a4f92f5e30
web: Update config. Flesh out build. Fix issue surrounding build. Fix paths. Update workspaces. Fix build steps. Apply linter. Temporarily remove problem rules. Add ignorefile. Prep for formatting. Lint website. Lint web, repo packages. Refine Prettier usage. Fix imports. Tidy build. Move node ignore files. Remove unused. Update job. Fix lint step. Build before compiling. Use root for paths. Fix issues surrounding import references, types, package names. Fix build paths. Tidy. Enforce prefix. Apply prefixes to imports. Enable linter, compiler, etc. Fix references. Update names. Mark optional. Revise mounts. Fix build order. Update package.json. Ignore all docusaurus. Fix paths, types. Clean up build steps, names. Fix paths. website: Fix nested paragraphs build warning. web: Enforce module resolution. Use consistent LTS version. Track Node version. Use default resolution. Test main entrypoint. Fix Node v20 compatibility. Add task names. WIP: Fix styles.
190 lines
6.2 KiB
Docker
190 lines
6.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Stage 1 Web UI and Documentation build
|
|
|
|
FROM --platform=${BUILDPLATFORM} docker.io/library/node:22 AS web-builder
|
|
|
|
ENV NODE_ENV=production
|
|
|
|
WORKDIR /work
|
|
|
|
COPY ./package.json ./package.json
|
|
COPY ./package-lock.json ./package-lock.json
|
|
COPY ./packages ./packages
|
|
COPY ./web ./web
|
|
COPY ./website ./website
|
|
|
|
COPY ./gen-ts-api ./gen-ts-api
|
|
COPY ./blueprints ./blueprints
|
|
COPY ./schema.yml ./schema.yml
|
|
COPY ./SECURITY.md ./SECURITY.md
|
|
|
|
RUN --mount=type=cache,target=/root/.npm npm ci --include=dev
|
|
|
|
RUN npm run build-bundled -w @goauthentik/docs
|
|
RUN npm run build -w @goauthentik/web
|
|
|
|
# Stage 2: Build go proxy
|
|
|
|
FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.24-bookworm AS go-builder
|
|
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
ARG TARGETVARIANT
|
|
|
|
ARG GOOS=$TARGETOS
|
|
ARG GOARCH=$TARGETARCH
|
|
|
|
WORKDIR /go/src/goauthentik.io
|
|
|
|
RUN --mount=type=cache,id=apt-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/var/cache/apt \
|
|
dpkg --add-architecture arm64 && \
|
|
apt-get update && \
|
|
apt-get install -y --no-install-recommends crossbuild-essential-arm64 gcc-aarch64-linux-gnu
|
|
|
|
RUN --mount=type=bind,target=/go/src/goauthentik.io/go.mod,src=./go.mod \
|
|
--mount=type=bind,target=/go/src/goauthentik.io/go.sum,src=./go.sum \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
|
|
COPY ./cmd /go/src/goauthentik.io/cmd
|
|
COPY ./authentik/lib /go/src/goauthentik.io/authentik/lib
|
|
COPY ./web/static.go /go/src/goauthentik.io/web/static.go
|
|
COPY --from=web-builder /work/web/robots.txt /go/src/goauthentik.io/web/robots.txt
|
|
COPY --from=web-builder /work/web/security.txt /go/src/goauthentik.io/web/security.txt
|
|
COPY ./internal /go/src/goauthentik.io/internal
|
|
COPY ./go.mod /go/src/goauthentik.io/go.mod
|
|
COPY ./go.sum /go/src/goauthentik.io/go.sum
|
|
|
|
RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \
|
|
--mount=type=cache,id=go-build-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/root/.cache/go-build \
|
|
if [ "$TARGETARCH" = "arm64" ]; then export CC=aarch64-linux-gnu-gcc && export CC_FOR_TARGET=gcc-aarch64-linux-gnu; fi && \
|
|
CGO_ENABLED=1 GOFIPS140=latest GOARM="${TARGETVARIANT#v}" \
|
|
go build -o /go/authentik ./cmd/server
|
|
|
|
# Stage 3: MaxMind GeoIP
|
|
|
|
FROM --platform=${BUILDPLATFORM} ghcr.io/maxmind/geoipupdate:v7.1.0 AS geoip
|
|
|
|
ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City GeoLite2-ASN"
|
|
ENV GEOIPUPDATE_VERBOSE="1"
|
|
ENV GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
|
|
ENV GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
|
|
|
|
USER root
|
|
RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
|
|
--mount=type=secret,id=GEOIPUPDATE_LICENSE_KEY \
|
|
mkdir -p /usr/share/GeoIP && \
|
|
/bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
|
|
|
|
# Stage 4: Download uv
|
|
FROM ghcr.io/astral-sh/uv:0.6.14 AS uv
|
|
|
|
# Stage 5: Base python image
|
|
FROM ghcr.io/goauthentik/fips-python:3.12.10-slim-bookworm-fips AS python-base
|
|
|
|
ENV VENV_PATH="/ak-root/.venv" \
|
|
PATH="/lifecycle:/ak-root/.venv/bin:$PATH" \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_NATIVE_TLS=1 \
|
|
UV_PYTHON_DOWNLOADS=0
|
|
|
|
WORKDIR /ak-root/
|
|
|
|
COPY --from=uv /uv /uvx /bin/
|
|
|
|
# Stage 6: Python dependencies
|
|
FROM python-base AS python-deps
|
|
|
|
ARG TARGETARCH
|
|
ARG TARGETVARIANT
|
|
|
|
RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
|
|
|
|
ENV PATH="/root/.cargo/bin:$PATH"
|
|
|
|
RUN --mount=type=cache,id=apt-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/var/cache/apt \
|
|
apt-get update && \
|
|
# Required for installing pip packages
|
|
apt-get install -y --no-install-recommends \
|
|
# Build essentials
|
|
build-essential pkg-config libffi-dev git \
|
|
# cryptography
|
|
curl \
|
|
# libxml
|
|
libxslt-dev zlib1g-dev \
|
|
# postgresql
|
|
libpq-dev \
|
|
# python-kadmin-rs
|
|
clang libkrb5-dev sccache \
|
|
# xmlsec
|
|
libltdl-dev && \
|
|
curl https://sh.rustup.rs -sSf | sh -s -- -y
|
|
|
|
ENV UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
|
|
|
|
RUN --mount=type=bind,target=pyproject.toml,src=pyproject.toml \
|
|
--mount=type=bind,target=uv.lock,src=uv.lock \
|
|
--mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-install-project --no-dev
|
|
|
|
# Stage 7: Run
|
|
FROM python-base AS final-image
|
|
|
|
ARG VERSION
|
|
ARG GIT_BUILD_HASH
|
|
ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
|
|
|
|
LABEL org.opencontainers.image.url=https://goauthentik.io
|
|
LABEL org.opencontainers.image.description="goauthentik.io Main server image, see https://goauthentik.io for more info."
|
|
LABEL org.opencontainers.image.source=https://github.com/goauthentik/authentik
|
|
LABEL org.opencontainers.image.version=${VERSION}
|
|
LABEL org.opencontainers.image.revision=${GIT_BUILD_HASH}
|
|
|
|
WORKDIR /
|
|
|
|
# We cannot cache this layer otherwise we'll end up with a bigger image
|
|
RUN apt-get update && \
|
|
apt-get upgrade -y && \
|
|
# Required for runtime
|
|
apt-get install -y --no-install-recommends libpq5 libmaxminddb0 ca-certificates libkrb5-3 libkadm5clnt-mit12 libkdb5-10 libltdl7 libxslt1.1 && \
|
|
# Required for bootstrap & healtcheck
|
|
apt-get install -y --no-install-recommends runit && \
|
|
pip3 install --no-cache-dir --upgrade pip && \
|
|
apt-get clean && \
|
|
rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
|
|
adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
|
|
mkdir -p /certs /media /blueprints && \
|
|
mkdir -p /authentik/.ssh && \
|
|
mkdir -p /ak-root && \
|
|
chown authentik:authentik /certs /media /authentik/.ssh /ak-root
|
|
|
|
COPY ./authentik/ /authentik
|
|
COPY ./pyproject.toml /
|
|
COPY ./uv.lock /
|
|
COPY ./schemas /schemas
|
|
COPY ./locale /locale
|
|
COPY ./tests /tests
|
|
COPY ./manage.py /
|
|
COPY ./blueprints /blueprints
|
|
COPY ./lifecycle/ /lifecycle
|
|
COPY ./authentik/sources/kerberos/krb5.conf /etc/krb5.conf
|
|
COPY --from=go-builder /go/authentik /bin/authentik
|
|
COPY --from=python-deps /ak-root/.venv /ak-root/.venv
|
|
COPY --from=web-builder /work/web/dist/ /web/dist/
|
|
COPY --from=web-builder /work/web/authentik/ /web/authentik/
|
|
COPY --from=web-builder /work/website/build/ /website/help/
|
|
COPY --from=geoip /usr/share/GeoIP /geoip
|
|
|
|
USER 1000
|
|
|
|
ENV TMPDIR=/dev/shm/ \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
GOFIPS=1
|
|
|
|
HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "ak", "healthcheck" ]
|
|
|
|
ENTRYPOINT [ "dumb-init", "--", "ak" ]
|