c6247ea9f8
- Update COPY paths in all 3 Dockerfiles for crates/bin/services/testing layout - Migrate service image builds from internal GitLab registry to SCW CR - Update Kaniko auth to use SCW credentials (nologin + SCW_SECRET_KEY) - Remove --insecure-registry flags (SCW CR is HTTPS) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
100 lines
3.1 KiB
Desktop File
100 lines
3.1 KiB
Desktop File
# Unified multi-stage Rust service builder
|
|
# Usage: docker build --build-arg SERVICE=trading_service -f infra/docker/Dockerfile.service .
|
|
#
|
|
# Optional sccache: pass SCCACHE_BUCKET + credentials to enable S3-backed build cache
|
|
|
|
# =============================================================================
|
|
# Stage 1: Builder
|
|
# =============================================================================
|
|
FROM rust:1.89-slim-bookworm AS builder
|
|
|
|
ARG SERVICE
|
|
ARG SCCACHE_BUCKET=""
|
|
ARG AWS_ACCESS_KEY_ID=""
|
|
ARG AWS_SECRET_ACCESS_KEY=""
|
|
ARG AWS_DEFAULT_REGION="fr-par"
|
|
ARG SCCACHE_ENDPOINT=""
|
|
|
|
RUN test -n "${SERVICE}" || (echo "ERROR: SERVICE build-arg is required" && exit 1)
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
pkg-config \
|
|
libssl-dev \
|
|
protobuf-compiler \
|
|
perl \
|
|
make \
|
|
curl \
|
|
git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Conditionally install sccache when a bucket is configured
|
|
RUN if [ -n "${SCCACHE_BUCKET}" ]; then \
|
|
curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.8.1/sccache-v0.8.1-x86_64-unknown-linux-musl.tar.gz \
|
|
| tar xz --strip-components=1 -C /usr/local/bin sccache-v0.8.1-x86_64-unknown-linux-musl/sccache \
|
|
&& chmod +x /usr/local/bin/sccache; \
|
|
fi
|
|
|
|
# Set sccache env vars conditionally
|
|
ENV RUSTC_WRAPPER=${SCCACHE_BUCKET:+/usr/local/bin/sccache}
|
|
ENV SCCACHE_BUCKET=${SCCACHE_BUCKET}
|
|
ENV SCCACHE_S3_USE_SSL=true
|
|
ENV SCCACHE_ENDPOINT=${SCCACHE_ENDPOINT}
|
|
ENV AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
|
|
ENV AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
|
|
ENV AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION}
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy workspace manifests first for layer caching
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY .sqlx ./.sqlx
|
|
|
|
# Copy workspace directories (post-restructure layout)
|
|
COPY crates ./crates
|
|
COPY bin ./bin
|
|
COPY services ./services
|
|
COPY testing ./testing
|
|
|
|
ENV SQLX_OFFLINE=true
|
|
|
|
RUN cargo build --release -p ${SERVICE} \
|
|
&& mkdir -p /build/out \
|
|
&& cp target/release/${SERVICE} /build/out/ \
|
|
&& strip /build/out/${SERVICE}
|
|
|
|
# Show sccache stats if enabled
|
|
RUN if [ -n "${SCCACHE_BUCKET}" ] && command -v sccache >/dev/null 2>&1; then \
|
|
sccache --show-stats; \
|
|
fi
|
|
|
|
# =============================================================================
|
|
# Stage 2: Runtime
|
|
# =============================================================================
|
|
FROM debian:bookworm-slim AS runtime
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
libssl3 \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install grpc_health_probe for Kubernetes health checks
|
|
RUN curl -fsSL https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.25/grpc_health_probe-linux-amd64 \
|
|
-o /usr/local/bin/grpc_health_probe \
|
|
&& chmod +x /usr/local/bin/grpc_health_probe
|
|
|
|
RUN groupadd -g 1000 foxhunt \
|
|
&& useradd -u 1000 -g foxhunt -m -s /bin/false foxhunt
|
|
|
|
ARG SERVICE
|
|
ENV SERVICE=${SERVICE}
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder /build/out/${SERVICE} ./${SERVICE}
|
|
RUN chmod +x ./${SERVICE}
|
|
|
|
USER foxhunt
|
|
|
|
ENTRYPOINT ["/bin/sh", "-c", "exec /app/${SERVICE}"]
|