Kyle Isom
941c71f2d1
- Makefile: build/test/lint/generate/man/install/clean/dist/docker; CGO_ENABLED=1 throughout; VERSION from git describe --tags --always - Dockerfile: multi-stage (golang:1.26-bookworm builder -> debian:bookworm-slim runtime); non-root uid 10001 (mcias), VOLUME /data, EXPOSE 8443/9443; no toolchain in final image - dist/mcias.service: hardened systemd unit (ProtectSystem=strict, ProtectHome, PrivateTmp, NoNewPrivileges, MemoryDenyWriteExecute, CapabilityBoundingSet= empty, EnvironmentFile, LimitNOFILE=65536) - dist/mcias.env.example: passphrase env file template - dist/mcias.conf.example: fully-commented production TOML config - dist/mcias-dev.conf.example: local dev config (/tmp, short expiry) - dist/mcias.conf.docker.example: container config template - dist/install.sh: POSIX sh idempotent installer; creates mcias user/group, installs binaries, /etc/mcias, /var/lib/mcias, systemd unit, man pages; prints post-install instructions - man/man1/mciassrv.1: mdoc synopsis/config/API/signals/files - man/man1/mciasctl.1: mdoc all subcommands/env/examples - man/man1/mciasdb.1: mdoc trust model/safety/all subcommands - man/man1/mciasgrpcctl.1: mdoc gRPC commands/grpcurl example - README.md: user-facing quick-start, first-run setup, build instructions, CLI references, Docker deployment, security notes - .gitignore: added /bin/, dist/mcias_*.tar.gz, man/man1/*.gz
100 lines
3.7 KiB
Docker
100 lines
3.7 KiB
Docker
# Dockerfile — MCIAS multi-stage container image
|
||
#
|
||
# Stage 1 (builder): Compiles all four MCIAS binaries.
|
||
# Stage 2 (runtime): Minimal Debian image containing only the binaries.
|
||
#
|
||
# The final image:
|
||
# - Runs as non-root uid 10001 (mcias)
|
||
# - Exposes port 8443 (REST/TLS) and 9443 (gRPC/TLS)
|
||
# - Declares VOLUME /data for the SQLite database
|
||
# - Does NOT contain the Go toolchain, source code, or build cache
|
||
#
|
||
# Build:
|
||
# docker build -t mcias:$(git describe --tags --always) .
|
||
#
|
||
# Run:
|
||
# docker run -d \
|
||
# --name mcias \
|
||
# -v /path/to/config:/etc/mcias:ro \
|
||
# -v mcias-data:/data \
|
||
# -e MCIAS_MASTER_PASSPHRASE=your-passphrase \
|
||
# -p 8443:8443 \
|
||
# -p 9443:9443 \
|
||
# mcias:latest
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Stage 1 — builder
|
||
# ---------------------------------------------------------------------------
|
||
FROM golang:1.26-bookworm AS builder
|
||
|
||
WORKDIR /build
|
||
|
||
# Download dependencies first for layer caching.
|
||
COPY go.mod go.sum ./
|
||
RUN go mod download
|
||
|
||
# Copy source.
|
||
COPY . .
|
||
|
||
# CGO_ENABLED=1 is required by modernc.org/sqlite (pure-Go CGo-free SQLite).
|
||
# -trimpath removes local file system paths from the binary.
|
||
# -ldflags="-s -w" strips the DWARF debug info and symbol table to reduce
|
||
# image size.
|
||
RUN CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /out/mciassrv ./cmd/mciassrv && \
|
||
CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /out/mciasctl ./cmd/mciasctl && \
|
||
CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /out/mciasdb ./cmd/mciasdb && \
|
||
CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /out/mciasgrpcctl ./cmd/mciasgrpcctl
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Stage 2 — runtime
|
||
# ---------------------------------------------------------------------------
|
||
FROM debian:bookworm-slim
|
||
|
||
# Install runtime dependencies.
|
||
# ca-certificates: required to validate external TLS certificates.
|
||
# libc6: required by CGo-compiled binaries (sqlite).
|
||
RUN apt-get update && \
|
||
apt-get install -y --no-install-recommends \
|
||
ca-certificates \
|
||
libc6 && \
|
||
rm -rf /var/lib/apt/lists/*
|
||
|
||
# Create a non-root user for the service.
|
||
# uid/gid 10001 is chosen to be well above the range typically assigned to
|
||
# system users (1–999) and human users (1000+), reducing the chance of
|
||
# collision with existing uids on the host when using host networking.
|
||
RUN groupadd --gid 10001 mcias && \
|
||
useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin mcias
|
||
|
||
# Copy compiled binaries from the builder stage.
|
||
COPY --from=builder /out/mciassrv /usr/local/bin/mciassrv
|
||
COPY --from=builder /out/mciasctl /usr/local/bin/mciasctl
|
||
COPY --from=builder /out/mciasdb /usr/local/bin/mciasdb
|
||
COPY --from=builder /out/mciasgrpcctl /usr/local/bin/mciasgrpcctl
|
||
|
||
# Create the config and data directories.
|
||
# /etc/mcias is mounted read-only by the operator with the config file,
|
||
# TLS cert, and TLS key.
|
||
# /data is the SQLite database mount point.
|
||
RUN mkdir -p /etc/mcias /data && \
|
||
chown mcias:mcias /data && \
|
||
chmod 0750 /data
|
||
|
||
# Declare /data as a volume so the operator must explicitly mount it.
|
||
# The SQLite database must persist across container restarts.
|
||
VOLUME /data
|
||
|
||
# REST/TLS port and gRPC/TLS port. These are documentation only; the actual
|
||
# ports are set in the config file. Override by mounting a different config.
|
||
EXPOSE 8443
|
||
EXPOSE 9443
|
||
|
||
# Run as the non-root mcias user.
|
||
USER mcias
|
||
|
||
# Default entry point and config path.
|
||
# The operator mounts /etc/mcias/mcias.conf from the host or a volume.
|
||
# See dist/mcias.conf.docker.example for a suitable template.
|
||
ENTRYPOINT ["mciassrv"]
|
||
CMD ["-config", "/etc/mcias/mcias.conf"]
|