mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zooqueen
3b14e17649
Docker Build & Push (Reusable) / create-manifest (push) Blocked by required conditions
Docker Build & Push (Reusable) / tag-single-arch (push) Blocked by required conditions
Docker Build & Push (Reusable) / deploy (push) Blocked by required conditions
Docker Build & Push (Reusable) / sbom (push) Blocked by required conditions
Docker Build & Push (Reusable) / build-amd64 (push) Waiting to run
Docker Build & Push (Reusable) / build-arm64 (push) Skipped
Build kms / build (push) Waiting to run
Release / Build binaries (linux/amd64) (push) Waiting to run
Release / GitHub Release (push) Blocked by required conditions
Release / Multi-arch Docker (ghcr.io/hanzoai/kms) (push) Blocked by required conditions
Release / Notify universe (auto-bump pin) (push) Blocked by required conditions
Release / Build binaries (darwin/arm64) (push) Failing after 0s
Release / Build binaries (darwin/amd64) (push) Failing after 0s
Release / Build binaries (linux/arm64) (push) Failing after 0s
Every module in this graph is public and notarized, so `go mod download` resolves through the module proxy and verifies against sum.golang.org. Both Dockerfiles drop the build ARG and the git credential rewrite; the release workflow stops passing a token as a build argument and stops setting GOPRIVATE/GONOSUMDB for the binary matrix. Root go.sum gains the module hashes for the versions MVS selects across the sdk/go replace, which `go build` requires under -mod=readonly.
77 lines
2.7 KiB
Docker
77 lines
2.7 KiB
Docker
# Hanzo KMS — thin wrapper over luxfi/kms.
|
|
#
|
|
# Build is now pure Go (no SQLCipher, no Base, no TS frontend toolchain
|
|
# required). The TS dashboard ships as a static asset built in a separate
|
|
# stage and copied verbatim.
|
|
|
|
FROM ghcr.io/hanzoai/nodejs:v24.18.0 AS frontend
|
|
WORKDIR /src/frontend
|
|
COPY frontend/package.json frontend/pnpm-lock.yaml ./
|
|
RUN corepack enable pnpm && pnpm install --frozen-lockfile
|
|
COPY frontend/ .
|
|
RUN pnpm build
|
|
|
|
FROM golang:1.26-bookworm AS build
|
|
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
# kmsclient is an in-repo module built via a local replace (see go.mod).
|
|
# Stage its go.mod/go.sum so `go mod download` can read the replaced module's
|
|
# graph before the full source tree is copied.
|
|
COPY sdk/go/go.mod sdk/go/go.sum ./sdk/go/
|
|
# Every module in this graph is public. They resolve through the module proxy
|
|
# and verify against the checksum database under the h1: hashes already in
|
|
# go.sum, so this build carries no credential and sets no GOPRIVATE — the
|
|
# checksum database stays authoritative for every dependency.
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
|
|
COPY . .
|
|
|
|
# Per SCALE_STANDARD.md §2 — GOEXPERIMENT=jsonv2 is mandatory in every
|
|
# production Dockerfile that builds Go code emitting JSON to clients.
|
|
# Verified -12% time / -23% allocs on the edge POST roundtrip.
|
|
ARG GO_EXPERIMENT=jsonv2
|
|
ENV GOEXPERIMENT=${GO_EXPERIMENT}
|
|
|
|
# Pure Go build — no CGO required (luxfi/kms uses ZapDB, not SQLCipher).
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-s -w" -o /kmsd ./cmd/kmsd/ && \
|
|
go build -ldflags="-s -w" -o /kms ./cmd/kms/
|
|
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl && \
|
|
rm -rf /var/lib/apt/lists/* && \
|
|
groupadd --system --gid 1000 hanzo && \
|
|
useradd --system --uid 1000 --gid hanzo --home-dir /data/hanzo-kms --shell /sbin/nologin hanzo
|
|
|
|
COPY --from=build /kmsd /usr/local/bin/kmsd
|
|
COPY --from=build /kms /usr/local/bin/kms
|
|
COPY --from=frontend /src/frontend/dist /app/frontend
|
|
|
|
# Hanzo defaults — the binary already defaults to these, env vars only
|
|
# document them for operators inspecting the image.
|
|
ENV KMS_LISTEN=:8443 \
|
|
KMS_ZAP_PORT=9653 \
|
|
KMS_DATA_DIR=/data/hanzo-kms \
|
|
KMS_NODE_ID=hanzo-kms-0 \
|
|
KMS_FRONTEND_DIR=/app/frontend \
|
|
BRAND_NAME=Hanzo
|
|
|
|
RUN mkdir -p /data/hanzo-kms && chown -R hanzo:hanzo /data/hanzo-kms /app/frontend
|
|
|
|
USER 1000
|
|
WORKDIR /data/hanzo-kms
|
|
|
|
EXPOSE 8443 9653
|
|
HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD curl -f http://localhost:8443/healthz || exit 1
|
|
|
|
ENTRYPOINT ["kmsd"]
|