Dockerfile

ARG CRYSTAL_VERSION=latest

FROM placeos/crystal:$CRYSTAL_VERSION AS build
WORKDIR /app

# Set the commit via a build arg
ARG PLACE_COMMIT="DEV"
# Set the platform version via a build arg
ARG PLACE_VERSION="DEV"

# Create a non-privileged user, defaults are appuser:10001
ARG IMAGE_UID="10001"
ENV UID=$IMAGE_UID
ENV USER=appuser

# See https://stackoverflow.com/a/55757473/12429735
RUN adduser \
    --disabled-password \
    --gecos "" \
    --home "/nonexistent" \
    --shell "/sbin/nologin" \
    --no-create-home \
    --uid "${UID}" \
    "${USER}"

# Install shards for caching
COPY shard.yml shard.yml
COPY shard.override.yml shard.override.yml
COPY shard.lock shard.lock

RUN shards install --production --ignore-crystal-version --skip-postinstall --skip-executables

# Add src
COPY ./src /app/src

# Build application
# -no-pie: backtraces of a static PIE binary can't be resolved, they print `from ???`
RUN UNAME_AT_COMPILE_TIME=true \
    PLACE_COMMIT=$PLACE_COMMIT \
    PLACE_VERSION=$PLACE_VERSION \
    shards build --production --error-trace --static --link-flags=-no-pie

SHELL ["/bin/ash", "-eo", "pipefail", "-c"]

# Extract binary dependencies, a fully static binary has none (ldd exits 1)
RUN mkdir deps
RUN for binary in /app/bin/*; do \
        { ldd "$binary" || true; } | \
        tr -s '[:blank:]' '\n' | \
        { grep '^/' || true; } | \
        xargs -r -I % sh -c 'mkdir -p $(dirname deps%); cp % deps%;'; \
    done

# Create a temporary folder (used when configuring TLS servers)
RUN mkdir -p /app/tmp

# Build a minimal docker image
FROM scratch
WORKDIR /
ENV PATH=$PATH:/

# Copy the user information over
COPY --from=build etc/passwd /etc/passwd
COPY --from=build /etc/group /etc/group

# These are required for communicating with external services
COPY --from=build /etc/hosts /etc/hosts

# These provide certificate chain validation where communicating with external services over TLS
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

# This is required for Timezone support
COPY --from=build /usr/share/zoneinfo/ /usr/share/zoneinfo/

# Create a writeable temporary folder
COPY --from=build --chown=0:0 /app/tmp /tmp

# This seems to be the only way to set permissions properly
COPY --from=build /bin /bin
COPY --from=build /lib/ld-musl-* /lib/
RUN chmod -R a+rwX /tmp
# hadolint ignore=SC2114,DL3059
RUN rm -rf /bin /lib

# Copy the app into place
COPY --from=build /app/deps /
COPY --from=build /app/bin /

# Use an unprivileged user.
USER appuser:appuser

# Run the app binding on port 8080
EXPOSE 8080
ENTRYPOINT ["/dispatch"]
HEALTHCHECK CMD ["/dispatch", "-c", "http://127.0.0.1:8080/api/dispatch/v1/healthz"]
CMD ["/dispatch", "-b", "0.0.0.0", "-p", "8080"]