mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-06 08:54:04 +01:00
garrytan
6cbd3e513e
Fixes the qualify-native failures from main run 37345275258: - re-bind promotion evidence for staged runtimes in cold-start tests - give npm a distinct empty global config (npm 11 refuses double-loading) - export /archives and /work through tmpfs-backed local volumes (docker cp cannot read tmpfs), with exec on /work - keep the offline seed process alive - end broker/forwarder tunnels explicitly under Bun - batch gem fetch per platform - wait for run-app's source copy before Rails db:prepare and tests - fix the Python cold fixture and add bin/rails to the Rails cold fixture
13 lines
575 B
Docker
13 lines
575 B
Docker
# BASE_IMAGE must be a reviewed, provenance-verified node image@sha256 digest.
|
|
ARG BASE_IMAGE
|
|
FROM ${BASE_IMAGE}
|
|
RUN mkdir -p /opt/cso /work /metadata /archives /source /policy /fixtures && touch /opt/cso/empty-config /opt/cso/empty-globalconfig \
|
|
&& chown 10001:10001 /work /metadata /archives
|
|
COPY --chmod=0555 entrypoint /opt/cso/entrypoint
|
|
COPY --chmod=0555 run-app /opt/cso/run-app
|
|
COPY --chmod=0555 gstack-cso-verifier /opt/cso/verifier
|
|
COPY --chmod=0555 gstack-cso-preparation /opt/cso/preparation
|
|
USER 10001:10001
|
|
WORKDIR /work
|
|
ENTRYPOINT ["/opt/cso/entrypoint"]
|