mirror of
https://github.com/luxfi/broker.git
synced 2026-09-24 00:25:18 +00:00
zeekay
7275d47c8d
The Dockerfile set GOPRIVATE=luxfi/*,hanzoai/* which routes module fetches 'direct' (git) and bypasses sum.golang.org. luxfi/hanzoai Go modules are all PUBLIC; after a tag was force-republished, the git tag content diverged from the immutable proxy/sumdb hash — so 'go mod download' fetched bits that no longer matched the canonical, sumdb-correct go.sum, failing image builds with SECURITY ERROR checksum mismatch. Dropping GOPRIVATE resolves these modules through the default public proxy + sumdb, yielding the canonical immutable hash that matches go.sum and that a re-publish can no longer break. GITHUB_TOKEN insteadOf stays for the direct fallback. go.sum re-tidied against the public sumdb is byte-identical (already canonical); only the Dockerfile changes.
26 lines
780 B
Docker
26 lines
780 B
Docker
# syntax=docker/dockerfile:1
|
|
FROM golang:1.26.4-alpine AS builder
|
|
|
|
RUN apk add --no-cache git ca-certificates
|
|
|
|
ARG GITHUB_TOKEN
|
|
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
|
|
# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
|
|
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o brokerd ./cmd/brokerd/
|
|
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates
|
|
COPY --from=builder /app/brokerd /usr/local/bin/brokerd
|
|
EXPOSE 8090 9090
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:8090/healthz || exit 1
|
|
|
|
ENTRYPOINT ["brokerd"]
|