-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathDockerfile.deprecated
More file actions
318 lines (234 loc) · 6.81 KB
/
Dockerfile.deprecated
File metadata and controls
318 lines (234 loc) · 6.81 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
# MarchProxy Docker Multi-Stage Build
# Build stage for Go applications
FROM golang:1.21-alpine AS go-builder
# Install build dependencies
RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev
# Set working directory
WORKDIR /build
# Copy go modules
COPY proxy/go.mod proxy/go.sum ./
RUN go mod download
# Copy source code
COPY proxy/ ./
# Build the proxy application
RUN CGO_ENABLED=1 GOOS=linux go build -a -installsuffix cgo \
-ldflags='-w -s -extldflags "-static"' \
-o marchproxy-proxy ./cmd/proxy
# Build additional tools
RUN CGO_ENABLED=1 GOOS=linux go build -a -installsuffix cgo \
-ldflags='-w -s -extldflags "-static"' \
-o marchproxy-health ./cmd/health
RUN CGO_ENABLED=1 GOOS=linux go build -a -installsuffix cgo \
-ldflags='-w -s -extldflags "-static"' \
-o marchproxy-metrics ./cmd/metrics
# Python build stage for manager
FROM python:3.12-slim AS python-builder
# Install build dependencies
RUN apt-get update && apt-get install -y \
build-essential \
libpq-dev \
&& rm -rf /var/lib/apt/lists/*
# Set working directory
WORKDIR /build
# Copy requirements
COPY manager/requirements.txt ./
RUN pip install --no-cache-dir --user -r requirements.txt
# Copy manager application
COPY manager/ ./
# Production stage - Manager
FROM python:3.12-slim AS manager
# Install runtime dependencies
RUN apt-get update && apt-get install -y \
libpq5 \
curl \
dumb-init \
&& rm -rf /var/lib/apt/lists/*
# Create app user
RUN groupadd -r marchproxy && useradd -r -g marchproxy marchproxy
# Set working directory
WORKDIR /app
# Copy Python dependencies
COPY --from=python-builder /root/.local /home/marchproxy/.local
# Copy application
COPY --from=python-builder /build ./
# Set ownership
RUN chown -R marchproxy:marchproxy /app
# Switch to app user
USER marchproxy
# Set PATH for local packages
ENV PATH=/home/marchproxy/.local/bin:$PATH
# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD curl -f http://localhost:8000/health || exit 1
# Expose port
EXPOSE 8000
# Run with dumb-init
ENTRYPOINT ["dumb-init", "--"]
CMD ["python", "-m", "py4web", "run", "apps", "--host", "0.0.0.0", "--port", "8000"]
# Production stage - Proxy
FROM alpine:3.18 AS proxy
# Install runtime dependencies
RUN apk --no-cache add \
ca-certificates \
tzdata \
curl \
dumb-init
# Create app user
RUN addgroup -g 1000 marchproxy && \
adduser -D -s /bin/sh -u 1000 -G marchproxy marchproxy
# Set working directory
WORKDIR /app
# Copy binaries from builder
COPY --from=go-builder /build/marchproxy-proxy ./
COPY --from=go-builder /build/marchproxy-health ./
COPY --from=go-builder /build/marchproxy-metrics ./
# Copy configuration files
COPY proxy/configs/ ./configs/
# Set ownership
RUN chown -R marchproxy:marchproxy /app
# Switch to app user
USER marchproxy
# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD ./marchproxy-health || exit 1
# Expose ports
EXPOSE 80 443 8080 8090
# Run with dumb-init
ENTRYPOINT ["dumb-init", "--"]
CMD ["./marchproxy-proxy"]
# Development stage
FROM golang:1.21-alpine AS development
# Install development tools
RUN apk add --no-cache \
git \
ca-certificates \
tzdata \
gcc \
musl-dev \
curl \
make \
bash \
vim \
tmux
# Install Go tools
RUN go install github.com/cosmtrek/air@latest && \
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest && \
go install github.com/swaggo/swag/cmd/swag@latest
# Set working directory
WORKDIR /workspace
# Copy go modules for caching
COPY proxy/go.mod proxy/go.sum ./
RUN go mod download
# Create non-root user
RUN addgroup -g 1000 developer && \
adduser -D -s /bin/sh -u 1000 -G developer developer
# Set ownership
RUN chown -R developer:developer /workspace
# Switch to developer user
USER developer
# Expose development ports
EXPOSE 80 443 8080 8090 9090
CMD ["air", "-c", ".air.toml"]
# Testing stage
FROM golang:1.21-alpine AS testing
# Install test dependencies
RUN apk add --no-cache \
git \
ca-certificates \
gcc \
musl-dev \
make
# Set working directory
WORKDIR /test
# Copy source code
COPY proxy/ ./
# Download dependencies
RUN go mod download
# Run tests with coverage
RUN go test -v -race -coverprofile=coverage.out -covermode=atomic ./...
# Generate test reports
RUN go tool cover -html=coverage.out -o coverage.html
# Benchmark stage
FROM golang:1.21-alpine AS benchmark
# Install benchmark dependencies
RUN apk add --no-cache \
git \
ca-certificates \
gcc \
musl-dev
# Set working directory
WORKDIR /bench
# Copy source code
COPY proxy/ ./
# Download dependencies
RUN go mod download
# Run benchmarks
RUN go test -bench=. -benchmem ./... > benchmark.txt
# Security scanning stage
FROM alpine:3.18 AS security
# Install security tools
RUN apk add --no-cache \
curl \
jq
# Install Trivy for vulnerability scanning
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
# Copy binaries to scan
COPY --from=go-builder /build/marchproxy-proxy ./
# Run security scan
RUN trivy filesystem --exit-code 0 --severity HIGH,CRITICAL --format json --output trivy-report.json .
# Multi-architecture build stage
FROM --platform=$BUILDPLATFORM golang:1.21-alpine AS cross-builder
ARG TARGETOS
ARG TARGETARCH
# Install dependencies
RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev
# Set working directory
WORKDIR /build
# Copy go modules
COPY proxy/go.mod proxy/go.sum ./
RUN go mod download
# Copy source code
COPY proxy/ ./
# Build for target platform
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build \
-a -installsuffix cgo \
-ldflags='-w -s' \
-o marchproxy-proxy ./cmd/proxy
# Distroless production stage
FROM gcr.io/distroless/static:nonroot AS distroless
# Copy binary
COPY --from=cross-builder /build/marchproxy-proxy /app/
# Copy timezone data
COPY --from=cross-builder /usr/share/zoneinfo /usr/share/zoneinfo
# Health check (limited in distroless)
# HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
# CMD ["/app/marchproxy-proxy", "health"] || exit 1
# Expose ports
EXPOSE 80 443
# Use non-root user
USER 65532:65532
# Run application
ENTRYPOINT ["/app/marchproxy-proxy"]
# Debug stage with shell access
FROM alpine:3.18 AS debug
# Install debugging tools
RUN apk add --no-cache \
bash \
curl \
htop \
strace \
tcpdump \
netcat-openbsd \
bind-tools \
ca-certificates
# Copy binary
COPY --from=go-builder /build/marchproxy-proxy ./
COPY --from=go-builder /build/marchproxy-health ./
COPY --from=go-builder /build/marchproxy-metrics ./
# Make executable
RUN chmod +x marchproxy-*
# Expose ports
EXPOSE 80 443 8080 8090
CMD ["./marchproxy-proxy"]
# Default production target
FROM proxy AS production