mirror of
https://github.com/narrrl/holy-flavor-rater.git
synced 2026-11-03 16:41:27 +01:00
65 lines
2.8 KiB
Docker
65 lines
2.8 KiB
Docker
# --- Build stage ------------------------------------------------------------
|
|
# Pin the toolchain image; the crate is edition 2021 with no nightly features.
|
|
FROM rust:1-slim-trixie AS build
|
|
|
|
WORKDIR /build
|
|
|
|
# reqwest uses rustls (no OpenSSL), but pkg-config/ca-certs are still handy for
|
|
# the build; sqlite is bundled via libsqlite3-sys, no system lib needed.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends pkg-config ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Cache dependencies separately from source: copy manifests, build a stub, then
|
|
# copy real sources. A source-only change then reuses the dependency layer.
|
|
COPY Cargo.toml Cargo.lock ./
|
|
RUN mkdir src && echo 'fn main() {}' > src/main.rs \
|
|
&& cargo build --release \
|
|
&& rm -rf src
|
|
|
|
# Fetch the common-passwords list at build time instead of vendoring it in git.
|
|
# It's Django 5.2's `common-passwords.txt.gz`, embedded via include_bytes! in
|
|
# src/password_policy.rs. The checksum is verified, so an upstream change (or a
|
|
# moved branch ref) fails the build loudly rather than silently shipping a
|
|
# different list. Bump the tag + DJANGO_PASSWORDS_SHA256 together to update it.
|
|
ARG DJANGO_PASSWORDS_TAG=5.2
|
|
ARG DJANGO_PASSWORDS_SHA256=3c1baed62596de36860824eb3f436d5932d37ca8b06e59df78f5a44ec175afe4
|
|
RUN mkdir -p assets \
|
|
&& curl -fsSL -o assets/common-passwords.txt.gz \
|
|
"https://raw.githubusercontent.com/django/django/${DJANGO_PASSWORDS_TAG}/django/contrib/auth/common-passwords.txt.gz" \
|
|
&& echo "${DJANGO_PASSWORDS_SHA256} assets/common-passwords.txt.gz" | sha256sum -c -
|
|
|
|
# Real sources.
|
|
COPY src ./src
|
|
# Touch so cargo sees main.rs as newer than the stub build above.
|
|
RUN touch src/main.rs && cargo build --release \
|
|
&& strip target/release/holy_backend_rs
|
|
|
|
# --- Runtime stage ----------------------------------------------------------
|
|
# Must stay on the same Debian release as the build stage — the binary links
|
|
# against that release's glibc.
|
|
FROM debian:trixie-slim
|
|
|
|
# curl for the container healthcheck; ca-certificates for outbound HTTPS
|
|
# (Shopify sync, SMTP over TLS).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Match the Django image's app user (UID/GID 1000) so the shared bind-mounted
|
|
# db.sqlite3 + media/ stay writable by both backends.
|
|
ARG APP_UID=1000
|
|
ARG APP_GID=1000
|
|
RUN groupadd -g ${APP_GID} app \
|
|
&& useradd -u ${APP_UID} -g app -m -s /bin/bash app
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /build/target/release/holy_backend_rs /usr/local/bin/holy_backend_rs
|
|
|
|
USER app
|
|
EXPOSE 8001
|
|
|
|
# Paths point at the shared bind mounts wired in docker-compose. SECRET_KEY,
|
|
# DATABASE_URL, ENABLE_SCHEDULER, EMAIL_* etc. come from the environment.
|
|
ENTRYPOINT ["/usr/local/bin/holy_backend_rs"]
|