64 lines
1.6 KiB
Docker
64 lines
1.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Builder
|
|
#
|
|
ARG NIX_SUBSTITUTERS=https://cache.nixos.org
|
|
|
|
FROM nixos/nix:2.31.3 AS builder
|
|
|
|
ARG NIX_SUBSTITUTERS
|
|
RUN tee -a /etc/nix/nix.conf <<EOF
|
|
extra-experimental-features = nix-command flakes
|
|
filter-syscalls = false
|
|
substituters = $NIX_SUBSTITUTERS
|
|
EOF
|
|
|
|
RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
|
|
|
|
COPY . /tmp/build
|
|
WORKDIR /tmp/build
|
|
|
|
RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
|
|
|
|
# Export the built closure to a folder
|
|
RUN mkdir /tmp/nix-store-closure
|
|
RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
|
|
|
|
# Create a folder which will be copied to /tmp in the final image
|
|
RUN install -d -o root -g root -m 0777 will_be_tmp
|
|
|
|
# Create a folder which will be copied to /nginx in the final image
|
|
RUN install -d -o 1000 -g 1000 -m 0755 will_be_slash_nginx
|
|
|
|
#
|
|
# Runner
|
|
#
|
|
|
|
FROM scratch
|
|
|
|
WORKDIR /app
|
|
|
|
ENV PATH="$PATH:/app/bin"
|
|
|
|
COPY --chmod=0644 --chown=0:0 <<EOF /etc/group
|
|
root:x:0:root
|
|
web:x:1000:web
|
|
EOF
|
|
|
|
COPY --chmod=0644 --chown=0:0 <<EOF /etc/passwd
|
|
root:x:0:0:root:/root:/bin/sh
|
|
web:x:1000:1000::/home/web:/bin/sh
|
|
EOF
|
|
|
|
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
|
|
ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
|
|
COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
|
|
|
|
COPY --from=builder /tmp/nix-store-closure /nix/store
|
|
COPY --from=builder /tmp/build/result /app
|
|
COPY --from=builder /tmp/build/will_be_tmp /tmp
|
|
COPY --from=builder /tmp/build/will_be_slash_nginx /nginx
|
|
|
|
EXPOSE 8080
|
|
CMD ["/app/nginx", "-c", "/app/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
|