Something went wrong. Try again.
Fork of atproto-crates for SCN forked from ngerakines.me/atproto-crates
Something went wrong. Try again.
atproto-crates Dockerfile.entryway
2.4 kB · 55 lines
at main
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556# The entryway as a single container.## docker build -f Dockerfile.entryway -t atproto-entryway .## One process, one writable volume. The database and, by default, the key# files live under `ENTRYWAY_DATA_DIRECTORY`, so a single mount is the whole# persistent state. Back the key files up separately from the database: losing# the database loses every credential in the cluster, and losing the PLC# rotation key without the offline recovery key loses control of every hosted# DID.
# Keep in step with `channel` in rust-toolchain.toml and the other images'# builder stages; the CI "toolchain pins" step fails on drift.FROM rust:1.97-slim-bookworm AS builder
RUN apt-get update && apt-get install -y --no-install-recommends \ pkg-config libssl-dev \ && rm -rf /var/lib/apt/lists/*
WORKDIR /usr/src/appCOPY . .
# `hickory-dns` resolves handles by DNS TXT; `smtp` sends the mail that# password resets and email confirmation depend on, as the PDS images do.# Extend the list with a `--build-arg ENTRYWAY_FEATURES=...` rather than# editing this file.ARG ENTRYWAY_FEATURES=clap,hickory-dns,smtpRUN cargo build --release --bin entryway --features "${ENTRYWAY_FEATURES}"
# Distroless: no shell and no package manager, as `Dockerfile.pds`.FROM gcr.io/distroless/cc-debian12
COPY --from=builder /usr/src/app/target/release/entryway /usr/local/bin/entryway
# Where durable state goes; mount the volume here. No `VOLUME` instruction, for# the reasons `Dockerfile.pds` gives: under `ENTRYWAY_PRODUCTION=true` the# entryway refuses to start unless this directory already exists, which is# only true when a volume is attached.ENV ENTRYWAY_DATA_DIRECTORY=/data
# Containers are routed to from outside, so the loopback default is wrong here.ENV ENTRYWAY_BIND=0.0.0.0
# `ENTRYWAY_PORT` is deliberately not set, so a platform-assigned `PORT` wins.EXPOSE 4900
ENTRYPOINT ["/usr/local/bin/entryway"]# `serve` runs the server and the operation runner. Run the admin commands# (`pds`, `ops`) in a second process against the same volume.CMD ["serve"]
LABEL org.opencontainers.image.title="atproto-entryway"LABEL org.opencontainers.image.description="AT Protocol entryway: account service and OAuth authorization server in front of PDS instances"LABEL org.opencontainers.image.source="https://tangled.org/ngerakines.me/atproto-crates"LABEL org.opencontainers.image.licenses="MIT"