Skip to content

add Dockerfile #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Propfend wants to merge 1 commit into
base: main
Choose a base branch
from
Open

add Dockerfile #32

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
FROM rust:latest
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using rust:latest as the base image is non-deterministic. The latest tag can change at any time, meaning two builds at different times may produce different results. This also means the image may silently break if a new version of Rust introduces breaking changes. Pin the base image to a specific version (e.g., rust:1.86 or rust:1.86-slim) to ensure reproducible builds.

Suggested change
FROM rust:latest
FROM rust:1.86

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The project's rust-toolchain file specifies nightly, but rust:latest ships with the stable toolchain. While rustup will automatically install the nightly toolchain when the rust-toolchain file is read during cargo build, this adds significant build time (downloading the entire nightly toolchain) on every fresh build. Consider using rust:nightly as the base image instead, which already has the nightly toolchain installed and is more consistent with the project's requirements.

Suggested change
FROM rust:latest
FROM rust:nightly

Copilot uses AI. Check for mistakes.

ENV RUSTUP_HOME=/usr/local/rustup \
CARGO_HOME=/usr/local/cargo \
PATH=/usr/local/cargo/bin:$PATH

Comment on lines +3 to +6
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rust:latest base image already sets RUSTUP_HOME, CARGO_HOME, and PATH to exactly these values. Re-declaring them here is redundant and could mislead maintainers into thinking these values are being changed or are not already set by the base image.

Suggested change
ENV RUSTUP_HOME=/usr/local/rustup \
CARGO_HOME=/usr/local/cargo \
PATH=/usr/local/cargo/bin:$PATH

Copilot uses AI. Check for mistakes.
WORKDIR /app

RUN git clone https://github.com/intentee/poet.git .

RUN make
Comment on lines +9 to +11
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Dockerfile performs git clone https://github.com/intentee/poet.git . followed by make, pulling and executing remote code at build time without pinning it to an immutable commit or verifying its integrity. If the GitHub repository or its default branch is compromised, any subsequent image build will transparently incorporate and execute attacker-controlled code, potentially leading to a malicious image or build-time code execution. To reduce supply chain risk, fetch only first-party source from the build context or pin the dependency to a specific trusted commit or release and verify its integrity before building.

Copilot uses AI. Check for mistakes.

RUN mv target/release/poet /usr/local/bin/poet
Comment on lines +11 to +13
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The final image contains the entire Rust toolchain, all downloaded crate sources, and build artifacts, which will result in a very large image (typically several gigabytes). Since the poet binary is the only runtime artifact needed, a multi-stage build should be used: one stage to compile the binary (using the rust base image) and a second, minimal stage (e.g., debian:bookworm-slim or scratch) to copy just the compiled binary into a much smaller runtime image.

Copilot uses AI. Check for mistakes.

ENTRYPOINT ["poet"]