mirror of
https://github.com/BigBodyCobain/Shadowbroker.git
synced 2026-05-25 16:47:52 +02:00
anoracleofra-code
39cc5d2e7c
The MLS gate encryption system requires libprivacy_core.so — a Rust shared library that was only compiled locally on the dev machine. Docker users got "active gate identity is not mapped into the MLS group" because the library was never built or included in the image. Add a multi-stage Docker build: - Stage 1: rust:1.87-slim-bookworm compiles privacy-core to .so - Stage 2: copies libprivacy_core.so into the Python backend image - Set PRIVACY_CORE_LIB env var so Python finds the library Also track the privacy-core Rust source (Cargo.toml, Cargo.lock, src/lib.rs) in git — they were previously untracked, which is why the Docker build never had access to them. Add root .dockerignore to exclude build caches and large directories from the Docker build context.
71 lines
2.3 KiB
Docker
71 lines
2.3 KiB
Docker
# ---- Stage 1: Compile privacy-core Rust library ----
|
|
FROM rust:1.87-slim-bookworm AS rust-builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
pkg-config libssl-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY privacy-core /build/privacy-core
|
|
WORKDIR /build/privacy-core
|
|
RUN cargo build --release --lib \
|
|
&& ls -la target/release/libprivacy_core.so
|
|
|
|
# ---- Stage 2: Python backend ----
|
|
FROM python:3.11-slim-bookworm
|
|
|
|
WORKDIR /app
|
|
|
|
# Install Node.js (for AIS WebSocket proxy) and curl (for network fallback)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
&& curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install UV for fast, reproducible Python dependency management
|
|
ADD https://astral.sh/uv/install.sh /uv-installer.sh
|
|
RUN sh /uv-installer.sh && rm /uv-installer.sh
|
|
ENV PATH="/root/.local/bin:$PATH"
|
|
# Install into system Python (no venv needed inside container)
|
|
ENV UV_PROJECT_ENVIRONMENT=/usr/local
|
|
|
|
# Copy workspace root files for UV resolution (build context is repo root)
|
|
COPY pyproject.toml /workspace/pyproject.toml
|
|
COPY uv.lock /workspace/uv.lock
|
|
COPY backend/pyproject.toml /workspace/backend/pyproject.toml
|
|
|
|
# Install Python dependencies using the lockfile
|
|
RUN cd /workspace/backend && uv sync --frozen --no-dev \
|
|
&& playwright install --with-deps chromium
|
|
|
|
# Copy backend source code
|
|
COPY backend/ .
|
|
|
|
# Install Node.js dependencies (ws module for AIS WebSocket proxy)
|
|
COPY backend/package*.json ./
|
|
RUN npm ci --omit=dev
|
|
|
|
# Clean up workspace scaffold
|
|
RUN rm -rf /workspace
|
|
|
|
# Copy compiled privacy-core library from Rust builder stage
|
|
COPY --from=rust-builder /build/privacy-core/target/release/libprivacy_core.so /app/libprivacy_core.so
|
|
ENV PRIVACY_CORE_LIB=/app/libprivacy_core.so
|
|
|
|
# Create a non-root user for security
|
|
# Grant write access to /app so the auto-updater can extract files
|
|
# Pre-create /app/data so mounted volumes inherit correct ownership
|
|
RUN adduser --system --uid 1001 backenduser \
|
|
&& mkdir -p /app/data \
|
|
&& chown -R backenduser /app \
|
|
&& chmod -R u+w /app
|
|
|
|
# Switch to the non-root user
|
|
USER backenduser
|
|
|
|
# Expose port
|
|
EXPOSE 8000
|
|
|
|
# Start FastAPI server
|
|
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--timeout-keep-alive", "120"]
|