mirror of
https://github.com/andwati/telecom-platform.git
synced 2026-10-18 11:02:54 +00:00
refactor: Enhance all Dockerfiles with security hardening, optimization, and production best practices
- Add maintainer and description labels to all build and runtime stages - Change builder WORKDIR from /app to /build for clarity - Install build dependencies with --no-cache/--no-install-recommends flags - Add build optimizations: -ldflags="-w -s -extldflags '-static'" and -trimpath for Go, strip for Rust - Implement dependency caching strategy for Rust builds (dummy app pattern) - Pin Alpine base
This commit is contained in:
nutcas3
@@ -1,22 +1,63 @@
|
||||
# Build stage
|
||||
FROM golang:1.26-alpine AS builder
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="API Server for Telecom Platform"
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install build dependencies
|
||||
RUN apk add --no-cache git ca-certificates
|
||||
|
||||
# Copy dependency files
|
||||
COPY apps/api-server/go.mod apps/api-server/go.sum ./
|
||||
RUN go mod download
|
||||
|
||||
# Copy source code
|
||||
COPY apps/api-server/ ./
|
||||
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -o api-server .
|
||||
# Build with optimizations
|
||||
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
|
||||
-ldflags="-w -s -extldflags '-static'" \
|
||||
-trimpath \
|
||||
-o api-server .
|
||||
|
||||
FROM alpine:latest
|
||||
# Runtime stage
|
||||
FROM alpine:3.20
|
||||
|
||||
RUN apk --no-cache add ca-certificates
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="API Server for Telecom Platform" \
|
||||
version="1.0.0"
|
||||
|
||||
WORKDIR /root/
|
||||
# Install runtime dependencies
|
||||
RUN apk add --no-cache ca-certificates tzdata
|
||||
|
||||
COPY --from=builder /app/api-server .
|
||||
# Create non-root user
|
||||
RUN addgroup -g 1000 appuser && \
|
||||
adduser -D -u 1000 -G appuser appuser
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Copy binary from builder
|
||||
COPY --from=builder /build/api-server .
|
||||
|
||||
# Change ownership
|
||||
RUN chown -R appuser:appuser /app
|
||||
|
||||
# Switch to non-root user
|
||||
USER appuser
|
||||
|
||||
# Expose port
|
||||
EXPOSE 8000
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider http://localhost:8000/v1/health || exit 1
|
||||
|
||||
# Set environment variables
|
||||
ENV GIN_MODE=release
|
||||
|
||||
# Signal handling
|
||||
STOPSIGNAL SIGTERM
|
||||
|
||||
CMD ["./api-server"]
|
||||
|
||||
@@ -1,20 +1,63 @@
|
||||
# Build stage
|
||||
FROM golang:1.26-alpine AS builder
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Carrier Connector for Telecom Platform"
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install build dependencies
|
||||
RUN apk add --no-cache git ca-certificates
|
||||
|
||||
# Copy dependency files
|
||||
COPY apps/carrier-connector/go.mod apps/carrier-connector/go.sum ./
|
||||
RUN go mod download
|
||||
|
||||
# Copy source code
|
||||
COPY apps/carrier-connector/ ./
|
||||
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -o carrier-connector .
|
||||
# Build with optimizations
|
||||
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
|
||||
-ldflags="-w -s -extldflags '-static'" \
|
||||
-trimpath \
|
||||
-o carrier-connector .
|
||||
|
||||
FROM alpine:latest
|
||||
# Runtime stage
|
||||
FROM alpine:3.20
|
||||
|
||||
RUN apk --no-cache add ca-certificates
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Carrier Connector for Telecom Platform" \
|
||||
version="1.0.0"
|
||||
|
||||
WORKDIR /root/
|
||||
# Install runtime dependencies
|
||||
RUN apk add --no-cache ca-certificates tzdata
|
||||
|
||||
COPY --from=builder /app/carrier-connector .
|
||||
# Create non-root user
|
||||
RUN addgroup -g 1000 appuser && \
|
||||
adduser -D -u 1000 -G appuser appuser
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Copy binary from builder
|
||||
COPY --from=builder /build/carrier-connector .
|
||||
|
||||
# Change ownership
|
||||
RUN chown -R appuser:appuser /app
|
||||
|
||||
# Switch to non-root user
|
||||
USER appuser
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider http://localhost:9000/health || exit 1
|
||||
|
||||
# Expose port
|
||||
EXPOSE 9000
|
||||
|
||||
# Set environment variables
|
||||
ENV GIN_MODE=release
|
||||
|
||||
# Signal handling
|
||||
STOPSIGNAL SIGTERM
|
||||
|
||||
CMD ["./carrier-connector"]
|
||||
|
||||
@@ -1,27 +1,73 @@
|
||||
# Build stage
|
||||
FROM rust:1.95-slim AS builder
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Charging Engine for Telecom Platform"
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
WORKDIR /build
|
||||
|
||||
# Install build dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
pkg-config \
|
||||
libssl-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
COPY apps/charging-engine ./apps/charging-engine
|
||||
|
||||
RUN cargo build --release --bin charging-engine
|
||||
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy Cargo files for better layer caching
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
|
||||
# Create a dummy app to cache dependencies
|
||||
RUN mkdir -p apps/charging-engine/src && \
|
||||
echo "fn main() {}" > apps/charging-engine/src/main.rs && \
|
||||
cargo build --release --bin charging-engine && \
|
||||
rm -rf apps/charging-engine/src
|
||||
|
||||
# Copy actual source code
|
||||
COPY apps/charging-engine ./apps/charging-engine
|
||||
|
||||
# Build with optimizations
|
||||
RUN cargo build --release --bin charging-engine && \
|
||||
strip /build/target/release/charging-engine
|
||||
|
||||
# Runtime stage
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Charging Engine for Telecom Platform" \
|
||||
version="1.0.0"
|
||||
|
||||
# Install runtime dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
ca-certificates \
|
||||
tzdata \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Create non-root user
|
||||
RUN groupadd -r appuser && \
|
||||
useradd -r -g appuser -u 1000 appuser
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY --from=builder /app/target/release/charging-engine .
|
||||
# Copy binary from builder
|
||||
COPY --from=builder /build/target/release/charging-engine .
|
||||
|
||||
# Change ownership
|
||||
RUN chown -R appuser:appuser /app
|
||||
|
||||
# Switch to non-root user
|
||||
USER appuser
|
||||
|
||||
# Expose port
|
||||
EXPOSE 8080
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider http://localhost:8080/v1/health || exit 1
|
||||
|
||||
# Set environment variables
|
||||
ENV RUST_LOG=info
|
||||
|
||||
# Signal handling
|
||||
STOPSIGNAL SIGTERM
|
||||
|
||||
CMD ["./charging-engine"]
|
||||
|
||||
@@ -1,20 +1,53 @@
|
||||
# Build stage
|
||||
FROM golang:1.26-alpine AS builder
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="CLI for Telecom Platform"
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install build dependencies
|
||||
RUN apk add --no-cache git ca-certificates
|
||||
|
||||
# Copy dependency files
|
||||
COPY apps/cli/go.mod apps/cli/go.sum ./
|
||||
RUN go mod download
|
||||
|
||||
# Copy source code
|
||||
COPY apps/cli/ ./
|
||||
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -o cli .
|
||||
# Build with optimizations
|
||||
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
|
||||
-ldflags="-w -s -extldflags '-static'" \
|
||||
-trimpath \
|
||||
-o telecom-cli .
|
||||
|
||||
FROM alpine:latest
|
||||
# Runtime stage
|
||||
FROM alpine:3.20
|
||||
|
||||
RUN apk --no-cache add ca-certificates
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="CLI for Telecom Platform" \
|
||||
version="1.0.0"
|
||||
|
||||
WORKDIR /root/
|
||||
# Install runtime dependencies
|
||||
RUN apk add --no-cache ca-certificates tzdata
|
||||
|
||||
COPY --from=builder /app/cli .
|
||||
# Create non-root user
|
||||
RUN addgroup -g 1000 appuser && \
|
||||
adduser -D -u 1000 -G appuser appuser
|
||||
|
||||
CMD ["./cli"]
|
||||
WORKDIR /app
|
||||
|
||||
# Copy binary from builder
|
||||
COPY --from=builder /build/telecom-cli .
|
||||
|
||||
# Change ownership
|
||||
RUN chown -R appuser:appuser /app
|
||||
|
||||
# Switch to non-root user
|
||||
USER appuser
|
||||
|
||||
# Signal handling
|
||||
STOPSIGNAL SIGTERM
|
||||
|
||||
CMD ["./telecom-cli"]
|
||||
|
||||
@@ -1,41 +1,79 @@
|
||||
FROM rust:1.95-slim as builder
|
||||
# Build stage
|
||||
FROM rust:1.95-slim AS builder
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Packet Gateway for Telecom Platform"
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install build dependencies
|
||||
RUN apt-get update && apt-get install -y \
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
pkg-config \
|
||||
libssl-dev \
|
||||
clang \
|
||||
llvm \
|
||||
libelf-dev \
|
||||
libbpf-dev \
|
||||
ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy Cargo files
|
||||
# Copy Cargo files for better layer caching
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
|
||||
# Create a dummy app to cache dependencies
|
||||
RUN mkdir -p apps/packet-gateway/src && \
|
||||
echo "fn main() {}" > apps/packet-gateway/src/main.rs && \
|
||||
cargo build --release --bin packet-gateway && \
|
||||
rm -rf apps/packet-gateway/src
|
||||
|
||||
# Copy actual source code
|
||||
COPY apps/packet-gateway ./apps/packet-gateway
|
||||
COPY apps/charging-engine/src/circuit_breaker.rs ./apps/charging-engine/src/circuit_breaker.rs
|
||||
|
||||
# Build the packet-gateway binary
|
||||
RUN cargo build --release --bin packet-gateway
|
||||
# Build with optimizations
|
||||
RUN cargo build --release --bin packet-gateway && \
|
||||
strip /build/target/release/packet-gateway
|
||||
|
||||
# Runtime stage
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Packet Gateway for Telecom Platform" \
|
||||
version="1.0.0"
|
||||
|
||||
# Install runtime dependencies
|
||||
RUN apt-get update && apt-get install -y \
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
libssl3 \
|
||||
ca-certificates \
|
||||
tzdata \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy the binary from builder
|
||||
COPY --from=builder /app/target/release/packet-gateway /app/packet-gateway
|
||||
# Create non-root user
|
||||
RUN groupadd -r appuser && \
|
||||
useradd -r -g appuser -u 1000 appuser
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Copy binary from builder
|
||||
COPY --from=builder /build/target/release/packet-gateway /app/packet-gateway
|
||||
|
||||
# Change ownership
|
||||
RUN chown -R appuser:appuser /app
|
||||
|
||||
# Switch to non-root user
|
||||
USER appuser
|
||||
|
||||
# Expose port
|
||||
EXPOSE 9090
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider http://localhost:9090/health || exit 1
|
||||
|
||||
# Set environment variables
|
||||
ENV RUST_LOG=info
|
||||
|
||||
# Run the binary
|
||||
# Signal handling
|
||||
STOPSIGNAL SIGTERM
|
||||
|
||||
CMD ["/app/packet-gateway"]
|
||||
|
||||
@@ -1,30 +1,71 @@
|
||||
# Build stage
|
||||
FROM node:22-alpine AS builder
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Web Dashboard for Telecom Platform"
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
RUN corepack enable
|
||||
|
||||
# Copy dependency files for better layer caching
|
||||
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
||||
COPY apps/web-dashboard ./apps/web-dashboard
|
||||
|
||||
# Install dependencies
|
||||
RUN pnpm install --frozen-lockfile
|
||||
|
||||
# Copy source code
|
||||
COPY apps/web-dashboard ./apps/web-dashboard
|
||||
|
||||
# Build with optimizations
|
||||
RUN pnpm --filter web-dashboard build
|
||||
|
||||
# Runtime stage
|
||||
FROM node:22-alpine
|
||||
|
||||
WORKDIR /app
|
||||
LABEL maintainer="nutcas3 <[email protected]>" \
|
||||
description="Web Dashboard for Telecom Platform" \
|
||||
version="1.0.0"
|
||||
|
||||
RUN corepack enable
|
||||
|
||||
COPY --from=builder /app/apps/web-dashboard/.next ./apps/web-dashboard/.next
|
||||
COPY --from=builder /app/apps/web-dashboard/public ./apps/web-dashboard/public
|
||||
COPY --from=builder /app/apps/web-dashboard/package.json ./apps/web-dashboard/
|
||||
COPY --from=builder /app/apps/web-dashboard/next.config.js ./apps/web-dashboard/
|
||||
COPY --from=builder /app/node_modules ./node_modules
|
||||
# Install runtime dependencies
|
||||
RUN apk add --no-cache ca-certificates tzdata
|
||||
|
||||
# Create non-root user
|
||||
RUN addgroup -g 1000 appuser && \
|
||||
adduser -D -u 1000 -G appuser appuser
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Copy built application from builder
|
||||
COPY --from=builder /build/apps/web-dashboard/.next ./apps/web-dashboard/.next
|
||||
COPY --from=builder /build/apps/web-dashboard/public ./apps/web-dashboard/public
|
||||
COPY --from=builder /build/apps/web-dashboard/package.json ./apps/web-dashboard/
|
||||
COPY --from=builder /build/apps/web-dashboard/next.config.js ./apps/web-dashboard/
|
||||
|
||||
# Copy production dependencies only
|
||||
COPY --from=builder /build/node_modules ./node_modules
|
||||
|
||||
WORKDIR /app/apps/web-dashboard
|
||||
|
||||
# Change ownership
|
||||
RUN chown -R appuser:appuser /app
|
||||
|
||||
# Switch to non-root user
|
||||
USER appuser
|
||||
|
||||
# Expose port
|
||||
EXPOSE 3000
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
|
||||
CMD wget --no-verbose --tries=1 --spider http://localhost:3000 || exit 1
|
||||
|
||||
# Set environment variables
|
||||
ENV NODE_ENV=production
|
||||
|
||||
# Signal handling
|
||||
STOPSIGNAL SIGTERM
|
||||
|
||||
CMD ["pnpm", "start"]
|
||||
|
||||
Reference in New Issue
Block a user