cgalo5758
8e7e0dd04d
Run Docker runtime stage as non-root user app (UID 65532). Add styled full-page 404/500 error rendering for navigation requests while preserving plain-text responses for HTMX partials. Reuse recent unconsumed OIDC login state to avoid state mismatch on parallel login hits, and merge resource_access in role extraction. Re-level template headings, add autocomplete tokens, and resolve catalog resource display names. Self-label test-stack secrets and document CSRF secret rotation.
47 lines
928 B
Docker
47 lines
928 B
Docker
# Build stage
|
|
FROM golang:1.24-alpine AS builder
|
|
|
|
# Install build dependencies
|
|
RUN apk add --no-cache gcc musl-dev
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy go.mod and go.sum files
|
|
COPY go.mod go.sum ./
|
|
|
|
# Download dependencies
|
|
RUN go mod download
|
|
|
|
# Copy the source code
|
|
COPY . .
|
|
|
|
# Build the application
|
|
RUN CGO_ENABLED=1 GOOS=linux go build -a -tags musl -o member-console .
|
|
|
|
# Runtime stage
|
|
FROM alpine:latest
|
|
|
|
# Run as a dedicated non-root user; port 8080 is unprivileged and the app
|
|
# performs no runtime filesystem writes, so no ownership setup is needed.
|
|
RUN adduser -D -H -u 65532 app
|
|
|
|
# Set the working directory
|
|
WORKDIR /app
|
|
|
|
# Copy the binary from the builder stage
|
|
COPY --from=builder /app/member-console .
|
|
|
|
USER app
|
|
|
|
# Set environment variables
|
|
ENV PORT=8080 \
|
|
ENV=production
|
|
|
|
# Expose the port the app runs on
|
|
EXPOSE 8080
|
|
|
|
# Command to run the application
|
|
ENTRYPOINT ["/app/member-console"]
|
|
CMD ["start"]
|