thomas/multiarch-docker-images
1
0
Fork 0
mirror of https://github.com/napnap75/multiarch-docker-images.git synced 2026-11-12 00:52:11 +01:00
Code Issues Projects Releases Wiki Activity

archivist: scratch runtime Dockerfile (static binary only, non-root, CA bundle + tzdata); .dockerignore; README build section; arch.md packaging; fix ARCHIVIST_HTTP_ADDR doc row

Browse Source
This commit is contained in:
thomas
2026-11-02 13:28:50 +01:00
parent 233c153072
commit 7829d73cd4
4 changed files with 66 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
archivist/arch.md
+7
View File
@@ -257,4 +257,11 @@ The scenarios form one narrative; each subtest names the US it proves:
The gate is a regression detector for dependency upgrades (PocketBase, minio-go, ledongthuc/pdf, expr, Garage), not an acceptance proof: acceptance criteria are reviewed on the stories themselves. `E2E_KEEP=1` leaves the containers running after the run for debugging.
## 11. Packaging
`Dockerfile`, two-stage build:
- Builder: `golang:1.23-alpine`, CGO disabled, static binary, `TARGETARCH` honored for multi-platform builds under buildx. `go mod tidy` runs there because `go.sum` is not committed; once it is committed, the line becomes `go mod download` for fully reproducible builds.
- Runtime: `scratch` with only the `/archivist` binary, the CA bundle (the S3 endpoint is HTTPS by default), the timezone database (the cron and date rendering honor `TZ`), and `/app/pb_data` + `/tmp`, the only writable directories, owned by the unprivileged runtime user 65532. `config.jsonc` is never baked in: it is mounted at runtime, `ARCHIVIST_CONFIG` defaulting to `config.jsonc` relative to `/app`.
The container runs as 65532:65532 (non-root), exposes 8090, declares `/app/pb_data` as a volume, and has no shell: `docker exec` is not available. `.dockerignore` keeps the build context to the Go sources; the E2E harness is not part of the image.