Bakhtiyar Issakhmetov
c6229c46f7
Close stdlib (net/http, crypto/tls, mime/multipart, net/http/httputil) and x/net advisories published after the go1.26.8 release (GO-2026-6603..6617, CVE-2026-78667/78669/97031). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
40 lines
1.3 KiB
Docker
40 lines
1.3 KiB
Docker
# Build context is the repo root: docker build -f build/package/Dockerfile .
|
|
# Go patch release pinned (not the floating 1.26 tag) so the shipped standard
|
|
# library is reproducible and includes the security fixes up to go1.26.9;
|
|
# keep in step with the `toolchain` line in go.mod.
|
|
FROM golang:1.26.9-alpine3.24 AS builder
|
|
|
|
# godal (GDAL bindings) needs cgo, a C/C++ toolchain and the GDAL headers.
|
|
# g++ is required: parts of the binding compile as C++ against GDAL's headers.
|
|
RUN apk add --no-cache gdal-dev gcc g++ musl-dev pkgconfig
|
|
|
|
WORKDIR /src
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -o /out/gis ./cmd/gis
|
|
|
|
# Must stay on the same Alpine release as the builder — hence the pinned
|
|
# `golang:1.26.9-alpine3.24` above rather than the floating `-alpine` tag. A
|
|
# mismatch ships a different libgdal soname, and the image still builds green
|
|
# while the binary dies at startup with "libgdal.so.NN: No such file".
|
|
# Bump both lines together.
|
|
FROM alpine:3.24
|
|
|
|
# gdal: shared library for godal (raster math in the worker).
|
|
# gdal-tools: gdal_translate / gdalinfo (COG conversion) and ogr2ogr.
|
|
RUN apk add --no-cache ca-certificates tzdata gdal gdal-tools \
|
|
&& adduser -D -u 10001 app
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder /out/gis /usr/local/bin/gis
|
|
|
|
USER app
|
|
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["gis"]
|
|
CMD ["serve"]
|