71 lines
No EOL
2.1 KiB
Docker
71 lines
No EOL
2.1 KiB
Docker
# Pin the Rust toolchain version used in the build stage.
|
|
ARG RUST_VERSION=1.92
|
|
|
|
# Name of the compiled binary produced by Cargo (must match Cargo.toml package name).
|
|
ARG APP_NAME=paste
|
|
|
|
################################################################################
|
|
# Build stage (DOI Rust image)
|
|
# This stage compiles the application.
|
|
################################################################################
|
|
|
|
FROM docker.io/library/rust:${RUST_VERSION}-alpine AS build
|
|
|
|
# Re-declare args inside the stage if you want to use them here.
|
|
ARG APP_NAME
|
|
|
|
# All build steps happen inside /app.
|
|
WORKDIR /app
|
|
|
|
# Install build dependencies needed to compile Rust crates on Alpine
|
|
RUN apk add --no-cache clang lld musl-dev git
|
|
|
|
# Build the application
|
|
RUN --mount=type=bind,source=src,target=src \
|
|
--mount=type=bind,source=Cargo.toml,target=Cargo.toml \
|
|
--mount=type=bind,source=Cargo.lock,target=Cargo.lock \
|
|
--mount=type=cache,target=/app/target/ \
|
|
--mount=type=cache,target=/usr/local/cargo/git/db \
|
|
--mount=type=cache,target=/usr/local/cargo/registry/ \
|
|
cargo build --locked --release && \
|
|
cp ./target/release/$APP_NAME /bin/server
|
|
|
|
################################################################################
|
|
# Runtime stage (DOI Alpine image)
|
|
# This stage runs the already-compiled binary with minimal dependencies.
|
|
################################################################################
|
|
|
|
FROM docker.io/library/alpine:3.18 AS final
|
|
|
|
# Create a non-privileged user (recommended best practice)
|
|
ARG UID=10001
|
|
RUN adduser \
|
|
--disabled-password \
|
|
--gecos "" \
|
|
--home "/nonexistent" \
|
|
--shell "/sbin/nologin" \
|
|
--no-create-home \
|
|
--uid "${UID}" \
|
|
imnyang
|
|
|
|
RUN mkdir -p /app
|
|
RUN chmod -R 755 /app
|
|
RUN mkdir -p /app/uploads
|
|
RUN chown -R imnyang:imnyang /app
|
|
|
|
# Drop privileges for runtime.
|
|
USER imnyang
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy only the compiled binary from the build stage.
|
|
COPY --from=build /bin/server /app/
|
|
|
|
# Rocket: listen on all interfaces inside the container.
|
|
ENV ROCKET_ADDRESS=0.0.0.0
|
|
|
|
# Document the port your app listens on.
|
|
EXPOSE 8000
|
|
|
|
# Start the application.
|
|
CMD ["/app/server"] |