c0a717ab26
- README: version v0.2.6.8, corrected stale gate claim, updated changelog - .env.example: merged two competing files into one, deleted bootstrap duplicate - ErrorBoundary: new component wrapping app, prevents white-screen crashes - Layout sidebar: version display from /api/health, Docs link to GitHub - client-logger: debug/trace logger gated behind localStorage.redflag_debug=1, routes through existing /logs/client-error server endpoint (ETHOS #1) - All web console.log calls rerouted through client-logger instead of deleted - Server health endpoint returns version field - Server accepts client_debug/client_trace in error_type validation - Dockerfiles: pinned alpine:latest->3.21, nginx:alpine->1.27-alpine, added HEALTHCHECK directives - docker-compose: healthcheck blocks for server and web services - .dockerignore: created to slim Docker build context
104 lines
No EOL
3.6 KiB
Docker
104 lines
No EOL
3.6 KiB
Docker
# Stage 1: Build server binary
|
|
FROM golang:1.25-alpine AS server-builder
|
|
|
|
ARG BUILD_VERSION=dev
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy go.mod and go.sum
|
|
COPY server/go.mod server/go.sum ./
|
|
RUN go mod download
|
|
|
|
# Copy server contents to /app
|
|
COPY server/ ./
|
|
|
|
# Build server with version injection
|
|
RUN echo "Building server version: $BUILD_VERSION" && \
|
|
CGO_ENABLED=0 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/server/internal/version.AgentVersion=$BUILD_VERSION" \
|
|
-o redflag-server cmd/server/main.go
|
|
|
|
# Stage 2: Build agent binaries for all platforms
|
|
FROM golang:1.25-alpine AS agent-builder
|
|
|
|
ARG BUILD_VERSION=dev
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy agent source code
|
|
COPY agent/ ./
|
|
|
|
# Build for Linux amd64
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/linux-amd64/redflag-agent ./cmd/agent
|
|
|
|
# Build for Linux arm64
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/linux-arm64/redflag-agent ./cmd/agent
|
|
|
|
# Build for macOS amd64
|
|
RUN CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/darwin-amd64/redflag-agent ./cmd/agent
|
|
|
|
# Build for macOS arm64
|
|
RUN CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/darwin-arm64/redflag-agent ./cmd/agent
|
|
|
|
# Build for Windows amd64
|
|
RUN CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/windows-amd64/redflag-agent.exe ./cmd/agent
|
|
|
|
# Build for Windows arm64
|
|
RUN CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build \
|
|
-ldflags "-X github.com/Fimeg/RedFlag/agent/internal/version.Version=$BUILD_VERSION" \
|
|
-o binaries/windows-arm64/redflag-agent.exe ./cmd/agent
|
|
|
|
# Stage 2b: Build the Rust capability-gate executor (redflag-helper)
|
|
FROM rust:1-alpine AS helper-builder
|
|
|
|
WORKDIR /helper
|
|
|
|
# musl-dev provides the C runtime cargo links against on alpine.
|
|
RUN apk --no-cache add musl-dev
|
|
|
|
# Copy helper crate and build a static release binary. ed25519-dalek/sha2/serde
|
|
# are pure Rust, so the default x86_64-unknown-linux-musl target builds clean.
|
|
COPY helper/ ./
|
|
RUN cargo build --release && \
|
|
mkdir -p /out/helper-linux-amd64 && \
|
|
cp target/release/redflag-helper /out/helper-linux-amd64/redflag-helper
|
|
|
|
# Stage 3: Final image with server and all agent binaries
|
|
FROM alpine:3.21
|
|
|
|
RUN apk --no-cache add ca-certificates tzdata bash
|
|
WORKDIR /app
|
|
|
|
# Copy server binary
|
|
COPY --from=server-builder /app/redflag-server .
|
|
COPY --from=server-builder /app/internal/database ./internal/database
|
|
|
|
# Copy all agent binaries
|
|
COPY --from=agent-builder /build/binaries ./binaries
|
|
|
|
# Copy the signed-at-startup capability-gate executor alongside the agent
|
|
# binaries so BuildOrchestrator.SignExistingBinary can find it at
|
|
# binaries/helper-linux-amd64/redflag-helper.
|
|
COPY --from=helper-builder /out/helper-linux-amd64 ./binaries/helper-linux-amd64
|
|
|
|
# Copy and setup entrypoint script
|
|
COPY server/docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:8080/api/health || exit 1
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["./redflag-server"] |