52 lines
1.9 KiB
Docker
52 lines
1.9 KiB
Docker
# Multi-stage container build for harmony-fleet-agent.
|
|
#
|
|
# Build context is the workspace root (the agent's Cargo.toml has
|
|
# `path = "../../harmony"` deps that only resolve when the whole
|
|
# workspace is in scope). Invoke from the repo root:
|
|
#
|
|
# docker build -f fleet/harmony-fleet-agent/Dockerfile \
|
|
# -t hub.nationtech.io/harmony/harmony-fleet-agent:<tag> .
|
|
#
|
|
# Both stages are pinned to bookworm for a matched glibc — the
|
|
# rust:slim image follows Debian's latest stable, and a binary built
|
|
# against trixie's glibc 2.40 fails to start on a bookworm runtime
|
|
# (`GLIBC_2.39 not found`). This is the same lesson the operator
|
|
# Dockerfile encodes; keep the two pinned to the same Debian release.
|
|
#
|
|
# The e2e harness uses a faster host-build + single-stage path
|
|
# (`fleet/harmony-fleet-e2e/src/images.rs`); this Dockerfile is the
|
|
# canonical recipe for production registries.
|
|
|
|
FROM docker.io/rust:1.94-slim-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
pkg-config \
|
|
ca-certificates \
|
|
libssl-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
COPY . .
|
|
|
|
RUN cargo build --release --locked -p harmony-fleet-agent
|
|
|
|
FROM docker.io/library/debian:bookworm-slim
|
|
|
|
# ca-certificates: outbound TLS to NATS over wss:// when the agent is
|
|
# configured against a TLS-terminated NATS endpoint. kube-rs is not
|
|
# used at runtime on the agent; async-nats uses rustls.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /app/target/release/harmony-fleet-agent /usr/local/bin/harmony-fleet-agent
|
|
|
|
RUN install -d -o 65532 -g 65532 -m 0700 /run/harmony-fleet-agent
|
|
|
|
# Non-root runtime. 65532 is the `nonroot` UID convention from
|
|
# distroless. Pairs with `securityContext.runAsNonRoot: true` in
|
|
# whatever Pod spec the harness or production helm chart applies.
|
|
USER 65532:65532
|
|
|
|
ENTRYPOINT ["/usr/local/bin/harmony-fleet-agent"]
|