reposystem/Containerfile at main · hyperpolymath/reposystem · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# SPDX-License-Identifier: PMPL-1.0-or-later
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
#
# Reposystem Container Image
# ==========================
# Based on Wolfi for minimal, secure, distroless-like base
#
# Build with: nerdctl build -t reposystem:dev .
# Run with:   nerdctl run -it --rm -v ~/repos:/data reposystem:dev scan /data

# ============================================================================
# Stage 1: Builder (Rust)
# ============================================================================
FROM cgr.dev/chainguard/rust:latest AS builder

# Note: Chainguard Rust image includes rust + cargo + git
# The image runs as nonroot user (uid 65532)

# Set up working directory
WORKDIR /home/nonroot/build

# Copy source files and fix ownership for nonroot user
COPY --chown=nonroot:nonroot . .

# Build Rust CLI
RUN cargo build --release

# ============================================================================
# Stage 2: Runtime (Minimal Wolfi)
# ============================================================================
FROM cgr.dev/chainguard/wolfi-base@sha256:0d8efc73b806c780206b69d62e1b8cb10e9e2eefa0e4452db81b9fa00b1a5175 AS runtime

# Install runtime dependencies only
RUN apk add --no-cache \
    graphviz \
    libgcc

# Create non-root user
RUN addgroup -g 1000 reposystem && \
    adduser -u 1000 -G reposystem -D reposystem

# Copy built artifacts
COPY --from=builder /home/nonroot/build/target/release/reposystem /usr/local/bin/reposystem

# Copy documentation and specs
COPY --from=builder /home/nonroot/build/README.adoc /app/
COPY --from=builder /home/nonroot/build/spec /app/spec
COPY --from=builder /home/nonroot/build/*.scm /app/

# Set permissions
RUN chown -R reposystem:reposystem /app

# Switch to non-root user
USER reposystem
WORKDIR /app

# Default data directory
VOLUME ["/data"]

# Environment
ENV REPOSYSTEM_DATA_DIR=/data
ENV RUST_LOG=info

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD reposystem --version || exit 1

# Default command
ENTRYPOINT ["reposystem"]
CMD ["--help"]

# ============================================================================
# Labels (OCI Image Spec)
# ============================================================================
LABEL org.opencontainers.image.title="Reposystem"
LABEL org.opencontainers.image.description="Railway yard for your repository ecosystem"
LABEL org.opencontainers.image.vendor="Hyperpolymath"
LABEL org.opencontainers.image.licenses="PMPL-1.0-or-later"
LABEL org.opencontainers.image.source="https://github.com/hyperpolymath/reposystem"
LABEL org.opencontainers.image.documentation="https://github.com/hyperpolymath/reposystem#readme"