embeddevio/awg-dash
1
0
Fork 0
Code Issues 40 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Sprint 0 / #18: multi-stage Dockerfile и супервизор entrypoint #49

Open
embeddevio wants to merge 10 commits from feat/18-docker-runtime into main
pull from: feat/18-docker-runtime
merge into: embeddevio:main
Conversation 2 Commits 10 Files Changed 4
+17 -3
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 20db51b7a2 - Show all commits
deploy/Dockerfile
+17 -3
View File
@@ -6,7 +6,12 @@
# ВАЖНО: AMNEZIAWG_GO_REF / AMNEZIAWG_TOOLS_REF по умолчанию указывают на master # ВАЖНО: AMNEZIAWG_GO_REF / AMNEZIAWG_TOOLS_REF по умолчанию указывают на master
# и должны быть запинены на проверенный тег/коммит перед релизом (см. #45). # и должны быть запинены на проверенный тег/коммит перед релизом (см. #45).
ARG GO_IMAGE=golang:1.25-alpine # Базовые образы и зависимости подняты под гейт image-scan (issue #61):
# golang:1.26-alpine — закрывает CVE Go stdlib 1.25.14 (CRITICAL CVE-2026-56857 + HIGH)
# golang.org/x/crypto >= v0.43.0 — закрывает CVE-2025-47913 (ssh/agent)
# alpine:3.23 — закрывает HIGH в пакетах alpine 3.21
ARG GO_IMAGE=golang:1.26-alpine
ARG X_CRYPTO_VERSION=v0.43.0
# --- stage 1: сборка awg-утилит (Go) ----------------------------------------- # --- stage 1: сборка awg-утилит (Go) -----------------------------------------
FROM ${GO_IMAGE} AS go-build FROM ${GO_IMAGE} AS go-build
@@ -15,12 +20,18 @@ ARG AMNEZIAWG_GO_REPO=https://github.com/amnezia-vpn/amneziawg-go.git
ARG AMNEZIAWG_GO_REF=master ARG AMNEZIAWG_GO_REF=master
ARG AMNEZIAWG_TOOLS_REPO=https://github.com/amnezia-vpn/amneziawg-tools.git ARG AMNEZIAWG_TOOLS_REPO=https://github.com/amnezia-vpn/amneziawg-tools.git
ARG AMNEZIAWG_TOOLS_REF=master ARG AMNEZIAWG_TOOLS_REF=master
ARG X_CRYPTO_VERSION
RUN apk add --no-cache git make gcc musl-dev linux-headers RUN apk add --no-cache git make gcc musl-dev linux-headers
WORKDIR /src WORKDIR /src
RUN git clone --depth 1 --branch "${AMNEZIAWG_GO_REF}" "${AMNEZIAWG_GO_REPO}" amneziawg-go \ RUN git clone --depth 1 --branch "${AMNEZIAWG_GO_REF}" "${AMNEZIAWG_GO_REPO}" amneziawg-go \
&& cd amneziawg-go && make && cp amneziawg-go /usr/local/bin/amneziawg-go && cd amneziawg-go \
&& go get "golang.org/x/crypto@${X_CRYPTO_VERSION}" \
&& go mod tidy \
&& go list -m golang.org/x/crypto \
&& make \
&& cp amneziawg-go /usr/local/bin/amneziawg-go
RUN git clone --depth 1 --branch "${AMNEZIAWG_TOOLS_REF}" "${AMNEZIAWG_TOOLS_REPO}" amneziawg-tools \ RUN git clone --depth 1 --branch "${AMNEZIAWG_TOOLS_REF}" "${AMNEZIAWG_TOOLS_REPO}" amneziawg-tools \
&& cd amneziawg-tools/src && make \ && cd amneziawg-tools/src && make \
@@ -28,7 +39,10 @@ RUN git clone --depth 1 --branch "${AMNEZIAWG_TOOLS_REF}" "${AMNEZIAWG_TOOLS_REP
&& if [ -f wg-quick ]; then cp wg-quick /usr/local/bin/awg-quick; fi && if [ -f wg-quick ]; then cp wg-quick /usr/local/bin/awg-quick; fi
# --- stage 2: runtime ------------------------------------------------------- # --- stage 2: runtime -------------------------------------------------------
FROM alpine:3.21 AS runtime FROM alpine:3.23 AS runtime
# Пакеты базы обновляем на момент сборки: trivy --ignore-unfixed учитывает только исправимые CVE.
RUN apk upgrade --no-cache
LABEL org.opencontainers.image.title="awg-dash" \ LABEL org.opencontainers.image.title="awg-dash" \
org.opencontainers.image.description="AmneziaWG gateway with intelligent routing: REST API + Web UI + split-tunnel" \ org.opencontainers.image.description="AmneziaWG gateway with intelligent routing: REST API + Web UI + split-tunnel" \