|
|
@ -1,5 +1,5 @@ |
|
|
|
# This file was generated using a Jinja2 template. |
|
|
|
# Please make your changes in `Dockerfile.j2` and then `make` the individual Dockerfile's. |
|
|
|
# Please make your changes in `Dockerfile.j2` and then `make` the individual Dockerfiles. |
|
|
|
|
|
|
|
{% set build_stage_base_image = "rust:1.48" %} |
|
|
|
{% if "alpine" in target_file %} |
|
|
@ -44,19 +44,26 @@ |
|
|
|
# https://docs.docker.com/develop/develop-images/multistage-build/ |
|
|
|
# https://whitfin.io/speeding-up-rust-docker-builds/ |
|
|
|
####################### VAULT BUILD IMAGE ####################### |
|
|
|
{% set vault_image_hash = "sha256:dcb7884dc5845b3842ff2204fe77482000b771495c6c359297ec3c03330d65e0" %} |
|
|
|
{% raw %} |
|
|
|
# This hash is extracted from the docker web-vault builds and it's preferred over a simple tag because it's immutable. |
|
|
|
# It can be viewed in multiple ways: |
|
|
|
# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. |
|
|
|
# - From the console, with the following commands: |
|
|
|
# docker pull bitwardenrs/web-vault:v2.17.1 |
|
|
|
# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.17.1 |
|
|
|
{% set vault_version = "2.17.1" %} |
|
|
|
{% set vault_image_digest = "sha256:dcb7884dc5845b3842ff2204fe77482000b771495c6c359297ec3c03330d65e0" %} |
|
|
|
# The web-vault digest specifies a particular web-vault build on Docker Hub. |
|
|
|
# Using the digest instead of the tag name provides better security, |
|
|
|
# as the digest of an image is immutable, whereas a tag name can later |
|
|
|
# be changed to point to a malicious image. |
|
|
|
# |
|
|
|
# - To do the opposite, and get the tag from the hash, you can do: |
|
|
|
# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:dcb7884dc5845b3842ff2204fe77482000b771495c6c359297ec3c03330d65e0 |
|
|
|
{% endraw %} |
|
|
|
FROM bitwardenrs/web-vault@{{ vault_image_hash }} as vault |
|
|
|
# To verify the current digest for a given tag name: |
|
|
|
# - From https://hub.docker.com/r/bitwardenrs/web-vault/tags, |
|
|
|
# click the tag name to view the digest of the image it currently points to. |
|
|
|
# - From the command line: |
|
|
|
# $ docker pull bitwardenrs/web-vault:v{{ vault_version }} |
|
|
|
# $ docker image inspect --format "{{ '{{' }}.RepoDigests}}" bitwardenrs/web-vault:v{{ vault_version }} |
|
|
|
# [bitwardenrs/web-vault@{{ vault_image_digest }}] |
|
|
|
# |
|
|
|
# - Conversely, to get the tag name from the digest: |
|
|
|
# $ docker image inspect --format "{{ '{{' }}.RepoTags}}" bitwardenrs/web-vault@{{ vault_image_digest }} |
|
|
|
# [bitwardenrs/web-vault:v{{ vault_version }}] |
|
|
|
# |
|
|
|
FROM bitwardenrs/web-vault@{{ vault_image_digest }} as vault |
|
|
|
|
|
|
|
########################## BUILD IMAGE ########################## |
|
|
|
FROM {{ build_stage_base_image }} as build |
|
|
|