b4921d51a0
Some checks failed
CI Pipeline / Rust Format Check (pull_request) Successful in 6s
CI Pipeline / Clippy Lints (pull_request) Successful in 54s
CI Pipeline / Rust Unit Tests (pull_request) Failing after 1m20s
CI Pipeline / Security Audit (pull_request) Successful in 5s
CI Pipeline / Frontend Lint & Type Check (pull_request) Successful in 15s
CI Pipeline / Build .deb & Release (pull_request) Has been skipped
The project targets Ubuntu 24.04, not Debian Bookworm. Ubuntu 24.04 includes PostgreSQL 16 in default repos, eliminating the need for the PGDG APT repo workaround. Also fixes libssl3 → libssl3t64 package name for the time64 transition in Ubuntu 24.04.
112 lines
3.8 KiB
Docker
112 lines
3.8 KiB
Docker
# =============================================================================
|
|
# Linux Patch Manager — Multi-stage Docker Build
|
|
# =============================================================================
|
|
# Build: docker build -t linux-patch-manager .
|
|
# Run: docker compose up
|
|
# =============================================================================
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 1: Rust build
|
|
# ---------------------------------------------------------------------------
|
|
FROM rust:1.82-bookworm AS rust-builder
|
|
|
|
RUN apt-get update && apt-get install -y \
|
|
pkg-config \
|
|
libssl-dev \
|
|
libfontconfig1-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /usr/src/app
|
|
|
|
# Cache dependencies by building a dummy project first
|
|
COPY Cargo.toml Cargo.lock ./
|
|
RUN mkdir -p crates/pm-web/src crates/pm-worker/src crates/pm-core/src \
|
|
crates/pm-agent-client/src crates/pm-auth/src crates/pm-ca/src \
|
|
crates/pm-reports/src crates/migrate-secrets/src
|
|
RUN echo 'fn main(){}' > crates/pm-web/src/main.rs \
|
|
&& echo 'fn main(){}' > crates/pm-worker/src/main.rs \
|
|
&& echo '' > crates/pm-core/src/lib.rs \
|
|
&& echo '' > crates/pm-agent-client/src/lib.rs \
|
|
&& echo '' > crates/pm-auth/src/lib.rs \
|
|
&& echo '' > crates/pm-ca/src/lib.rs \
|
|
&& echo '' > crates/pm-reports/src/lib.rs \
|
|
&& echo 'fn main(){}' > crates/migrate-secrets/src/main.rs
|
|
RUN cargo build --release 2>/dev/null || true
|
|
|
|
# Now build the real project
|
|
COPY crates/ crates/
|
|
RUN cargo build --release
|
|
|
|
# Verify binaries exist
|
|
RUN ls -la target/release/pm-web target/release/pm-worker
|
|
|
|
# Strip debug symbols
|
|
RUN strip target/release/pm-web target/release/pm-worker
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 2: Frontend build
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:20-bookworm-slim AS frontend-builder
|
|
|
|
WORKDIR /usr/src/app/frontend
|
|
COPY frontend/package.json frontend/package-lock.json ./
|
|
RUN npm ci --production=false
|
|
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 3: Runtime
|
|
# ---------------------------------------------------------------------------
|
|
FROM ubuntu:24.04 AS runtime
|
|
|
|
RUN apt-get update && apt-get install -y \
|
|
ca-certificates \
|
|
libssl3t64 \
|
|
libfontconfig1 \
|
|
postgresql-client-16 \
|
|
argon2 \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create service user
|
|
RUN useradd --system --no-create-home --shell /usr/sbin/nologin \
|
|
--comment "Linux Patch Manager service account" patch-manager
|
|
|
|
# Create directories
|
|
RUN mkdir -p /etc/patch-manager/ca /etc/patch-manager/certs \
|
|
/etc/patch-manager/jwt /etc/patch-manager/tls \
|
|
/var/log/patch-manager /opt/patch-manager \
|
|
/usr/share/patch-manager/frontend \
|
|
/usr/share/patch-manager/migrations
|
|
|
|
# Copy binaries
|
|
COPY --from=rust-builder /usr/src/app/target/release/pm-web /usr/local/bin/pm-web
|
|
COPY --from=rust-builder /usr/src/app/target/release/pm-worker /usr/local/bin/pm-worker
|
|
|
|
# Copy frontend
|
|
COPY --from=frontend-builder /usr/src/app/frontend/dist/ /usr/share/patch-manager/frontend/
|
|
|
|
# Copy migrations
|
|
COPY migrations/ /usr/share/patch-manager/migrations/
|
|
|
|
# Copy entrypoint
|
|
COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod 755 /usr/local/bin/entrypoint.sh
|
|
|
|
# Copy config template
|
|
COPY config/config.example.toml /usr/share/patch-manager/config.example.toml
|
|
|
|
# Set ownership
|
|
RUN chown -R patch-manager:patch-manager \
|
|
/etc/patch-manager /var/log/patch-manager \
|
|
/opt/patch-manager /usr/share/patch-manager
|
|
|
|
# Expose HTTPS port
|
|
EXPOSE 443
|
|
|
|
# Volume for persistent data
|
|
VOLUME ["/etc/patch-manager", "/var/log/patch-manager", "/opt/patch-manager"]
|
|
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|