mirror of
https://github.com/lukaszraczylo/mcp-captcharesolver.git
synced 2026-10-12 00:45:28 +00:00
44 lines
1.3 KiB
Docker
44 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# Build stage: cross-compile on the buildx host's native arch, then COPY
|
|
# the right per-arch binary into the final stage. Avoids QEMU emulation
|
|
# (much faster; same result for a static Go binary).
|
|
FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS build
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /src
|
|
|
|
# Cache module download across builds.
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
|
|
COPY . .
|
|
|
|
# Build a fully static, stripped binary. CGO_ENABLED=0 → no glibc dep, runs
|
|
# on scratch/distroless. -trimpath strips local paths from the binary.
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 \
|
|
GOOS=$TARGETOS \
|
|
GOARCH=$TARGETARCH \
|
|
go build \
|
|
-trimpath \
|
|
-ldflags="-s -w" \
|
|
-o /out/captcha-solver-mcp \
|
|
./cmd/captcha-solver-mcp
|
|
|
|
# Final stage: distroless static + nonroot. Matches the k8s securityContext
|
|
# (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps, seccompRuntimeDefault).
|
|
# No shell — the binary handles SIGTERM via signal.NotifyContext in main.go.
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
|
|
COPY --from=build /out/captcha-solver-mcp /captcha-solver-mcp
|
|
|
|
EXPOSE 8080
|
|
|
|
USER nonroot:nonroot
|
|
|
|
ENTRYPOINT ["/captcha-solver-mcp"]
|