tegwick
f4c9f2beeb
Founder decision 2026-11-01: the v14 release must meet the zero HIGH/CRITICAL bar. Trivy found CVE-2026-111943, -78667, -78669 and -97031 in Go stdlib 1.26.7 (fixed in 1.26.9/1.26.10). Builder image golang:1.26.10-alpine (index sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308) and go.mod go 1.26.10; runtime base unchanged. make test (race), go vet and both compact-sitting policy packages (v14 46 tests, v13 32 tests) pass on go1.26.10. Containerfile and go.mod trigger .forgejo/workflows/image.yaml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
19 lines
1.2 KiB
Docker
19 lines
1.2 KiB
Docker
FROM golang:1.26.10-alpine@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
# Portable, unchanged Approval-owner pure data helper; available before download.
|
|
COPY third_party/approvalfact ./third_party/approvalfact
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/access-engine ./cmd/access-engine && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/flex-auth ./cmd/flex-auth
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
|
|
COPY --from=build /out/access-engine /usr/local/bin/access-engine
|
|
# Retired name: prints the rename and exits 2 (FLEX-DEC-2026-020).
|
|
COPY --from=build /out/flex-auth /usr/local/bin/flex-auth
|
|
COPY examples /opt/access-engine/examples
|
|
# Existing pinned releases still pass these paths during the side-by-side migration.
|
|
COPY examples /opt/flex-auth/examples
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/usr/local/bin/access-engine"]
|
|
CMD ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/access-engine/examples/tenant-engine/registry_snapshot.json", "--policy", "/opt/access-engine/examples/tenant-engine/policy_package.md"]
|