-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dockerfile
107 lines (82 loc) · 2.88 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# Use dotnet runtime deps to gather all dependencies
FROM mcr.microsoft.com/dotnet/aspnet:7.0.2-alpine3.17 as base-builder
# Create appuser.
ENV USER=dotnet
ENV UID=245000
# See https://stackoverflow.com/a/55757473/12429735RUN
RUN adduser \
--disabled-password \
--gecos "" \
--home "/nonexistent" \
--shell "/sbin/nologin" \
--no-create-home \
--uid "${UID}" \
"${USER}"
RUN mkdir -p /tmp
RUN chown ${USER} /tmp
FROM base-builder as builder
# Cleanup /lib
RUN find /lib -type d -empty -delete && \
rm -r /lib/apk && \
rm -r /lib/sysctl.d
RUN find / -xdev -perm -4000 -type f -exec chmod a-s {} \;
FROM base-builder as globalization-builder
RUN apk add --no-cache \
icu-libs \
icu-data-full \
tzdata
# Cleanup /lib
RUN find /lib -type d -empty -delete && \
rm -r /lib/apk && \
rm -r /lib/sysctl.d
RUN find / -xdev -perm -4000 -type f -exec chmod a-s {} \;
# Create runtime image
FROM scratch as runtime-deps
ENV USER=dotnet
ENV UID=245000
ENV DOTNET_ROOT=/.dotnet
ARG TARGETARCH
COPY --from=builder /lib/ /lib
COPY --from=builder /tmp/ /tmp
COPY --from=builder /usr/lib /usr/lib
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=builder /etc/passwd /etc/passwd
COPY --from=builder /etc/group /etc/group
# chmod hack: extract tmp.tar file with correct flags
# see https://github.com/GoogleContainerTools/distroless/blob/main/base/tmp.tar
ADD tmp.tar .
ENV ASPNETCORE_URLS=http://+:80 \
DOTNET_RUNNING_IN_CONTAINER=true \
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true \
TMPDIR=/tmp \
PATH=$PATH:$DOTNET_ROOT:$DOTNET_ROOT/tools
USER $UID:$UID
# Create runtime image
FROM runtime-deps as aspnet
COPY --from=builder /usr/share/dotnet $DOTNET_ROOT
# Create runtime image
FROM scratch as runtime-deps-globalization
ENV USER=dotnet
ENV UID=245000
ENV DOTNET_ROOT=/.dotnet
ARG TARGETARCH
COPY --from=globalization-builder /lib/ /lib
COPY --from=globalization-builder /tmp/ /tmp
COPY --from=globalization-builder /usr/lib /usr/lib
COPY --from=globalization-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=globalization-builder /usr/share/icu /usr/share/icu
COPY --from=globalization-builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=globalization-builder /etc/passwd /etc/passwd
COPY --from=globalization-builder /etc/group /etc/group
# chmod hack: extract tmp.tar file with correct flags
# see https://github.com/GoogleContainerTools/distroless/blob/main/base/tmp.tar
ADD tmp.tar .
ENV ASPNETCORE_URLS=http://+:80 \
DOTNET_RUNNING_IN_CONTAINER=true \
DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false \
TMPDIR=/tmp \
PATH=$PATH:$DOTNET_ROOT:$DOTNET_ROOT/tools
USER $UID:$UID
# Create runtime image
FROM runtime-deps-globalization as aspnet-globalization
COPY --from=globalization-builder /usr/share/dotnet $DOTNET_ROOT