74 lines
3.2 KiB
Docker
74 lines
3.2 KiB
Docker
# Multi-binary image for the platform/ catalog wire harnesses.
|
|
#
|
|
# Build context is the platform/ directory. Modules used by the binaries all
|
|
# live under platform/, so a single-tree build is sufficient — no external
|
|
# replace directives needed.
|
|
#
|
|
# Pure Go: cmd/catalog-emit and cmd/event-emit-publisher use only stdlib +
|
|
# github.com/rabbitmq/amqp091-go + git.k6n.net/mats/platform/* internals.
|
|
# No CGO, so we ship a Debian-bookworm-slim runtime with ca-certificates
|
|
# and a timezone DB. The writer (slask-finder) is NOT built here — it lives
|
|
# in its own Dockerfile and has its own ONNX / libtokenizers deps (CGO).
|
|
|
|
# ─── 1. Build stage ────────────────────────────────────────────────────────
|
|
FROM golang:1.26-bookworm AS build-stage
|
|
WORKDIR /app
|
|
ENV CGO_ENABLED=0 GOFLAGS="-trimpath"
|
|
|
|
# Module files first so the dep download caches correctly on rebuild.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# Rest of the source.
|
|
COPY . .
|
|
|
|
ARG TARGETARCH
|
|
ARG BUILDTIME
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-s -w" -o /out/catalog-emit ./cmd/catalog-emit && \
|
|
CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
|
|
go build -ldflags="-s -w" -o /out/event-emit-publisher ./cmd/event-emit-publisher
|
|
|
|
# ─── 2. Runtime stage ────────────────────────────────────────────────────
|
|
FROM debian:bookworm-slim
|
|
|
|
# ca-certificates for TLS-validated RabbitMQ URLs (amqps://).
|
|
# tzdata so time.Now() resolves zones predictably in logs.
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
tzdata && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user, matching the k8s securityContext pattern that
|
|
# 20-data-plane.yaml uses for cart/checkout/profile (runAsUser: 1000).
|
|
# Pick 1010 here to leave 1000 available for future platform pods.
|
|
RUN groupadd --gid 1010 platcat && \
|
|
useradd --uid 1010 --gid platcat \
|
|
--home-dir /home/platcat --create-home \
|
|
--shell /bin/bash platcat
|
|
|
|
# Binaries straight from the build stage.
|
|
COPY --from=build-stage /out/catalog-emit /usr/local/bin/catalog-emit
|
|
COPY --from=build-stage /out/event-emit-publisher /usr/local/bin/event-emit-publisher
|
|
|
|
# Make them owned by platcat so a non-root pod UID can run them.
|
|
RUN chown platcat:platcat /usr/local/bin/catalog-emit \
|
|
/usr/local/bin/event-emit-publisher
|
|
|
|
USER platcat:platcat
|
|
WORKDIR /home/platcat
|
|
|
|
# Healthcheck surfaces what's running; useful for `kubectl describe pod`
|
|
# when watching the projection consumer come up.
|
|
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
|
|
CMD /usr/local/bin/catalog-emit -h >/dev/null 2>&1 || exit 1
|
|
|
|
# Production entrypoint is catalog-emit (the consumer harness); the
|
|
# publisher binary is intentionally a sibling so it's invokeable for
|
|
# smoke tests via `kubectl exec <pod> -- /usr/local/bin/event-emit-publisher ...`.
|
|
# The k8s Deployment (52-catalog-emit.yaml) overrides args with the
|
|
# watch-mode flags + -out-dir pointing at the projection PVC.
|
|
ENTRYPOINT ["/usr/local/bin/catalog-emit"]
|
|
CMD ["-h"]
|