Admin
ad670f30ac
The browser hub is a status/metadata reader for an instance, separate from the operator console and its owner cookies. Build it as its own Preact bundle at /hub/ outside the owner gate, embed it via //go:embed all:hub/dist (with a committed index placeholder so a clean checkout still builds), and apply a strict CSP because it shares the console origin. The Docker build stages the hub build alongside the console; dist assets remain ignored.
56 lines
2.1 KiB
Docker
56 lines
2.1 KiB
Docker
# Copyright (C) 2026 Dcntrlized
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
# Stage 1: Build the UI bundle
|
|
FROM oven/bun:1.3.9-alpine AS frontend-builder
|
|
WORKDIR /app
|
|
# Copy the lockfile so `bun ci` can accurately install
|
|
COPY src/frontend/package.json src/frontend/bun.lock ./
|
|
RUN bun ci
|
|
COPY src/frontend/ ./
|
|
RUN bun run build
|
|
|
|
# Stage 1b: Build the PUBLIC hub SPA bundle (separate bundle, served at /hub/
|
|
# outside the owner gate; browser-edge contract §10.5).
|
|
FROM oven/bun:1.3.9-alpine AS hub-builder
|
|
WORKDIR /app
|
|
COPY src/hub/package.json src/hub/bun.lock ./
|
|
RUN bun ci
|
|
COPY src/hub/ ./
|
|
RUN bun run build
|
|
|
|
# Stage 2: Build the static Go binary
|
|
FROM golang:1.26-alpine AS go-builder
|
|
WORKDIR /app
|
|
COPY src/go.mod src/go.sum ./
|
|
RUN go mod download
|
|
# This dumps main.go and the frontend dir into /app
|
|
COPY src/ .
|
|
# Copy the built UI into the frontend folder so go:embed finds it
|
|
COPY --from=frontend-builder /app/dist ./frontend/dist
|
|
# Copy the built hub SPA into hub/dist so go:embed all:hub/dist finds it
|
|
COPY --from=hub-builder /app/dist ./hub/dist
|
|
# Build a statically linked binary, stripping debug symbols (-s -w) for smaller size
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o server .
|
|
RUN apk add --no-cache ca-certificates
|
|
|
|
# Stage 3: The final minimal image
|
|
FROM scratch
|
|
# The binary is at /app/server, not src/app/server
|
|
COPY --from=go-builder /app/server /server
|
|
# Copy SSL certs
|
|
COPY --from=go-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/server"] |