lanes/Dockerfile at master · litvancom/lanes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# Lanes — multi-stage Docker build (D-22, PLAT-02)
#
# Stage 1: Builder (nightly-trixie — matches Leptos official Dockerfile)
#   Installs cargo-leptos, wasm32 target, binaryen, sass, clang, then
#   builds the release binary + WASM site assets via `cargo leptos build --release`.
#
# Stage 2: Runtime (debian:trixie-slim)
#   Copies only the binary and site assets; runs as non-root `lanes` user.
#   All secrets injected at runtime via ENV — nothing baked into the image (T-07-23).
#
# Usage:
#   docker compose up --build           # production (see compose.yml)
#   docker build -t lanes .             # standalone build

# ── Builder stage ─────────────────────────────────────────────────────────────
FROM rustlang/rust:nightly-trixie AS builder

# System deps for cargo-leptos: clang (for ring/openssl), sass, binaryen (wasm-opt)
RUN apt-get update -y \
    && apt-get install -y --no-install-recommends \
        clang \
        pkg-config \
        libssl-dev \
    && apt-get autoremove -y \
    && apt-get clean -y \
    && rm -rf /var/lib/apt/lists/*

# Install cargo-binstall for fast binary installs
RUN wget -q https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz \
    && tar -xvf cargo-binstall-x86_64-unknown-linux-musl.tgz \
    && cp cargo-binstall /usr/local/cargo/bin \
    && rm cargo-binstall-x86_64-unknown-linux-musl.tgz

# Install cargo-leptos (0.3.6 — compatible with Leptos 0.8, CLAUDE.md)
RUN cargo binstall cargo-leptos --version 0.3.6 -y

WORKDIR /app
COPY . .

# WASM compilation target — added AFTER `COPY . .` so rust-toolchain.toml
# (channel = "stable") is in scope; the target must be installed for the toolchain
# the build actually selects, not the image's default nightly (otherwise the wasm
# build fails with E0463 "can't find crate for core").
RUN rustup target add wasm32-unknown-unknown

# SQLx compile-time query verification uses the committed .sqlx/ offline cache —
# there is no DATABASE_URL at build time. Regenerate via `cargo sqlx prepare`
# whenever query! macros change, and commit the .sqlx/ directory.
ENV SQLX_OFFLINE=true

# Build release: binary → target/release/lanes; site assets → target/site/
RUN cargo leptos build --release -vv

# ── Runtime stage ─────────────────────────────────────────────────────────────
FROM debian:trixie-slim AS runtime

WORKDIR /app

# Runtime deps: openssl (TLS), ca-certificates (HTTPS/S3 root CAs)
RUN apt-get update -y \
    && apt-get install -y --no-install-recommends \
        openssl \
        ca-certificates \
        curl \
    && apt-get autoremove -y \
    && apt-get clean -y \
    && rm -rf /var/lib/apt/lists/*

# Non-root user for container isolation (D-22, T-07-22)
RUN useradd -r -s /bin/false lanes

# Pre-create the data dir owned by the non-root user. When the named volume (D-24)
# is first mounted at /data, Docker seeds it with this directory's ownership, so the
# non-root `lanes` process can create /data/lanes.db. Without this the fresh volume is
# root-owned and SQLite fails with SQLITE_CANTOPEN (code 14).
RUN mkdir -p /data && chown lanes:lanes /data

# Copy binary and static site assets from builder
COPY --from=builder /app/target/release/lanes /app/lanes
COPY --from=builder /app/target/site /app/site

# Runtime defaults — all overridable via ENV at compose/run time (D-24)
ENV RUST_LOG="info"
ENV LEPTOS_SITE_ADDR="0.0.0.0:3000"
ENV LEPTOS_SITE_ROOT="site"

EXPOSE 3000

USER lanes

CMD ["/app/lanes"]