mirror of
https://github.com/luxfi/kms.git
synced 2026-07-27 03:38:31 +00:00
zeekayandHanzo Dev
0c3eca807e
Dockerfile.server used plain 'go build' (vendor mode) + a single pre-COPY 'go mod download'. Two breakages: (1) the committed vendor/ lags go.mod (luxfi/vm v1.2.3 in modules.txt vs v1.3.1 in go.mod) -> 'inconsistent vendoring'; (2) COPY . . re-clobbers any regenerated go.sum with the stale committed one, so a force-republished luxfi tag aborts the build on a checksum mismatch. Mirror the proven-green main Dockerfile: GOSUMDB=off + rm -f go.sum && go mod download before AND after COPY . ., and GOFLAGS=-mod=mod on build so it resolves from the module cache instead of the inconsistent vendor tree. Regenerate-not-bypass: integrity still enforced against go.sum. Co-authored-by: Hanzo Dev <dev@hanzo.ai>
56 lines
2.4 KiB
Docker
56 lines
2.4 KiB
Docker
# luxfi/kms — MPC-backed KMS server (headless, no React UI)
|
|
# Server-only build: Go + sqlcipher + MPC/ZAP. Skips the React SPA frontend
|
|
# stage so emulated cross-platform builds (M-series Mac → linux/amd64) don't
|
|
# trip QEMU's esbuild crash.
|
|
|
|
FROM golang:1.26.4-bookworm AS builder
|
|
ENV GOTOOLCHAIN=auto
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG GITHUB_TOKEN
|
|
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
|
|
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
|
|
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
# GOSUMDB=off: luxfi first-party tags are periodically force-republished during the
|
|
# ongoing ecosystem re-tag (e.g. luxfi/vm), so immutable sum.golang.org lags the
|
|
# proxy and rejects the current bits. Trust the proxy/authed-git source and record
|
|
# what is really fetched — integrity is still enforced against the regenerated
|
|
# go.sum (regenerate-not-bypass). Mirrors the main Dockerfile.
|
|
ENV GOSUMDB=off
|
|
RUN rm -f go.sum && go mod download
|
|
COPY . .
|
|
|
|
# `COPY . .` just re-introduced the committed go.sum, which can be stale vs the bits
|
|
# primed above when a luxfi tag was force-republished — a -mod=mod build then aborts
|
|
# on a go.sum checksum mismatch. Drop and regenerate from the primed cache under
|
|
# GOSUMDB=off (same as the main Dockerfile). Without this, that earlier regeneration
|
|
# is silently reverted by this COPY.
|
|
RUN rm -f go.sum && go mod download
|
|
|
|
# GOFLAGS=-mod=mod builds from the module cache, not the in-tree vendor/. The
|
|
# committed vendor/ can lag go.mod during the re-tag (inconsistent vendoring) and
|
|
# also strips supranational/blst C headers. Matches the main Dockerfile.
|
|
RUN CGO_ENABLED=1 GOFLAGS=-mod=mod go build -tags "sqlite_fts5 sqlcipher" \
|
|
-ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsqlcipher0 ca-certificates curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /usr/local/bin/kms /usr/local/bin/kms
|
|
RUN mkdir -p /data/kms
|
|
|
|
ENV BASE_SKIP_ROOT_REDIRECT=1
|
|
ENV BASE_DISABLE_ADMIN_UI=1
|
|
|
|
EXPOSE 8080
|
|
HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
|
|
CMD curl -f http://localhost:8080/healthz || exit 1
|
|
ENTRYPOINT ["kms", "serve", "--http=0.0.0.0:8080"]
|