cgalo5758
0b28a9dc29
- Replace gorilla/csrf with net/http CrossOriginProtection - Require valkey-password and add TLS options for session store - End session at /logout and revoke refresh tokens - Re-derive identity and roles from provider every five minutes - Process each Stripe webhook event in its own Temporal workflow - Give each outbox entry its own workflow with Temporal retries - Guard against stale Stripe events with provider timestamps - Derive transport security from base-url scheme
52 lines
1.3 KiB
Docker
52 lines
1.3 KiB
Docker
# Build stage
|
|
# Pinned to a supported Go release. Go 1.23 left the upstream support window,
|
|
# so the image shipped without stdlib security fixes. Flagged by the 2026-09
|
|
# security audit; the project moved to 1.27 in the same pass.
|
|
FROM golang:1.27.1-alpine AS builder
|
|
|
|
# Install build dependencies
|
|
RUN apk add --no-cache gcc musl-dev
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy go.mod and go.sum files
|
|
COPY go.mod go.sum ./
|
|
|
|
# Download dependencies
|
|
RUN go mod download
|
|
|
|
# Copy the source code
|
|
COPY . .
|
|
|
|
# Build the application
|
|
RUN CGO_ENABLED=1 GOOS=linux go build -a -tags musl -o member-console .
|
|
|
|
# Runtime stage
|
|
# Pinned rather than floating: `alpine:latest` made builds irreproducible and
|
|
# silently changed the runtime base. Bump this tag deliberately.
|
|
FROM alpine:3.23
|
|
|
|
# Run as a dedicated non-root user; port 8080 is unprivileged and the app
|
|
# performs no runtime filesystem writes, so no ownership setup is needed.
|
|
RUN adduser -D -H -u 65532 app
|
|
|
|
# Set the working directory
|
|
WORKDIR /app
|
|
|
|
# Copy the binary from the builder stage
|
|
COPY --from=builder /app/member-console .
|
|
|
|
USER app
|
|
|
|
# Set environment variables
|
|
ENV PORT=8080 \
|
|
ENV=production
|
|
|
|
# Expose the port the app runs on
|
|
EXPOSE 8080
|
|
|
|
# Command to run the application
|
|
ENTRYPOINT ["/app/member-console"]
|
|
CMD ["start"]
|