24 lines
832 B
Docker
24 lines
832 B
Docker
# review-bot — static Go binary in a FROM-scratch image.
|
|
#
|
|
# Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
|
|
# (the binary has no shell and no package manager to patch or to exec).
|
|
FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS build
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY *.go prompt.md ./
|
|
|
|
RUN go vet ./... \
|
|
&& CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /review-bot .
|
|
|
|
FROM scratch
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=build /review-bot /review-bot
|
|
|
|
# Matches runAsUser in the Deployment. There is no /etc/passwd in a scratch image, so this is a
|
|
# bare uid by necessity.
|
|
USER 65534:65534
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/review-bot"]
|