ktims
ac154066e1
The runtime image contains only the binary and an empty hooks directory, and runs as an unprivileged numeric user. Hook scripts need a shell, so they will not run in this image.
29 lines
1.2 KiB
Docker
29 lines
1.2 KiB
Docker
FROM rust:1.94-bookworm AS builder
|
|
# Statically linked musl build. Override for other architectures, e.g. --build-arg RUST_TARGET=aarch64-unknown-linux-musl
|
|
ARG RUST_TARGET=x86_64-unknown-linux-musl
|
|
RUN rustup target add ${RUST_TARGET}
|
|
WORKDIR /build
|
|
|
|
# Build dependencies against stub sources so this layer is only invalidated by Cargo.toml/Cargo.lock changes.
|
|
COPY Cargo.toml Cargo.lock ./
|
|
RUN mkdir -p src/bin \
|
|
&& touch src/lib.rs \
|
|
&& echo 'fn main() {}' > src/bin/rust-bfdd.rs \
|
|
&& cargo build --release --locked --target ${RUST_TARGET} --bin rust-bfdd \
|
|
&& rm -rf src
|
|
|
|
COPY src ./src
|
|
# COPY keeps the host mtimes, which may predate the stub build; force cargo to rebuild the crate itself.
|
|
RUN touch src/lib.rs src/bin/rust-bfdd.rs \
|
|
&& cargo build --release --locked --target ${RUST_TARGET} --bin rust-bfdd \
|
|
&& mkdir -p /rootfs/etc/rust-bfd/hooks.d \
|
|
&& cp target/${RUST_TARGET}/release/rust-bfdd /rootfs/rust-bfdd
|
|
|
|
FROM scratch
|
|
COPY --from=builder /rootfs/etc /etc
|
|
COPY --from=builder /rootfs/rust-bfdd /usr/local/bin/rust-bfdd
|
|
# No /etc/passwd in scratch, so use a numeric unprivileged user
|
|
USER 10001:10001
|
|
EXPOSE 3784/udp
|
|
ENTRYPOINT ["/usr/local/bin/rust-bfdd"]
|