mirror/inv_sig_helper
1
0
Fork 0
mirror of https://github.com/iv-org/inv_sig_helper.git synced 2025-01-27 05:34:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
inv_sig_helper/docker-compose.yaml

21 lines
433 B
YAML
Raw Normal View History

Add Docker support and update README (#13) * add compose.yaml * add Dockerfile * update README * Dockerfile: uncomment CMD instruction * add .dockerignore * Dockerfile: use scratch image for second stage * Dockerfile: use newer OpenSSL version (3.0.9) * Dockerfile: use Alpine-based Rust image to skip building OpenSSL * Dockerfile: expose to localhost only by default * Dockerfile: allow building for different architectures (AMD64 and ARM64) Dockerfile now detects the architecture being used during the build process and templates in the correct Rust target architecture * compose.yaml: include command line * compose.yaml: listen on 127.0.0.1 only * compose.yaml: remove healthcheck due to using scratch image * README.md: restore old table format * rename compose.yaml to docker-compose.yml * docker-compose.yml: include version line * update .dockerignore * README.md: update Docker instructions to expose only on localhost * add workflow to build and push container images to quay.io * docker-compose.yml: harden configuration * docker workflow: add paths-ignore section * Dockerfile: let Rustup handle architecture detection More flexible as the build process will now automatically adapt to whatever architecture the container is being built on, without needing to explicitly list out each supported architecture * Docker: further security hardening - Run as a non-privileged user within the scratch container - Add security_opt: - no-new-privileges:true to docker-compose.yml * Dockerfile: Switch to Debian-based images and simplify build command - rust:1.80-alpine replaced with rust:1.80 for the builder stage - alpine:3.20 replaced with debian:12.6-slim for the user-stage - Build command simplified to use default target architecture * Cargo.toml: correct note on optimisations * docker-compose.yml: use quay.io image by default * rename docker-compose.yml to docker-compose.yaml * compose: build image from local repo by default * Revert "Dockerfile: Switch to Debian-based images and simplify build command" This reverts commit ff9a37856463062f31af2d1aa00a87dc23bedb6c. Reasons for reverting: 1. Compiling via musl is necessary to statically link dependencies and create a truly standalone Rust binary. [1] 2. Alpine-based Rust images are required for the build stage because such systems support dynamic linking, which is also needed for statically-linked binaries. [2] 3. Determining the target architecture and templating the correct value for the --target flag is necessary for the statically-linked binary to be built correctly. [2] [1]: https://doc.rust-lang.org/1.13.0/book/advanced-linking.html#linux [2]: https://github.com/rust-lang/rust/issues/40174#issuecomment-538791091
2024-08-14 20:58:44 +10:00
version: "3"
services:
inv_sig_helper:
build:
context: .
dockerfile: Dockerfile
# image: quay.io/invidious/inv-sig-helper:latest
Use Docker's builtin tini process, to run as PID 1 and handle SIGTERMs/SIGINTs Fixes #20
2024-08-17 18:04:20 +01:00
init: true
Add Docker support and update README (#13) * add compose.yaml * add Dockerfile * update README * Dockerfile: uncomment CMD instruction * add .dockerignore * Dockerfile: use scratch image for second stage * Dockerfile: use newer OpenSSL version (3.0.9) * Dockerfile: use Alpine-based Rust image to skip building OpenSSL * Dockerfile: expose to localhost only by default * Dockerfile: allow building for different architectures (AMD64 and ARM64) Dockerfile now detects the architecture being used during the build process and templates in the correct Rust target architecture * compose.yaml: include command line * compose.yaml: listen on 127.0.0.1 only * compose.yaml: remove healthcheck due to using scratch image * README.md: restore old table format * rename compose.yaml to docker-compose.yml * docker-compose.yml: include version line * update .dockerignore * README.md: update Docker instructions to expose only on localhost * add workflow to build and push container images to quay.io * docker-compose.yml: harden configuration * docker workflow: add paths-ignore section * Dockerfile: let Rustup handle architecture detection More flexible as the build process will now automatically adapt to whatever architecture the container is being built on, without needing to explicitly list out each supported architecture * Docker: further security hardening - Run as a non-privileged user within the scratch container - Add security_opt: - no-new-privileges:true to docker-compose.yml * Dockerfile: Switch to Debian-based images and simplify build command - rust:1.80-alpine replaced with rust:1.80 for the builder stage - alpine:3.20 replaced with debian:12.6-slim for the user-stage - Build command simplified to use default target architecture * Cargo.toml: correct note on optimisations * docker-compose.yml: use quay.io image by default * rename docker-compose.yml to docker-compose.yaml * compose: build image from local repo by default * Revert "Dockerfile: Switch to Debian-based images and simplify build command" This reverts commit ff9a37856463062f31af2d1aa00a87dc23bedb6c. Reasons for reverting: 1. Compiling via musl is necessary to statically link dependencies and create a truly standalone Rust binary. [1] 2. Alpine-based Rust images are required for the build stage because such systems support dynamic linking, which is also needed for statically-linked binaries. [2] 3. Determining the target architecture and templating the correct value for the --target flag is necessary for the statically-linked binary to be built correctly. [2] [1]: https://doc.rust-lang.org/1.13.0/book/advanced-linking.html#linux [2]: https://github.com/rust-lang/rust/issues/40174#issuecomment-538791091
2024-08-14 20:58:44 +10:00
command: ["--tcp", "127.0.0.1:12999"]
ports:
- 127.0.0.1:12999:12999
environment:
- RUST_LOG=info
restart: unless-stopped
cap_drop:
- ALL
read_only: true
user: 10001:10001
security_opt:
- no-new-privileges:true
Reference in a new issue Copy permalink