irongit
Sign inRegister
huncholanehuncholane/irongitPublic

Git hosting and a container registry in one Rust binary (axum + Astro)

irongit/Dockerfile
72 lines2.9 KB
RawDownloadHistory
1# syntax=docker/dockerfile:1.7
2# irongit: server (axum + embedded Astro build) plus the static ig CLI, which
3# the server publishes to R2 for install.sh and `ig upgrade`.
4# docker build -t irongit .
5
6# ---- Frontend -----------------------------------------------------------------
7FROM oven/bun:1.4 AS frontend
8WORKDIR /src/frontend
9COPY frontend/package.json frontend/bun.lock ./
10RUN bun install --frozen-lockfile
11COPY frontend/ ./
12# The backend's Rust templates use Tailwind classes too; the CSS build scans them.
13COPY backend/src /src/backend/src
14RUN bun run build
15
16# ---- Rust ---------------------------------------------------------------------
17FROM rust:1-trixie AS rust
18RUN apt-get update \
19 && apt-get install -y --no-install-recommends musl-tools \
20 && rm -rf /var/lib/apt/lists/* \
21 && rustup target add x86_64-unknown-linux-musl
22WORKDIR /src
23COPY Cargo.toml Cargo.lock ./
24COPY backend/ backend/
25COPY cli/ cli/
26COPY shared/ shared/
27COPY --from=frontend /src/frontend/dist frontend/dist
28# deploy.sh passes the CLI version (bumped automatically when cli/ or shared/
29# change) and the server URL ig defaults to. Empty values fall back to the
30# crate version and to no built-in server.
31ARG IG_BUILD_VERSION=""
32ARG IG_DEFAULT_HOST=""
33# Cache mounts keep the registry and build artifacts between image builds;
34# the binaries are copied out of the cache within the same step.
35RUN --mount=type=cache,target=/usr/local/cargo/registry \
36 --mount=type=cache,target=/src/target \
37 cargo build --release --locked -p irongit --no-default-features \
38 && IG_BUILD_VERSION="$IG_BUILD_VERSION" IG_DEFAULT_HOST="$IG_DEFAULT_HOST" \
39 cargo build --release --locked -p ig --target x86_64-unknown-linux-musl \
40 && mkdir -p /out \
41 && cp target/release/irongit /out/irongit \
42 && cp target/x86_64-unknown-linux-musl/release/ig /out/ig
43
44# ---- Runtime ------------------------------------------------------------------
45FROM debian:trixie-slim AS runtime
46# git serves every push, clone and page; postgresql-client (17) is for backups.
47RUN apt-get update \
48 && apt-get install -y --no-install-recommends ca-certificates git postgresql-client wget \
49 && rm -rf /var/lib/apt/lists/* \
50 && groupadd --system --gid 10001 irongit \
51 && useradd --system --uid 10001 --gid irongit --home-dir /data --no-create-home --shell /usr/sbin/nologin irongit \
52 && mkdir -p /data \
53 && chown irongit:irongit /data \
54 && chmod 0750 /data
55
56COPY --from=rust --chown=root:root --chmod=0755 /out/irongit /usr/local/bin/irongit
57COPY --from=rust --chown=root:root --chmod=0755 /out/ig /usr/local/share/irongit/ig
58
59USER irongit
60ENV HOST=0.0.0.0 \
61 PORT=7878 \
62 SSH_PORT=2222 \
63 DATA_DIR=/data \
64 HOME=/data \
65 MALLOC_ARENA_MAX=2 \
66 RUST_LOG=info
67EXPOSE 7878 2222
68VOLUME ["/data"]
69HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=6 \
70 CMD wget -q -O /dev/null http://127.0.0.1:7878/api/health || exit 1
71ENTRYPOINT ["/usr/local/bin/irongit"]
72CMD ["serve"]