951a522
# syntax=docker/dockerfile:1
# Bun bundles the web SPA from inside web/build.rs. Take the binary from the
# official image instead of running the network installer: the installer pulls
# its archive from GitHub releases, which regularly times out here.
FROM oven/bun:1-slim AS bun
FROM rust:1-bookworm AS rust-deps
RUN apt-get update && apt-get install -y --no-install-recommends \
pkg-config \
libssl-dev \
cmake \
perl \
git \
curl \
ca-certificates \
unzip \
protobuf-compiler \
&& rm -rf /var/lib/apt/lists/*
COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
FROM rust-deps AS builder
COPY lib ./lib
COPY app ./app
COPY web ./web
RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=/build/target \
rm -rf /build/target/release/build/web-* \
/build/target/release/deps/web-* 2>/dev/null; \
cargo build --release --workspace --bins && \
mkdir -p /out && \
for b in apihost migrate openapi im; do \
cp "target/release/$b" /out/; \
done
########## runtime ##########
FROM debian:bookworm-slim
# ca-certificates: outbound TLS; git: available for manual maintenance
RUN apt-get update && apt-get install -y --no-install-recommends \
git \
ca-certificates \
libssl3 \
&& rm -rf /var/lib/apt/lists/* \
&& useradd --system --create-home --uid 10001 gitdata \
&& mkdir -p /opt/gitdata/repos /opt/gitdata/objects \
&& chown -R gitdata:gitdata /opt/gitdata
WORKDIR /app
COPY --chown=gitdata:gitdata config/default.toml config/default.toml
COPY --from=builder /out/apihost /out/migrate /out/openapi /out/im /usr/local/bin/
USER gitdata
EXPOSE 3000 3001
CMD ["apihost"]