From d8c86b4c99cf8699f214bd1afd9332a56d713306 Mon Sep 17 00:00:00 2001 From: Jim Clark Date: Wed, 9 Aug 2023 23:10:57 -0700 Subject: [PATCH] Slim/flake (#16) * flake plus docker cli metadata --- .dockerignore | 33 +++++++++++- Dockerfile.init | 72 ++++++++++++++++++++++++++ Dockerfile.nix | 28 ++++++++++ dev/user.clj | 16 +++--- docker/ops.go | 11 ++++ flake.lock | 133 +++++++++++++++++++++++++++++++++++++++--------- flake.nix | 69 +++++-------------------- main.go | 53 ++++++++++++------- 8 files changed, 310 insertions(+), 105 deletions(-) create mode 100644 Dockerfile.init create mode 100644 Dockerfile.nix diff --git a/.dockerignore b/.dockerignore index fdfdf9c..3aae539 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1 +1,32 @@ -pod-atomisthq-tools.docker +# Include any files or directories that you don't want to be copied to your +# container here (e.g., local build artifacts, temporary files, etc.). +# +# For more help, visit the .dockerignore file reference guide at +# https://docs.docker.com/engine/reference/builder/#dockerignore-file + +**/.DS_Store +**/.classpath +**/.dockerignore +**/.env +**/.git +**/.gitignore +**/.project +**/.settings +**/.toolstarget +**/.vs +**/.vscode +**/*.*proj.user +**/*.dbmdl +**/*.jfm +**/bin +**/charts +**/docker-compose* +**/compose* +**/Dockerfile* +**/node_modules +**/npm-debug.log +**/obj +**/secrets.dev.yaml +**/values.dev.yaml +LICENSE +README.md diff --git a/Dockerfile.init b/Dockerfile.init new file mode 100644 index 0000000..ee44b16 --- /dev/null +++ b/Dockerfile.init @@ -0,0 +1,72 @@ +# syntax=docker/dockerfile:1 + +# Comments are provided throughout this file to help you get started. +# If you need more help, visit the Dockerfile reference guide at +# https://docs.docker.com/engine/reference/builder/ + +################################################################################ +# Create a stage for building the application. +ARG GO_VERSION=1.19 +FROM golang:${GO_VERSION} AS build +WORKDIR /src + +# Download dependencies as a separate step to take advantage of Docker's caching. +# Leverage a cache mount to /go/pkg/mod/ to speed up subsequent builds. +# Leverage bind mounts to go.sum and go.mod to avoid having to copy them into +# the container. +RUN --mount=type=cache,target=/go/pkg/mod/ \ + --mount=type=bind,source=go.sum,target=go.sum \ + --mount=type=bind,source=go.mod,target=go.mod \ + go mod download -x + +# Build the application. +# Leverage a cache mount to /go/pkg/mod/ to speed up subsequent builds. +# Leverage a bind mount to the current directory to avoid having to copy the +# source code into the container. +RUN --mount=type=cache,target=/go/pkg/mod/ \ + --mount=type=bind,target=. \ + CGO_ENABLED=0 go build -o /bin/server . + +################################################################################ +# Create a new stage for running the application that contains the minimal +# runtime dependencies for the application. This often uses a different base +# image from the build stage where the necessary files are copied from the build +# stage. +# +# The example below uses the alpine image as the foundation for running the app. +# By specifying the "latest" tag, it will also use whatever happens to be the +# most recent version of that image when you build your Dockerfile. If +# reproducability is important, consider using a versioned tag +# (e.g., alpine:3.17.2) or SHA (e.g., alpine:sha256:c41ab5c992deb4fe7e5da09f67a8804a46bd0592bfdf0b1847dde0e0889d2bff). +FROM alpine:latest AS final + +# Install any runtime dependencies that are needed to run your application. +# Leverage a cache mount to /var/cache/apk/ to speed up subsequent builds. +RUN --mount=type=cache,target=/var/cache/apk \ + apk --update add \ + ca-certificates \ + tzdata \ + && \ + update-ca-certificates + +# Create a non-privileged user that the app will run under. +# See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user +ARG UID=10001 +RUN adduser \ + --disabled-password \ + --gecos "" \ + --home "/nonexistent" \ + --shell "/sbin/nologin" \ + --no-create-home \ + --uid "${UID}" \ + appuser +USER appuser + +# Copy the executable from the "build" stage. +COPY --from=build /bin/server /bin/ + +# Expose the port that the application listens on. +EXPOSE 3000 + +# What the container should run when it is started. +ENTRYPOINT [ "/bin/server" ] diff --git a/Dockerfile.nix b/Dockerfile.nix new file mode 100644 index 0000000..692bfe1 --- /dev/null +++ b/Dockerfile.nix @@ -0,0 +1,28 @@ +# syntax = docker/dockerfile:1.4 +FROM nixos/nix:latest AS builder + +WORKDIR /tmp/build +RUN mkdir /tmp/nix-store-closure + +RUN \ + --mount=type=cache,target=/nix,from=nixos/nix:latest,source=/nix \ + --mount=type=cache,target=/root/.cache \ + --mount=type=bind,target=/tmp/build \ + <