1241c1ef01
Server becomes self-contained: web/dist embedded via go:embed (server/internal/webui), SPA served from the binary with JSON-404 guard on /api paths, nginx web container removed from compose (31336 now maps to the server). Clean checkouts without the UI copy build API-only. Agent local API gains its first write endpoint, POST /v1/actions/trigger-scan (FEAT-002 write path): group-ACL authorized, single-flight, 202/409/503 semantics. Registered agents run the same HandleScanUpdates path as a signed scan command (empty command_id, no ack tracking); standalone agents scan through the orchestrator into the local read model only. Also repairs localapi tests left uncompilable by the desktop-provider parameter.
155 lines
No EOL
4.9 KiB
Docker
155 lines
No EOL
4.9 KiB
Docker
# Stage 0: Build the web dashboard for embedding into the server binary
|
|
FROM node:20-alpine AS web-builder
|
|
|
|
WORKDIR /web
|
|
|
|
COPY web/package.json web/package-lock.json ./
|
|
RUN npm ci --ignore-scripts
|
|
|
|
COPY web/ ./
|
|
RUN npx vite build
|
|
|
|
# Stage 1: Build server binary
|
|
FROM golang:1.25-alpine AS server-builder
|
|
|
|
ARG BUILD_VERSION=dev
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy go.mod and go.sum
|
|
COPY server/go.mod server/go.sum ./
|
|
RUN go mod download
|
|
|
|
# Copy server contents to /app
|
|
COPY server/ ./
|
|
|
|
# Embed the dashboard build — server/internal/webui picks this up via go:embed
|
|
COPY --from=web-builder /web/dist ./internal/webui/dist
|
|
|
|
# Build server with version injection
|
|
RUN echo "Building server version: $BUILD_VERSION" && \
|
|
CGO_ENABLED=0 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/server/internal/version.AgentVersion=$BUILD_VERSION" \
|
|
-o redflag-server cmd/server/main.go
|
|
|
|
# Stage 2: Build agent binaries for all platforms
|
|
FROM golang:1.25-alpine AS agent-builder
|
|
|
|
ARG BUILD_VERSION=dev
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy agent source code
|
|
COPY agent/ ./
|
|
|
|
# Build for Linux amd64
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/linux-amd64/redflag-agent ./cmd/agent
|
|
|
|
# Build for Linux arm64
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/linux-arm64/redflag-agent ./cmd/agent
|
|
|
|
# Build for macOS amd64
|
|
RUN CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/darwin-amd64/redflag-agent ./cmd/agent
|
|
|
|
# Build for macOS arm64
|
|
RUN CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/darwin-arm64/redflag-agent ./cmd/agent
|
|
|
|
# Build for Windows amd64
|
|
RUN CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/windows-amd64/redflag-agent.exe ./cmd/agent
|
|
|
|
# Build for Windows arm64
|
|
RUN CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/windows-arm64/redflag-agent.exe ./cmd/agent
|
|
|
|
# Stage 2b: Build the Rust capability-gate executor (redflag-helper)
|
|
FROM rust:1-alpine AS helper-builder
|
|
|
|
WORKDIR /helper
|
|
|
|
# musl-dev provides the C runtime cargo links against on alpine.
|
|
RUN apk --no-cache add musl-dev
|
|
|
|
# Copy helper crate and build a static release binary. ed25519-dalek/sha2/serde
|
|
# are pure Rust, so the default x86_64-unknown-linux-musl target builds clean.
|
|
COPY helper/ ./
|
|
RUN cargo build --release && \
|
|
mkdir -p /out/helper-linux-amd64 && \
|
|
cp target/release/redflag-helper /out/helper-linux-amd64/redflag-helper
|
|
|
|
# Stage 2c: Build the Tauri desktop app (system tray + local UI)
|
|
FROM rust:1-bookworm AS desktop-builder
|
|
|
|
ARG BUILD_VERSION=dev
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
nodejs npm \
|
|
libwebkit2gtk-4.1-dev \
|
|
libjavascriptcoregtk-4.1-dev \
|
|
libappindicator3-dev \
|
|
librsvg2-dev \
|
|
libgtk-3-dev \
|
|
libsoup-3.0-dev \
|
|
libglib2.0-dev \
|
|
pkg-config \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy web frontend source and build the desktop variant
|
|
COPY web/package.json web/package-lock.json web/
|
|
RUN cd web && npm ci --ignore-scripts
|
|
|
|
COPY web/ web/
|
|
RUN cd web && npm run build:desktop
|
|
|
|
# Copy desktop Tauri source
|
|
COPY desktop/ desktop/
|
|
|
|
# Build the Tauri app in release mode
|
|
RUN cd desktop && cargo build --release && \
|
|
mkdir -p /out && \
|
|
cp target/release/redflag-desktop /out/redflag-desktop
|
|
|
|
# Stage 3: Final image with server and all agent binaries
|
|
FROM alpine:3.21
|
|
|
|
RUN apk --no-cache add ca-certificates tzdata bash
|
|
WORKDIR /app
|
|
|
|
# Copy server binary
|
|
COPY --from=server-builder /app/redflag-server .
|
|
COPY --from=server-builder /app/internal/database ./internal/database
|
|
|
|
# Copy all agent binaries
|
|
COPY --from=agent-builder /build/binaries ./binaries
|
|
|
|
# Copy the signed-at-startup capability-gate executor alongside the agent
|
|
# binaries so BuildOrchestrator.SignExistingBinary can find it at
|
|
# binaries/helper-linux-amd64/redflag-helper.
|
|
COPY --from=helper-builder /out/helper-linux-amd64 ./binaries/helper-linux-amd64
|
|
|
|
# Copy the Tauri desktop app (system tray + local UI shell)
|
|
COPY --from=desktop-builder /out/redflag-desktop ./binaries/linux-amd64/redflag-desktop
|
|
|
|
# Copy and setup entrypoint script
|
|
COPY server/docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:8080/api/health || exit 1
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["./redflag-server"] |