A service to replicate and serve requests for site configurations based on site ID, public IP, and the on-site lead contact's OTP.
| Révision | d3bef901d0a703ad8ca619d91a47d1370d93f7db (tree) |
|---|---|
| l'heure | 2021-10-13 02:11:10 |
| Auteur | S. Seago <sseago-dev@proj...> |
| Commiter | S. Seago |
Beautify code blocks
container/Docker Notes.adoc (diff)| @@ -26,55 +26,27 @@ | ||
| 26 | 26 | # Note: when updating the go minor version here, also update the go-channel in snap/snapcraft.yml |
| 27 | 27 | FROM golang:1.16.7-buster |
| 28 | 28 | LABEL maintainer="Steven Allen <steven@stebalien.com>" |
| 29 | - | |
| 30 | 29 | # Install deps |
| 31 | -RUN apt-get update && apt-get install -y \ | |
| 32 | - libssl-dev \ | |
| 33 | - ca-certificates \ | |
| 34 | - fuse | |
| 35 | - | |
| 30 | +RUN apt-get update && apt-get install -y libssl-dev ca-certificates fuse | |
| 36 | 31 | ENV SRC_DIR /go-ipfs |
| 37 | - | |
| 38 | 32 | # Download packages first so they can be cached. |
| 39 | 33 | COPY go.mod go.sum $SRC_DIR/ |
| 40 | -RUN cd $SRC_DIR \ | |
| 41 | - && go mod download | |
| 42 | - | |
| 34 | +RUN cd $SRC_DIR && go mod download | |
| 43 | 35 | COPY . $SRC_DIR |
| 44 | - | |
| 45 | 36 | # Preload an in-tree but disabled-by-default plugin by adding it to the IPFS_PLUGINS variable |
| 46 | 37 | # e.g. docker build --build-arg IPFS_PLUGINS="foo bar baz" |
| 47 | 38 | ARG IPFS_PLUGINS |
| 48 | - | |
| 49 | 39 | # Build the thing. |
| 50 | 40 | # Also: fix getting HEAD commit hash via git rev-parse. |
| 51 | -RUN cd $SRC_DIR \ | |
| 52 | - && mkdir -p .git/objects \ | |
| 53 | - && make build GOTAGS=openssl IPFS_PLUGINS=$IPFS_PLUGINS | |
| 54 | - | |
| 41 | +RUN cd $SRC_DIR && mkdir -p .git/objects && make build GOTAGS=openssl IPFS_PLUGINS=$IPFS_PLUGINS | |
| 55 | 42 | # Get su-exec, a very minimal tool for dropping privileges, |
| 56 | 43 | # and tini, a very minimal init daemon for containers |
| 57 | 44 | ENV SUEXEC_VERSION v0.2 |
| 58 | 45 | ENV TINI_VERSION v0.19.0 |
| 59 | -RUN set -eux; \ | |
| 60 | - dpkgArch="$(dpkg --print-architecture)"; \ | |
| 61 | - case "${dpkgArch##*-}" in \ | |
| 62 | - "amd64" | "armhf" | "arm64") tiniArch="tini-static-$dpkgArch" ;;\ | |
| 63 | - *) echo >&2 "unsupported architecture: ${dpkgArch}"; exit 1 ;; \ | |
| 64 | - esac; \ | |
| 65 | - cd /tmp \ | |
| 66 | - && git clone https://github.com/ncopa/su-exec.git \ | |
| 67 | - && cd su-exec \ | |
| 68 | - && git checkout -q $SUEXEC_VERSION \ | |
| 69 | - && make su-exec-static \ | |
| 70 | - && cd /tmp \ | |
| 71 | - && wget -q -O tini https://github.com/krallin/tini/releases/download/$TINI_VERSION/$tiniArch \ | |
| 72 | - && chmod +x tini | |
| 73 | - | |
| 46 | +RUN set -eux; dpkgArch="$(dpkg --print-architecture)"; case "${dpkgArch##*-}" in "amd64" | "armhf" | "arm64") tiniArch="tini-static-$dpkgArch" ;; *) echo >&2 "unsupported architecture: ${dpkgArch}"; exit 1 ;; esac; cd /tmp && git clone https://github.com/ncopa/su-exec.git && cd su-exec && git checkout -q $SUEXEC_VERSION && make su-exec-static && cd /tmp && wget -q -O tini https://github.com/krallin/tini/releases/download/$TINI_VERSION/$tiniArch && chmod +x tini | |
| 74 | 47 | # Now comes the actual target image, which aims to be as small as possible. |
| 75 | 48 | FROM busybox:1.31.1-glibc |
| 76 | 49 | LABEL maintainer="Steven Allen <steven@stebalien.com>" |
| 77 | - | |
| 78 | 50 | # Get the ipfs binary, entrypoint script, and TLS CAs from the build container. |
| 79 | 51 | ENV SRC_DIR /go-ipfs |
| 80 | 52 | COPY --from=0 $SRC_DIR/cmd/ipfs/ipfs /usr/local/bin/ipfs |
| @@ -83,20 +55,15 @@ | ||
| 83 | 55 | COPY --from=0 /tmp/tini /sbin/tini |
| 84 | 56 | COPY --from=0 /bin/fusermount /usr/local/bin/fusermount |
| 85 | 57 | COPY --from=0 /etc/ssl/certs /etc/ssl/certs |
| 86 | - | |
| 87 | 58 | # Add suid bit on fusermount so it will run properly |
| 88 | 59 | RUN chmod 4755 /usr/local/bin/fusermount |
| 89 | - | |
| 90 | 60 | # Fix permissions on start_ipfs (ignore the build machine's permissions) |
| 91 | 61 | RUN chmod 0755 /usr/local/bin/start_ipfs |
| 92 | - | |
| 93 | 62 | # This shared lib (part of glibc) doesn't seem to be included with busybox. |
| 94 | 63 | COPY --from=0 /lib/*-linux-gnu*/libdl.so.2 /lib/ |
| 95 | - | |
| 96 | 64 | # Copy over SSL libraries. |
| 97 | 65 | COPY --from=0 /usr/lib/*-linux-gnu*/libssl.so* /usr/lib/ |
| 98 | 66 | COPY --from=0 /usr/lib/*-linux-gnu*/libcrypto.so* /usr/lib/ |
| 99 | - | |
| 100 | 67 | # Swarm TCP; should be exposed to the public |
| 101 | 68 | EXPOSE 4001 |
| 102 | 69 | # Swarm UDP; should be exposed to the public |
| @@ -107,35 +74,25 @@ | ||
| 107 | 74 | EXPOSE 8080 |
| 108 | 75 | # Swarm Websockets; must be exposed publicly when the node is listening using the websocket transport (/ipX/.../tcp/8081/ws). |
| 109 | 76 | EXPOSE 8081 |
| 110 | - | |
| 111 | 77 | # Create the fs-repo directory and switch to a non-privileged user. |
| 112 | 78 | ENV IPFS_PATH /data/ipfs |
| 113 | -RUN mkdir -p $IPFS_PATH \ | |
| 114 | - && adduser -D -h $IPFS_PATH -u 1000 -G users ipfs \ | |
| 115 | - && chown ipfs:users $IPFS_PATH | |
| 116 | - | |
| 79 | +RUN mkdir -p $IPFS_PATH && adduser -D -h $IPFS_PATH -u 1000 -G users ipfs && chown ipfs:users $IPFS_PATH | |
| 117 | 80 | # Create mount points for `ipfs mount` command |
| 118 | -RUN mkdir /ipfs /ipns \ | |
| 119 | - && chown ipfs:users /ipfs /ipns | |
| 120 | - | |
| 81 | +RUN mkdir /ipfs /ipns && chown ipfs:users /ipfs /ipns | |
| 121 | 82 | # Expose the fs-repo as a volume. |
| 122 | 83 | # start_ipfs initializes an fs-repo if none is mounted. |
| 123 | 84 | # Important this happens after the USER directive so permissions are correct. |
| 124 | 85 | VOLUME $IPFS_PATH |
| 125 | - | |
| 126 | 86 | # The default logging level |
| 127 | 87 | ENV IPFS_LOGGING "" |
| 128 | - | |
| 129 | 88 | # This just makes sure that: |
| 130 | 89 | # 1. There's an fs-repo, and initializes one if there isn't. |
| 131 | 90 | # 2. The API and Gateway are accessible from outside the container. |
| 132 | 91 | ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/start_ipfs"] |
| 133 | - | |
| 134 | 92 | # Heathcheck for the container |
| 135 | 93 | # QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn is the CID of empty folder |
| 136 | -HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ | |
| 137 | - CMD ipfs dag stat /ipfs/QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn || exit 1 | |
| 138 | - | |
| 94 | +HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 | |
| 95 | +CMD ipfs dag stat /ipfs/QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn || exit 1 | |
| 139 | 96 | # Execute the daemon subcommand by default |
| 140 | 97 | CMD ["daemon", "--migrate=true"] |
| 141 | 98 | --- |
| \ No newline at end of file |
Fork