1a704bd6ba
* docker: a server image and a multi-arch build workflow The image is the terminal-only binary built with -tags nogui on distroless static, run as nonroot with magpie's files on a /config volume, created and chowned at build time so a fresh named volume is writable by uid 65532. The workflow builds amd64 and arm64 on native runners, smoke-tests each image before anything is pushed (ready probe, unknown-model 4xx JSON, /config write), pushes by digest, merges a multi-arch manifest (semver trio plus latest on v* tags, edge otherwise) and attests build provenance. PR runs build and smoke-test only. The README documents running the image, the web UI mode, and why subscription sign-ins must start where a browser shares loopback with magpie. Co-Authored-By: glm-5.3-flash <hakase@ooooo.space> Generated-By: omp 18.4.3 * docker: README publishes the ports on the host's loopback and says how to require a key — until the gateway is shared from Settings it takes any key from anyone who reaches it, and Docker's -p 3425:3425 puts it on every interface of the host past its firewall. Checked in the built image: with settings lan+lanKey a request from the host through the published port without the key gets 401 and with it 200; without them any key gets 200. --------- Co-authored-by: glm-5.3-flash <hakase@ooooo.space> Co-authored-by: yetone <yetoneful@gmail.com>
29 lines
531 B
Docker
29 lines
531 B
Docker
FROM golang:1.26-alpine AS build
|
|
|
|
WORKDIR /src
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
RUN CGO_ENABLED=0 go build -tags nogui -trimpath \
|
|
-ldflags "-s -w -X main.version=${VERSION}" -o /out/magpie . \
|
|
&& mkdir /config
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
COPY --from=build /out/magpie /magpie
|
|
COPY --from=build --chown=65532:65532 /config /config
|
|
|
|
ENV XDG_CONFIG_HOME=/config \
|
|
MAGPIE_ADDR=0.0.0.0:3425
|
|
|
|
VOLUME /config
|
|
|
|
EXPOSE 3425 3430
|
|
|
|
ENTRYPOINT ["/magpie"]
|
|
CMD ["serve"]
|