diff --git a/docker/server.Dockerfile b/docker/server.Dockerfile index e8d5c16..33f0a29 100644 --- a/docker/server.Dockerfile +++ b/docker/server.Dockerfile @@ -4,9 +4,9 @@ ARG FIPS_ON=on ARG ALPINE_VERSION=3.23 ARG GO_VERSION=1.25.5 -FROM alpine:${ALPINE_VERSION} AS grpc_health_probe +FROM registry.opensuse.org/opensuse/bci/bci-base-fips:20260106.0-16.10 AS grpc_health_probe -RUN apk add --no-cache curl ca-certificates +RUN zypper --non-interactive install --no-recommends curl ca-certificates ENV GRPC_HEALTH_PROBE_VERSION=v0.4.43 ENV TARGETOS=linux @@ -15,7 +15,7 @@ ENV TARGETARCH=amd64 RUN curl -sfLo /bin/grpc_health_probe https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-${TARGETOS}-${TARGETARCH} && \ chmod +x /bin/grpc_health_probe -FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS builder +FROM registry.opensuse.org/opensuse/bci/golang:1.25.5 AS builder WORKDIR /usr/src/app @@ -23,12 +23,12 @@ COPY go.sum go.mod ./ RUN go mod tidy && go mod verify COPY . . -RUN GODEBUG=fips140=$FIPS_ON CGO_ENABLED=0 go build -o /bin/server ./cmd/server +RUN CGO_ENABLED=0 go build -o /bin/dino ./cmd/server -FROM gcr.io/distroless/static AS final +FROM registry.opensuse.org/opensuse/bci/bci-micro-fips:20260105.0-10.15 COPY --chown=65532:65532 --chmod=0755 --from=grpc_health_probe /bin/grpc_health_probe /usr/bin/grpc_health_probe -COPY --chown=65532:65532 --chmod=0755 --from=builder /bin/server /usr/bin/server +COPY --chown=65532:65532 --chmod=0755 --from=builder /bin/dino /usr/bin/dino USER 65532 @@ -39,5 +39,5 @@ HEALTHCHECK --interval=30s --timeout=10s \ EXPOSE 50051 4242 -ENTRYPOINT [ "/usr/bin/server" ] +ENTRYPOINT [ "dino" ] CMD [ ] diff --git a/docker/tunnel.Dockerfile b/docker/tunnel.Dockerfile index fe0d698..9f72fb9 100644 --- a/docker/tunnel.Dockerfile +++ b/docker/tunnel.Dockerfile @@ -2,7 +2,7 @@ ARG ALPINE_VERSION=3.23 ARG GO_VERSION=1.25.5 -FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} +FROM registry.opensuse.org/opensuse/bci/golang:1.25.5 AS builder WORKDIR /usr/src/app @@ -10,6 +10,13 @@ COPY go.sum go.mod ./ RUN go mod tidy && go mod verify COPY . . -RUN CGO_ENABLED=0 go build -o /usr/local/bin/tunnel ./cmd/tunnel +RUN CGO_ENABLED=0 go build -o /bin/tunnel ./cmd/tunnel -CMD [ "tunnel" ] \ No newline at end of file +FROM registry.opensuse.org/opensuse/bci/bci-micro-fips:20260105.0-10.15 + +COPY --chown=65532:65532 --chmod=0755 --from=builder /bin/dino /usr/bin/dino + +USER 65532 + +ENTRYPOINT [ "tunnel" ] +CMD [ ]