Multi-stage build with security hardening
|
|
# Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices
|
|
|
|
# ========== Frontend Build Stage ==========
|
|
FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS frontend-builder
|
|
|
|
ARG SOURCE_DATE_EPOCH=0
|
|
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY frontend/package.json frontend/package.json
|
|
RUN corepack enable && pnpm install --frozen-lockfile
|
|
|
|
COPY frontend/ frontend/
|
|
RUN pnpm --dir frontend test:build
|
|
|
|
# ========== Go Build Stage ==========
|
|
FROM golang:1.25.13-alpine@sha256:1e0126852075c9c60731c8ba49088448b91f63e2aed97ca9d1a9791622a05946 AS builder
|
|
|
|
# Build arguments for version injection
|
|
ARG VERSION=dev
|
|
ARG COMMIT_SHA=unknown
|
|
ARG BUILD_DATE=unknown
|
|
ARG SOURCE_DATE_EPOCH=0
|
|
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
|
|
|
|
WORKDIR /app
|
|
|
|
# Dependency layer — cached unless go.mod/go.sum change
|
|
COPY backend/go.mod backend/go.sum ./
|
|
COPY backend/internal/pgvector_stub/ ./internal/pgvector_stub/
|
|
RUN go mod download
|
|
|
|
# Copy source code (build context = repo root)
|
|
COPY backend/ .
|
|
|
|
# Build with version info injected via ldflags
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
|
|
-X github.com/gochat/gochat/internal/config.Version=${VERSION} \
|
|
-X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
|
|
-X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
|
|
-o /gochat ./cmd/gochat/
|
|
|
|
# Build worker binary (same source, --worker-only flag in main)
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -trimpath -buildvcs=false -tags timetzdata -ldflags="-s -w \
|
|
-X github.com/gochat/gochat/internal/config.Version=${VERSION} \
|
|
-X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
|
|
-X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
|
|
-o /gochat-worker ./cmd/gochat/
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -ldflags="-s -w" -o /migrate ./cmd/migrate/
|
|
|
|
# ========== Production Stage ==========
|
|
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
|
|
|
|
ARG VERSION=dev
|
|
ARG COMMIT_SHA=unknown
|
|
ARG BUILD_DATE=unknown
|
|
ARG SOURCE_DATE_EPOCH=0
|
|
LABEL org.opencontainers.image.version="${VERSION}" \
|
|
org.opencontainers.image.revision="${COMMIT_SHA}" \
|
|
org.opencontainers.image.created="${BUILD_DATE}"
|
|
|
|
# Install and verify the complete pinned runtime dependency closure.
|
|
COPY deploy/docker/gochat-runtime-apks.txt /tmp/gochat-runtime-apks.txt
|
|
RUN apk --no-cache add bash=5.2.37-r0 brotli-libs=1.1.0-r2 busybox=1.37.0-r14 \
|
|
busybox-binsh=1.37.0-r14 c-ares=1.34.8-r0 ca-certificates=20260413-r0 \
|
|
ca-certificates-bundle=20260413-r0 curl=8.14.1-r2 libcrypto3=3.3.7-r0 \
|
|
libcurl=8.14.1-r2 libidn2=2.3.7-r0 libssl3=3.3.7-r0 \
|
|
libncursesw=6.5_p20241006-r3 libpq=17.11-r0 libpsl=0.21.5-r3 libunistring=1.2-r0 \
|
|
lz4-libs=1.10.0-r0 musl=1.2.5-r11 ncurses-terminfo-base=6.5_p20241006-r3 \
|
|
nghttp2-libs=1.69.0-r0 \
|
|
openssl=3.3.7-r0 postgresql-common=1.2-r1 postgresql16-client=16.15-r0 \
|
|
readline=8.2.13-r0 tzdata=2026c-r0 zlib=1.3.2-r0 zstd-libs=1.5.6-r2 && \
|
|
apk info -vv | sed 's/ .*//' | sort | diff -u /tmp/gochat-runtime-apks.txt - && \
|
|
rm /tmp/gochat-runtime-apks.txt && \
|
|
addgroup -S gochat && adduser -S gochat -G gochat
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy binary and configs from builder
|
|
COPY --from=builder /gochat /app/gochat
|
|
COPY --from=builder /gochat-worker /app/gochat-worker
|
|
COPY --from=builder /migrate /app/migrate
|
|
COPY --chown=gochat:gochat --from=frontend-builder /app/frontend/dist /app/frontend/dist
|
|
COPY backend/configs/ /app/configs/
|
|
COPY backend/migrations/ /app/migrations/
|
|
COPY backend/scripts/db_backup.sh backend/scripts/db_restore.sh deploy/docker/database_client_entrypoint.sh /app/scripts/
|
|
|
|
ENV GOCHAT_FRONTEND_DIST=/app/frontend/dist
|
|
|
|
# Set ownership to non-root user
|
|
RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app/storage
|
|
|
|
# Switch to non-root user for security
|
|
USER gochat
|
|
|
|
# Health check — references the /health endpoint we will add
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget -q -T 3 -O /dev/null http://127.0.0.1:3000/ready || exit 1
|
|
|
|
EXPOSE 3000
|
|
|
|
# Default entrypoint — can be overridden for worker mode:
|
|
# docker run gochat/gochat serve → API server
|
|
# docker run gochat/gochat serve --worker-only → background worker
|
|
ENTRYPOINT ["/app/gochat"]
|
|
CMD ["serve"]
|