unkin-agent
b5e68da270
Ship a distroless image so the plugin can run in-cluster in serve mode, letting developer laptops use the shared cache without S3 credentials. - Dockerfile: golang builder running `make build`, distroless static nonroot - `make docker` for a local smoke build - `.woodpecker/docker.yaml` pushes to docker-internal on tag - README: image name and the SSL_CERT_DIR mount the internal CA needs
20 lines
475 B
Docker
20 lines
475 B
Docker
FROM docker.io/golang:1.26 AS builder
|
|
|
|
WORKDIR /build
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
RUN make build
|
|
|
|
# distroless static ships /etc/ssl/certs/ca-certificates.crt, which the S3
|
|
# client needs to reach https://s3.ceph.unkin.net, and runs as an unprivileged
|
|
# user. No shell, no package manager.
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
COPY --from=builder /build/dist/go-cache-plugin /usr/local/bin/go-cache-plugin
|
|
|
|
ENTRYPOINT ["go-cache-plugin"]
|