opsx
4f74fe6c3f
- .gitea/workflows/ci.yml:后端 gofmt/vet/test + 前端 lint/test/build 双 job 门禁 - vitest + @testing-library + jsdom 落地,14 个命脉用例:useListQuery 乱序丢弃/卸载中止、 http.ts 401 单飞刷新+队列重放+失败登出+silent 直拒、审计防抖、StepDeploy 部署目标、query-utils - 版本注入断裂修复:main 补 buildTime/gitCommit 符号,build.sh/Dockerfile 注入 main.version, /health 返回真实版本,前端 package.json 版本对齐 2.0.0 - gofmt 清零(8 个存量未格式化文件)
127 lines
4.6 KiB
Docker
127 lines
4.6 KiB
Docker
# ============================================================
|
|
# lokistack - Secure Multi-Stage Dockerfile
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root user (lokistack:1000)
|
|
# - No hardcoded JWT_SECRET (validated at runtime)
|
|
# - HEALTHCHECK instruction added
|
|
# - Binary installation verification
|
|
# P1 Fixes:
|
|
# - Supply chain risk reduction (--ignore-scripts where applicable)
|
|
# - File ownership with --chown
|
|
# - Security environment variables
|
|
# ============================================================
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 1: Frontend Builder (Node.js)
|
|
# ---------------------------------------------------------------
|
|
FROM node:20-alpine AS frontend-builder
|
|
WORKDIR /app/frontend
|
|
|
|
# Install dependencies separately to leverage layer caching
|
|
COPY frontend/package*.json ./
|
|
# Use --ignore-scripts to reduce supply chain attack surface
|
|
RUN npm ci --ignore-scripts && \
|
|
npm cache clean --force
|
|
|
|
# Copy source and build
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 2: Backend Builder (Go)
|
|
# ---------------------------------------------------------------
|
|
FROM golang:1.24-alpine AS backend-builder
|
|
RUN apk add --no-cache git ca-certificates tzdata
|
|
ENV GOTOOLCHAIN=local
|
|
WORKDIR /app/backend
|
|
|
|
# Download dependencies (cached layer)
|
|
COPY backend/go.* ./
|
|
RUN go mod download
|
|
|
|
# Copy source and build static binary
|
|
# -trimpath：抹掉源码绝对路径（否则二进制里能 strings 出 /app/backend/controllers/*.go 共 66 处）
|
|
COPY backend/ ./
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-a -installsuffix cgo \
|
|
-ldflags="-s -w -X main.version=${APP_VERSION:-docker} -extldflags '-static'" \
|
|
-o bin/lokistack .
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 3: Final Runtime Image
|
|
# ---------------------------------------------------------------
|
|
FROM alpine:3.20
|
|
|
|
# Install runtime dependencies:
|
|
# ca-certificates: HTTPS TLS verification
|
|
# openssh-client: SSH key auth for host deployment
|
|
# bash: Entrypoint script support
|
|
# wget: HEALTHCHECK (lighter than curl)
|
|
RUN apk --no-cache add \
|
|
ca-certificates \
|
|
openssh-client \
|
|
bash \
|
|
wget
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: Create non-root user and group
|
|
# ---------------------------------------------------------------
|
|
RUN addgroup -g 1000 lokistack && \
|
|
adduser -u 1000 -G lokistack -s /bin/sh -D lokistack
|
|
|
|
# ---------------------------------------------------------------
|
|
# Working directory with proper ownership
|
|
# ---------------------------------------------------------------
|
|
WORKDIR /app
|
|
RUN chown lokistack:lokistack /app
|
|
|
|
# ---- Copy application files with correct ownership (P1) ----
|
|
COPY --from=frontend-builder --chown=lokistack:lokistack /app/frontend/dist ./dist
|
|
COPY --from=backend-builder --chown=lokistack:lokistack /app/backend/bin/lokistack ./lokistack
|
|
|
|
# Create data directory with non-root ownership
|
|
RUN mkdir -p /app/data && chown -R lokistack:lokistack /app/data
|
|
|
|
# Create .kube directory for non-root user (P0: not /root/.kube)
|
|
RUN mkdir -p /home/lokistack/.kube && \
|
|
chown -R lokistack:lokistack /home/lokistack && \
|
|
chmod 700 /home/lokistack/.kube
|
|
|
|
# ---- Security hardening: remove unnecessary tools ----
|
|
RUN rm -rf /tmp/* /var/cache/apk/*
|
|
|
|
# ---------------------------------------------------------------
|
|
# Security environment variables
|
|
# ---------------------------------------------------------------
|
|
ENV DATA_DIR=/app/data
|
|
ENV SERVER_PORT=8080
|
|
ENV KUBECONFIG=/home/lokistack/.kube/config
|
|
ENV HOME=/home/lokistack
|
|
|
|
# NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.
|
|
# They MUST be provided at runtime via docker-compose env or secrets.
|
|
# The entrypoint script will enforce this requirement.
|
|
|
|
# ---- Copy and configure entrypoint script ----
|
|
COPY --chown=lokistack:lokistack docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
EXPOSE 8080
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: HEALTHCHECK - verifies static file serving (no auth needed)
|
|
# ---------------------------------------------------------------
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider \
|
|
http://localhost:${SERVER_PORT}/index.html || exit 1
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: Switch to non-root user
|
|
# ---------------------------------------------------------------
|
|
USER lokistack
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
|
CMD ["./lokistack"]
|