47f295d864
Some checks failed
validate / JSON Schema (ajv) (push) Successful in 19s
build-images / signing-service image (push) Failing after 24s
validate / Go (vet + test) (push) Failing after 5s
validate / Rego (opa fmt + opa test) (push) Successful in 13s
validate / DB (migrate up/down dry-run) (push) Failing after 20s
signing-service depends on github.com/open-policy-agent/opa v1.21.4,
which requires Go >= 1.26.0. The CI Go image and the signing-service
Dockerfile were still pinned to golang:1.23-alpine3.21, so the
"Go (vet + test)" job and the signing-service image build both
failed on main as soon as [DEV-609](/DEV/issues/DEV-609) landed:
go: module ../signing-service requires go >= 1.26.0
(running go 1.23.12; GOTOOLCHAIN=local)
Fix: pin both to golang:1.26-alpine3.23 (oldest alpine tag that
exists for the 1.26 line). All other modules declare go 1.23 which
1.26 still accepts, so no downstream churn.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
47 lines
1.7 KiB
Docker
47 lines
1.7 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------- build ----------
|
|
# Pinned to 1.26 because this module depends on
|
|
# github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
|
|
FROM golang:1.26-alpine3.23 AS build
|
|
|
|
ENV CGO_ENABLED=0 \
|
|
GOOS=linux \
|
|
GOFLAGS="-trimpath"
|
|
|
|
WORKDIR /src
|
|
|
|
# The image reproduces the repo layout under /src so Go module paths and
|
|
# the OPA policy's relative location (`../../../../policies/sinks/...`
|
|
# in tests) line up both in CI and inside the image.
|
|
COPY services/signing-service/go.mod services/signing-service/go.sum ./services/signing-service/
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
cd services/signing-service && go mod download
|
|
|
|
COPY services/signing-service/ ./services/signing-service/
|
|
# The OPA Rego policy ships with the image for dev / smoke runs. GitOps
|
|
# mounts it from a ConfigMap at /etc/signing-service/policies at runtime
|
|
# and wins over the baked-in copy.
|
|
COPY policies/sinks/signing_service.rego ./policies/sinks/signing_service.rego
|
|
|
|
WORKDIR /src/services/signing-service
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
go vet ./... && \
|
|
go test ./... && \
|
|
go build -ldflags="-s -w" -o /out/signing-service ./cmd/signing-service
|
|
|
|
# ---------- runtime ----------
|
|
# Distroless static+nonroot: no shell, no package manager, UID/GID 65532.
|
|
# gcr.io/distroless/static-debian12:nonroot pins to the latest nonroot
|
|
# variant; CI tags images by git sha so this is reproducible at the point
|
|
# of build.
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
COPY --from=build /out/signing-service /signing-service
|
|
|
|
USER 65532:65532
|
|
EXPOSE 8081
|
|
ENTRYPOINT ["/signing-service"]
|
|
CMD ["-listen=:8081", "-backend=memory"]
|