mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Stephan Renatus
818738539e
As discussed in #1639. Note that .dockerignore had to be changed as to *not* skip what's needed for the build: vendor, obviously, and .git for the compiled-in version information. parts: - .travis.yml: don't bother about golang anymore - docs/devel/DEVELOPMENT.md: update - Makefile: update hint Signed-off-by: Stephan Renatus <srenatus@chef.io>
22 lines
847 B
Docker
22 lines
847 B
Docker
# Copyright 2019 The OPA Authors. All rights reserved.
|
|
# Use of this source code is governed by an Apache2
|
|
# license that can be found in the LICENSE file.
|
|
ARG BUILD_COMMIT
|
|
# we cant use build-args in `COPY --from=...` below, so work around this
|
|
# see: https://medium.com/@tonistiigi/advanced-multi-stage-build-patterns-6f741b852fae
|
|
FROM build-${BUILD_COMMIT} AS copy-src
|
|
|
|
FROM gcr.io/distroless/base${VARIANT}
|
|
# make root (uid 0) default when not specified
|
|
ARG USER=0
|
|
MAINTAINER Torin Sandall <torinsandall@gmail.com>
|
|
COPY --from=copy-src /go/src/github.com/open-policy-agent/opa/opa_linux_amd64 /opa
|
|
|
|
# Any non-zero number will do, and unfortunately a named user will not,
|
|
# as k8s pod securityContext runAsNonRoot can't resolve the user ID:
|
|
# https://github.com/kubernetes/kubernetes/issues/40958
|
|
USER ${USER}
|
|
|
|
ENTRYPOINT ["/opa"]
|
|
CMD ["run"]
|