Garrett Mills
cec61b886e
The image now runs as USER 10001:10001 with a matching group, so Kubernetes can verify runAsNonRoot and fsGroup: 10001 grants it a mounted volume. When the database can't be opened because its directory isn't writable, the server says so and how to fix it, instead of SQLite's bare "unable to open database file". The README covers the pod securityContext.
28 lines
943 B
Docker
28 lines
943 B
Docker
# Build from the repository root, so the workspace (and its lockfile) is in
|
|
# the context:
|
|
#
|
|
# docker build -f crates/mtgc-server/Dockerfile -t mtgc-server .
|
|
|
|
FROM rust:1-bookworm AS build
|
|
WORKDIR /src
|
|
COPY . .
|
|
RUN cargo build --release --locked -p mtgc-server \
|
|
&& cp target/release/mtgc-server /mtgc-server
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --system --gid 10001 mtgc \
|
|
&& useradd --system --uid 10001 --gid 10001 --home /data mtgc \
|
|
&& mkdir /data && chown 10001:10001 /data
|
|
COPY --from=build /mtgc-server /usr/local/bin/mtgc-server
|
|
# Numeric, so Kubernetes can verify `runAsNonRoot` (it can't resolve names),
|
|
# and with a fixed group so `fsGroup: 10001` grants a mounted volume to it.
|
|
USER 10001:10001
|
|
VOLUME /data
|
|
ENV MTGC_DB=/data/mtgc-server.db \
|
|
MTGC_BIND=0.0.0.0:8080
|
|
EXPOSE 8080
|
|
CMD ["mtgc-server"]
|