36 lines
1.4 KiB
Docker
36 lines
1.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# --- Build stage -----------------------------------------------------------
|
|
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
|
|
# Download modules first so the layer caches unless go.mod/go.sum change.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# Static, stripped binary. CGO is off so it runs on a scratch/distroless base.
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/dyzur-bot ./cmd/dyzur-bot
|
|
|
|
# Writable cache dir, created here so it can be copied in with nonroot ownership.
|
|
RUN mkdir /data
|
|
|
|
# --- Runtime stage ---------------------------------------------------------
|
|
# distroless static includes CA certificates (needed for HTTPS to Google) and
|
|
# runs as the unprivileged "nonroot" user by default. Timezone data is embedded
|
|
# in the binary via the time/tzdata import, so no system zoneinfo is required.
|
|
FROM gcr.io/distroless/static:nonroot
|
|
COPY --from=build /out/dyzur-bot /usr/local/bin/dyzur-bot
|
|
# 65532 is the distroless "nonroot" uid/gid; use the numeric form so it resolves
|
|
# without depending on /etc/passwd name lookup in the target image.
|
|
COPY --from=build --chown=65532:65532 /data /data
|
|
|
|
# Persist the rota cache to /data — mount a volume here to survive restarts.
|
|
ENV ROTA_CACHE_PATH=/data/rota.json
|
|
WORKDIR /data
|
|
|
|
# Long polling: run EXACTLY ONE instance per bot token. Two concurrent pollers
|
|
# get HTTP 409 Conflict from Telegram and drop updates.
|
|
ENTRYPOINT ["/usr/local/bin/dyzur-bot"]
|