mirror of
https://github.com/cloudflare/cloudflared.git
synced 2026-10-12 02:12:14 +00:00
Devin Carr
2253eeeb25
Update CI and standard container builders to Go 1.26.8. Add coverage for Go 1.26's stricter net/url host parsing, rejecting unbracketed IPv6 addresses and repeated port separators in origin URLs. Retain existing Access bare-IPv6 normalization behavior. Closes TUN-10834
38 lines
1.4 KiB
Docker
38 lines
1.4 KiB
Docker
# use a builder image for building cloudflare
|
|
FROM golang:1.26.8 AS builder
|
|
ENV GO111MODULE=on \
|
|
CGO_ENABLED=0 \
|
|
GOPROXY=https://athens.cfdata.org|https://proxy.golang.org|direct \
|
|
# the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
|
|
# which changes how cloudflared binds the metrics server
|
|
CONTAINER_BUILD=1
|
|
|
|
WORKDIR /go/src/github.com/cloudflare/cloudflared/
|
|
|
|
# Download dependencies in their own layer so source-only changes reuse it.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# compile cloudflared
|
|
RUN GOOS=linux GOARCH=arm64 make cloudflared
|
|
|
|
# use a distroless base image with glibc
|
|
FROM gcr.io/distroless/base-debian13:nonroot-arm64@sha256:7a4876f88e7fe3190972c274b679b3473f61e8d990a4dce3627961b3e22a0eaf
|
|
|
|
LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"
|
|
|
|
# copy our compiled binary
|
|
COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/
|
|
|
|
# run as nonroot user
|
|
# We need to use numeric user id's because Kubernetes doesn't support strings:
|
|
# https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49
|
|
# The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18
|
|
USER 65532:65532
|
|
|
|
# command / entrypoint of container
|
|
ENTRYPOINT ["cloudflared", "--no-autoupdate"]
|
|
CMD ["version"]
|