mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

distroless: fetch CA certificates in builder stage

Browse source 
...so that we don't rely on a package manager to bring these down into the
runner stage.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
This commit is contained in:
Andrew Keesler 2022-01-18 12:40:27 -05:00
parent 764ce711b6
commit a672ff9288
No known key found for this signature in database
GPG key ID: 27CE0444346F9413
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Dockerfile
View file

@ -2,7 +2,7 @@ FROM golang:1.17.6-alpine3.14 AS builder
WORKDIR /usr/local/src/dex
RUN apk add --no-cache --update alpine-sdk
RUN apk add --no-cache --update alpine-sdk ca-certificates openssl
ARG TARGETOS
ARG TARGETARCH
@ -39,8 +39,8 @@ FROM alpine:3.15.0
# Proper installations should manage those certificates, but it's a bad user
# experience when this doesn't work out of the box.
#
# OpenSSL is required so wget can query HTTPS endpoints for health checking.
RUN apk add --no-cache --update ca-certificates openssl
# See https://go.dev/src/crypto/x509/root_linux.go for Go root CA bundle locations.
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
RUN mkdir -p /var/dex
RUN chown -R 1001:1001 /var/dex