nilsandClaude Opus 5.5
acb7e1969e
The update relay logs every check (car, number of releases, newest pre-release) and every download (car, file, size, then bytes and time, or that it was cut short); never the forge's address or token, tested. Go 1.27.3 for the build image and toolchain: govulncheck had found GO-2026-6809 in crypto/x509 under 1.26.9; source and binary now clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6
17 lines
569 B
Docker
17 lines
569 B
Docker
# The car server: one static Go binary on distroless, running as non-root.
|
|
# Configuration comes from the environment at runtime; nothing secret is baked in.
|
|
|
|
FROM docker.io/library/golang:1.27.3-alpine AS build
|
|
WORKDIR /src
|
|
ENV CGO_ENABLED=0 GOFLAGS=-trimpath GOTOOLCHAIN=local
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download && go mod verify
|
|
COPY *.go ./
|
|
RUN go vet ./... && go test ./... && go build -ldflags="-s -w" -o /out/server .
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
COPY --from=build /out/server /server
|
|
USER 65532:65532
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/server"]
|