34 lines
1.2 KiB
Docker
34 lines
1.2 KiB
Docker
# The binary is NOT compiled here. Build it first, from the repository root:
|
|
#
|
|
# (cd web && npm ci && npm run build)
|
|
# zig build cross -Dweb-dist=web/dist -Doptimize=ReleaseSafe
|
|
#
|
|
# then build the image with the repository root as context:
|
|
#
|
|
# docker build -t nxdns -f deploy/docker/Dockerfile .
|
|
#
|
|
# The builder stage stages the CA bundle (upstream DoH/DoT verification rescans
|
|
# the system store; a scratch image without one breaks every TLS upstream) and
|
|
# maps the buildx TARGETARCH onto the zig cross-target directory.
|
|
|
|
FROM alpine:3.22 AS builder
|
|
RUN apk add --no-cache ca-certificates
|
|
ARG TARGETARCH
|
|
COPY zig-out/cross /cross
|
|
RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/etc/nxdns /rootfs/var/lib/nxdns \
|
|
&& cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ \
|
|
&& case "${TARGETARCH:-amd64}" in \
|
|
amd64) cp /cross/x86_64-linux-musl/nxdns /rootfs/nxdns ;; \
|
|
arm64) cp /cross/aarch64-linux-musl/nxdns /rootfs/nxdns ;; \
|
|
*) echo "unsupported TARGETARCH '${TARGETARCH}'" >&2; exit 1 ;; \
|
|
esac \
|
|
&& chown 65532:65532 /rootfs/var/lib/nxdns
|
|
|
|
FROM scratch
|
|
COPY --from=builder /rootfs/ /
|
|
USER 65532:65532
|
|
VOLUME /var/lib/nxdns
|
|
EXPOSE 53/udp 53/tcp 8080 443 853
|
|
ENTRYPOINT ["/nxdns"]
|
|
CMD ["run"]
|