mirror of
https://github.com/hanzoai/gateway.git
synced 2026-11-02 08:45:10 +00:00
zooqueen
c7e280dee2
The redirect is set through GIT_CONFIG_COUNT and its key/value pair for the life of this command, so the build creates no credential file.
42 lines
1.6 KiB
Docker
42 lines
1.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# admin-guard — the single forward-auth gate for Hanzo's raw global-admin
|
|
# surfaces. Tiny static Go binary; reuses github.com/hanzoai/gateway/v2/iamauth.
|
|
ARG GOLANG_VERSION=1.26.5
|
|
ARG ALPINE_VERSION=3.23
|
|
|
|
FROM --platform=$BUILDPLATFORM golang:${GOLANG_VERSION}-alpine${ALPINE_VERSION} AS builder
|
|
ARG TARGETOS TARGETARCH
|
|
|
|
RUN apk --no-cache add git
|
|
|
|
COPY . /app
|
|
WORKDIR /app
|
|
|
|
# Private cross-repo modules are fetched via authenticated git (gh_token secret).
|
|
# Everything else resolves through the public proxy and is verified against
|
|
# sum.golang.org — matches the gateway Dockerfile.
|
|
ENV GOPRIVATE=github.com/hanzoai/*
|
|
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=secret,id=gh_token \
|
|
if [ -s /run/secrets/gh_token ]; then \
|
|
export GIT_CONFIG_COUNT=1 \
|
|
GIT_CONFIG_KEY_0="url.https://x-access-token:$(cat /run/secrets/gh_token)@github.com/.insteadOf" \
|
|
GIT_CONFIG_VALUE_0="https://github.com/"; \
|
|
fi; \
|
|
CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
|
|
go build -trimpath -ldflags="-s -w" -o /admin-guard ./cmd/admin-guard
|
|
|
|
FROM alpine:${ALPINE_VERSION}
|
|
LABEL maintainer="[email protected]"
|
|
RUN apk upgrade --no-cache && \
|
|
apk add --no-cache ca-certificates tzdata wget && \
|
|
adduser -u 1000 -S -D -H guard
|
|
COPY --from=builder /admin-guard /usr/bin/admin-guard
|
|
USER 1000
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD wget -qO- http://localhost:8080/__guard/healthz || exit 1
|
|
ENTRYPOINT ["/usr/bin/admin-guard"]
|