huncholaneGit hosting and a container registry in one Rust binary (axum + Astro)
| 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # irongit: server (axum + embedded Astro build) plus the static ig CLI, which |
| 3 | # the server publishes to R2 for install.sh and `ig upgrade`. |
| 4 | # docker build -t irongit . |
| 5 | |
| 6 | # ---- Frontend ----------------------------------------------------------------- |
| 7 | FROM oven/bun:1.4 AS frontend |
| 8 | WORKDIR /src/frontend |
| 9 | COPY frontend/package.json frontend/bun.lock ./ |
| 10 | RUN bun install --frozen-lockfile |
| 11 | COPY frontend/ ./ |
| 12 | # The backend's Rust templates use Tailwind classes too; the CSS build scans them. |
| 13 | COPY backend/src /src/backend/src |
| 14 | RUN bun run build |
| 15 | |
| 16 | # ---- Rust --------------------------------------------------------------------- |
| 17 | FROM rust:1-trixie AS rust |
| 18 | RUN apt-get update \ |
| 19 | && apt-get install -y --no-install-recommends musl-tools \ |
| 20 | && rm -rf /var/lib/apt/lists/* \ |
| 21 | && rustup target add x86_64-unknown-linux-musl |
| 22 | WORKDIR /src |
| 23 | COPY Cargo.toml Cargo.lock ./ |
| 24 | COPY backend/ backend/ |
| 25 | COPY cli/ cli/ |
| 26 | COPY shared/ shared/ |
| 27 | COPY --from=frontend /src/frontend/dist frontend/dist |
| 28 | # Cache mounts keep the registry and build artifacts between image builds; |
| 29 | # the binaries are copied out of the cache within the same step. |
| 30 | RUN --mount=type=cache,target=/usr/local/cargo/registry \ |
| 31 | --mount=type=cache,target=/src/target \ |
| 32 | cargo build --release --locked -p irongit --no-default-features \ |
| 33 | && cargo build --release --locked -p ig --target x86_64-unknown-linux-musl \ |
| 34 | && mkdir -p /out \ |
| 35 | && cp target/release/irongit /out/irongit \ |
| 36 | && cp target/x86_64-unknown-linux-musl/release/ig /out/ig |
| 37 | |
| 38 | # ---- Runtime ------------------------------------------------------------------ |
| 39 | FROM debian:trixie-slim AS runtime |
| 40 | # git serves every push, clone and page; postgresql-client (17) is for backups. |
| 41 | RUN apt-get update \ |
| 42 | && apt-get install -y --no-install-recommends ca-certificates git postgresql-client wget \ |
| 43 | && rm -rf /var/lib/apt/lists/* \ |
| 44 | && groupadd --system --gid 10001 irongit \ |
| 45 | && useradd --system --uid 10001 --gid irongit --home-dir /data --no-create-home --shell /usr/sbin/nologin irongit \ |
| 46 | && mkdir -p /data \ |
| 47 | && chown irongit:irongit /data \ |
| 48 | && chmod 0750 /data |
| 49 | |
| 50 | COPY --from=rust --chown=root:root --chmod=0755 /out/irongit /usr/local/bin/irongit |
| 51 | COPY --from=rust --chown=root:root --chmod=0755 /out/ig /usr/local/share/irongit/ig |
| 52 | |
| 53 | USER irongit |
| 54 | ENV HOST=0.0.0.0 \ |
| 55 | PORT=7878 \ |
| 56 | SSH_PORT=2222 \ |
| 57 | DATA_DIR=/data \ |
| 58 | HOME=/data \ |
| 59 | MALLOC_ARENA_MAX=2 \ |
| 60 | RUST_LOG=info |
| 61 | EXPOSE 7878 2222 |
| 62 | VOLUME ["/data"] |
| 63 | HEALTHCHECK --interval=10s --timeout=5s --start-period=20s --retries=6 \ |
| 64 | CMD wget -q -O /dev/null http://127.0.0.1:7878/api/health || exit 1 |
| 65 | ENTRYPOINT ["/usr/local/bin/irongit"] |
| 66 | CMD ["serve"] |