deploy/server/Dockerfile

Ref: Size: 728 B History

# eitri-server production image: static Go binaries (pure-Go sqlite, no CGO)
# on distroless/static — CA roots included for OIDC discovery, runs as nonroot
# (uid 65532). The console SPA is embedded in the binary; state lives on the
# mounted PVC and config in the mounted server.json Secret.
#
# eitri-oidc rides along as a second entrypoint. A plane with no external
# identity provider runs it as its own Deployment off this same image, so the
# issuer can never be a different version than the server it authenticates for
# — and a plane fronted by a real IdP simply never starts it.
FROM gcr.io/distroless/static-debian12:nonroot
COPY eitri-server /eitri-server
COPY eitri-oidc /eitri-oidc
ENTRYPOINT ["/eitri-server"]