Niklas Ye
a2dc9e3b03
The image is built FROM scratch and carried only the binary, so it had no trust store, and every HTTPS call failed with "x509: certificate signed by unknown authority". Nothing needed one until v0.29.0: OIDC discovery and the token exchange are HTTPS calls to the identity provider, and the first sign-in against Authentik died in discovery. The tests could not see it, because they run on the host, whose trust store is fine. The builder's ca-certificates.crt is copied in by name, so a missing file fails the build instead of shipping an image that cannot sign anybody in. Verified by fetching the provider's discovery URL from a scratch image with and without the bundle: the same x509 error, then 200. Password login and everything that talks only to Postgres were unaffected.
28 lines
1.3 KiB
Docker
28 lines
1.3 KiB
Docker
# --platform=$BUILDPLATFORM pins the builder to the machine doing the building, so a
|
|
# multi-arch build compiles both targets natively instead of running an emulated arm64
|
|
# toolchain under QEMU. Go cross-compiles from TARGETOS/TARGETARCH, which BuildKit fills
|
|
# in per platform. The CI runner has no binfmt registration and no way to get one (the
|
|
# JS action that used to install it cannot run there), so this is not just an
|
|
# optimisation -- it is what makes the arm64 image buildable at all.
|
|
FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut
|
|
|
|
FROM scratch
|
|
# scratch has no trust store, and a Go binary on it fails every HTTPS call with
|
|
# "x509: certificate signed by unknown authority". Nothing needed one until single
|
|
# sign-on: discovery and the token exchange are HTTPS calls to the identity provider.
|
|
# The bundle is the builder's, copied by name so a missing file fails the build
|
|
# rather than shipping an image that cannot sign anybody in.
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=builder /terdut /terdut
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/terdut"]
|