Niklas Ye
94c394e8f1
CI / chart (push) Successful in 0s
CI / security (push) Successful in 2m41s
CI / test (push) Successful in 7m7s
Release / test (push) Successful in 10s
Release / chart (push) Successful in 2s
Release / image (push) Successful in 2m37s
Release / scan-image (push) Successful in 8s
Release / binaries (push) Successful in 2m51s
govulncheck started failing CI on GO-2026-6809, a crypto/x509 flaw in the
standard library that is fixed in 1.26.10 and reachable through
http.Server.ListenAndServe. golang:1.26.9 is what ci.yaml, release.yaml and
the Dockerfile build with, so all five pins move together: the scan and the
shipped binary must agree on the toolchain, as in 3173abf.
No code change; go.mod still says go 1.25.9.
Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
34 lines
1.7 KiB
Docker
34 lines
1.7 KiB
Docker
# --platform=$BUILDPLATFORM pins the builder to the machine doing the building, so a
|
|
# multi-arch build compiles both targets natively instead of running an emulated arm64
|
|
# toolchain under QEMU. Go cross-compiles from TARGETOS/TARGETARCH, which BuildKit fills
|
|
# in per platform. The CI runner has no binfmt registration and no way to get one (the
|
|
# JS action that used to install it cannot run there), so this is not just an
|
|
# optimisation -- it is what makes the arm64 image buildable at all.
|
|
FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine AS builder
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut
|
|
|
|
FROM scratch
|
|
# scratch has no trust store, and a Go binary on it fails every HTTPS call with
|
|
# "x509: certificate signed by unknown authority". Nothing needed one until single
|
|
# sign-on: discovery and the token exchange are HTTPS calls to the identity provider.
|
|
# The bundle is the builder's, copied by name so a missing file fails the build
|
|
# rather than shipping an image that cannot sign anybody in.
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=builder /terdut /terdut
|
|
EXPOSE 8080
|
|
# Numeric, not a name: scratch has no /etc/passwd for one to resolve against,
|
|
# and Docker's USER accepts a bare UID:GID without it. 65532 is the common
|
|
# "nonroot" convention (distroless's own uid), chosen so the chart's pod
|
|
# securityContext (runAsNonRoot, runAsUser: 65532) matches what the image
|
|
# already runs as rather than fighting it.
|
|
USER 65532:65532
|
|
ENTRYPOINT ["/terdut"]
|