qpismont
624bc1e028
ci/woodpecker/push/tests Pipeline was successful
limit tool result to open router tool response (with truncated info for ai) Hard kill if graceful shutdown is too long
43 lines
1.4 KiB
Docker
43 lines
1.4 KiB
Docker
FROM rust:1.98-trixie as builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates/ crates/
|
|
|
|
RUN cargo build --release --package herald-server
|
|
|
|
|
|
FROM debian:trixie-slim
|
|
|
|
# git clones the pull request. ca-certificates is what every HTTPS call needs
|
|
# (Gitea, OpenRouter, git). The shared libraries are the non-base ones the binary
|
|
# links against, as reported by `ldd target/release/herald-server`; libc, libm
|
|
# and libgcc_s come from the base image.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
git \
|
|
libssl3t64 \
|
|
libzstd1 \
|
|
zlib1g \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Herald drives the container daemon through its socket (DOCKER_HOST, default
|
|
# unix:///var/run/docker.sock), so neither docker nor podman is needed here: the
|
|
# compose file mounts the socket. Reaching that socket is what this user needs,
|
|
# and the socket is root-equivalent, so either run the container as root or give
|
|
# it the socket's group, e.g. `group_add: ["<gid of the host docker group>"]`.
|
|
RUN useradd --create-home --shell /usr/sbin/nologin --uid 10001 herald
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder /app/target/release/herald-server ./herald-server
|
|
|
|
# git looks for its configuration under $HOME.
|
|
ENV HOME=/home/herald
|
|
|
|
USER herald
|
|
|
|
# Exec form, so the binary is PID 1 and receives the SIGTERM it handles to shut
|
|
# down gracefully.
|
|
CMD ["./herald-server"]
|