newdrive/Dockerfile
Elijah f24e96efa7
All checks were successful
CI / Backend (push) Successful in 29s
CI / Frontend (push) Successful in 9m27s
CI / Contracts and repository policy (push) Successful in 7s
CI / Container (push) Successful in 18s
Harden CI and switch release builds to tagged immutable images
2026-07-15 19:21:07 -07:00

49 lines
1.3 KiB
Docker

# syntax=docker/dockerfile:1.7
FROM golang:1.26-bookworm AS go-base
WORKDIR /src
FROM node:24-bookworm AS web-dependencies
WORKDIR /src/web
COPY web/package.json web/package-lock.json ./
RUN npm ci
FROM web-dependencies AS web-build
COPY web/ ./
RUN npm run build
FROM go-base AS backend-build
ARG VERSION=dev
COPY go.mod ./
COPY cmd/ ./cmd/
COPY internal/ ./internal/
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o /out/drive ./cmd/drive
FROM node:24-bookworm AS verify
COPY --from=go-base /usr/local/go /usr/local/go
ENV PATH="/usr/local/go/bin:${PATH}"
WORKDIR /src
COPY . .
RUN npm --prefix web ci
CMD ["sh", "scripts/verify.sh"]
FROM debian:bookworm-slim AS runtime
RUN apt-get update \
&& apt-get install --no-install-recommends -y ca-certificates tini \
&& rm -rf /var/lib/apt/lists/* \
&& groupadd --gid 65532 drive \
&& useradd --uid 65532 --gid drive --no-create-home --home-dir /nonexistent drive
WORKDIR /app
COPY --from=backend-build /out/drive /usr/local/bin/drive
COPY --from=web-build /src/web/dist /app/web
ENV DRIVE_HTTP_ADDRESS=:8080 \
DRIVE_WEB_ROOT=/app/web \
DRIVE_STORAGE_ROOT=/storage/.drive \
DRIVE_PREVIEW_CACHE_ROOT=/cache/previews
USER 65532:65532
EXPOSE 8080
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/drive"]
CMD ["serve"]