2026-09-22 19:06:31 +02:00
|
|
|
# Portal, from the release tarball uhhm/portal publishes on
|
|
|
|
|
# project.uhhm.no (the same artifact the bare-metal instances run).
|
|
|
|
|
# PORTAL_RELEASE in .env pins the version; bumping it and rebuilding is
|
|
|
|
|
# the whole upgrade.
|
2026-09-28 20:56:58 +02:00
|
|
|
#
|
|
|
|
|
# Arch, because that is what the release is built on. The published
|
|
|
|
|
# binary is dynamically linked against that runner's glibc, so a
|
|
|
|
|
# debian:bookworm-slim base - glibc 2.36 against the 2.38 the binary
|
|
|
|
|
# asks for - starts and immediately exits with a version error. The
|
|
|
|
|
# base has to be at least as new as the builder, and the builder is
|
|
|
|
|
# Arch, so this is Arch. gdo's image is the same base for the same
|
|
|
|
|
# reason.
|
|
|
|
|
FROM archlinux:base
|
2026-09-22 19:06:31 +02:00
|
|
|
ARG PORTAL_RELEASE
|
2026-09-28 20:56:58 +02:00
|
|
|
RUN pacman -Sy --noconfirm --needed ca-certificates curl \
|
|
|
|
|
&& pacman -Scc --noconfirm \
|
|
|
|
|
&& rm -rf /var/cache/pacman/pkg/* /var/lib/pacman/sync/*
|
2026-09-22 19:06:31 +02:00
|
|
|
WORKDIR /app
|
|
|
|
|
RUN curl -sfL "https://project.uhhm.no/uhhm/portal/releases/download/${PORTAL_RELEASE}/portal-${PORTAL_RELEASE}.tar.gz" \
|
|
|
|
|
| tar -xz -C /app \
|
|
|
|
|
&& test -x /app/portal
|
|
|
|
|
# A non-root user; the image ships nothing writable it needs.
|
|
|
|
|
RUN useradd --system --no-create-home portal
|
|
|
|
|
USER portal
|
|
|
|
|
EXPOSE 3000
|
|
|
|
|
CMD ["/app/portal"]
|
