mirror of
https://github.com/Control-D-Inc/ctrld.git
synced 2026-10-24 14:08:27 +02:00
Dev Scribe
9562717ec5
govulncheck reports reachable x/net HTTP/2 vulnerabilities GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603, all fixed in golang.org/x/net v0.60.0. x/net v0.60.0 requires go 1.26, so the go directive moves to 1.26.0. x/net v0.60.0 deprecates http2.ConfigureTransports and the http2.Transport ReadIdleTimeout/PingTimeout fields (staticcheck SA1019). Configure the same DoH HTTP/2 health check through http.Transport.HTTP2: SendPingTimeout 10s and PingTimeout 5s. Add a test that silences an HTTP/2 peer and requires the transport to close the connection.
43 lines
1.4 KiB
Docker
43 lines
1.4 KiB
Docker
# Using Debian bookworm for building regular image.
|
|
# Using scratch image for minimal image size.
|
|
# The final image has:
|
|
#
|
|
# - Timezone info file.
|
|
# - CA certs file.
|
|
# - /etc/{passwd,group} file.
|
|
# - Non-cgo ctrld-client binary.
|
|
#
|
|
# CI_COMMIT_TAG is used to set the version of the ctrld-client binary.
|
|
FROM golang:1.27-bookworm AS base
|
|
|
|
WORKDIR /app
|
|
|
|
RUN echo "deb http://deb.debian.org/debian bookworm-backports main" | tee /etc/apt/sources.list.d/backports.list
|
|
RUN apt update && apt install -t bookworm-backports upx-ucl
|
|
|
|
COPY . .
|
|
|
|
ARG tag=master
|
|
ENV CI_COMMIT_TAG=$tag
|
|
RUN CTRLD_NO_QF=yes CGO_ENABLED=0 ./scripts/build.sh
|
|
|
|
# Resolve the arch-suffixed build artifact to one fixed path, and fail the build
|
|
# if it is not there. A COPY glob that matches nothing does not reliably fail,
|
|
# which is how a rename can produce an image whose ENTRYPOINT names a binary the
|
|
# image does not contain.
|
|
RUN set -eu; \
|
|
set -- ctrld-client-linux-*-nocgo; \
|
|
[ "$#" -eq 1 ] && [ -x "$1" ] || { echo >&2 "no single executable build artifact: $*"; exit 1; }; \
|
|
mv -- "$1" /ctrld-client
|
|
|
|
FROM alpine
|
|
|
|
COPY --from=base /usr/share/zoneinfo /usr/share/zoneinfo
|
|
COPY --from=base /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
COPY --from=base /etc/passwd /etc/passwd
|
|
COPY --from=base /etc/group /etc/group
|
|
|
|
COPY --from=base /ctrld-client ctrld-client
|
|
|
|
ENTRYPOINT ["./ctrld-client", "run"]
|