mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Torin Sandall
98e7a6f50f
This commit changes a few build settings required for the wasm runtime integration. Since wasmer ships as a shared library, it must be distributed with OPA. Rather than require all users obtain the wasmer shared library, we continue to publish statically linked OPA executables like we always have. For the time being, these statically linked executables will NOT have wasm runtime support available. If users want to interact with wasm compiled policies, they will either have to do so via Docker or build OPA themselves. As part of this change, the Docker images have been updated to be from gcr.io/distroless/cc (since libc and libgcc are required now) instead of scratch. Finally, the build process now produces an extra "opa_docker_$GOARCH" executable that is used in the Docker image. This executable has the runpath set so that it can find the wasmer library at runtime. Signed-off-by: Torin Sandall <torinsandall@gmail.com>
27 lines
767 B
Docker
27 lines
767 B
Docker
# Copyright 2019 The OPA Authors. All rights reserved.
|
|
# Use of this source code is governed by an Apache2
|
|
# license that can be found in the LICENSE file.
|
|
|
|
ARG BASE
|
|
|
|
FROM ${BASE}
|
|
|
|
# Any non-zero number will do, and unfortunately a named user will not, as k8s
|
|
# pod securityContext runAsNonRoot can't resolve the user ID:
|
|
# https://github.com/kubernetes/kubernetes/issues/40958. Make root (uid 0) when
|
|
# not specified.
|
|
ARG USER=0
|
|
|
|
MAINTAINER Torin Sandall <torinsandall@gmail.com>
|
|
|
|
# Hack.. https://github.com/moby/moby/issues/37965
|
|
# _Something_ needs to be between the two COPY steps.
|
|
USER ${USER}
|
|
|
|
ARG BIN_DIR=.
|
|
COPY ${BIN_DIR}/opa_docker_amd64 /opa
|
|
COPY ./vendor/github.com/wasmerio/go-ext-wasm/wasmer/libwasmer.so /libwasmer.so
|
|
|
|
ENTRYPOINT ["/opa"]
|
|
CMD ["run"]
|