|
| 1 | +# syntax=docker/dockerfile:1 |
| 2 | + |
| 3 | +# We use the latest Go 1.x version unless asked to use something else. |
| 4 | +# The GitHub Actions CI job sets this argument for a consistent Go version. |
| 5 | +ARG GO_VERSION=1 |
| 6 | + |
| 7 | +# Setup the base environment. The BUILDPLATFORM is set automatically by Docker. |
| 8 | +# The --platform=${BUILDPLATFORM} flag tells Docker to build the function using |
| 9 | +# the OS and architecture of the host running the build, not the OS and |
| 10 | +# architecture that we're building the function for. |
| 11 | +FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS build |
| 12 | + |
| 13 | +# Download platform-specific AWS CLI binaries |
| 14 | +ARG TARGETPLATFORM |
| 15 | + |
| 16 | +WORKDIR /fn |
| 17 | + |
| 18 | +# Most functions don't want or need CGo support, so we disable it. |
| 19 | +ENV CGO_ENABLED=0 |
| 20 | + |
| 21 | +# We run go mod download in a separate step so that we can cache its results. |
| 22 | +# This lets us avoid re-downloading modules if we don't need to. The type=target |
| 23 | +# mount tells Docker to mount the current directory read-only in the WORKDIR. |
| 24 | +# The type=cache mount tells Docker to cache the Go modules cache across builds. |
| 25 | +RUN --mount=target=. --mount=type=cache,target=/go/pkg/mod go mod download |
| 26 | + |
| 27 | +# The TARGETOS and TARGETARCH args are set by docker. We set GOOS and GOARCH to |
| 28 | +# these values to ask Go to compile a binary for these architectures. If |
| 29 | +# TARGETOS and TARGETOS are different from BUILDPLATFORM, Go will cross compile |
| 30 | +# for us (e.g. compile a linux/amd64 binary on a linux/arm64 build machine). |
| 31 | +ARG TARGETOS |
| 32 | +ARG TARGETARCH |
| 33 | + |
| 34 | +# Build the function binary. The type=target mount tells Docker to mount the |
| 35 | +# current directory read-only in the WORKDIR. The type=cache mount tells Docker |
| 36 | +# to cache the Go modules cache across builds. |
| 37 | +RUN --mount=target=. \ |
| 38 | + --mount=type=cache,target=/go/pkg/mod \ |
| 39 | + --mount=type=cache,target=/root/.cache/go-build \ |
| 40 | + GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /function . |
| 41 | + |
| 42 | +# Produce the Function image. |
| 43 | +FROM --platform=${BUILDPLATFORM} python:3.13-bookworm AS image |
| 44 | +RUN apt-get update && apt-get install -y coreutils curl jq unzip zsh less |
| 45 | +RUN groupadd -g 65532 nonroot |
| 46 | +RUN useradd -u 65532 -g 65532 -d /home/nonroot --system --shell /usr/sbin/nologin nonroot |
| 47 | +RUN mkdir /scripts /.aws && chown 65532:65532 /scripts /.aws |
| 48 | + |
| 49 | +RUN if [ "$TARGETPLATFORM" = "linux/arm64" ]; then \ |
| 50 | + echo "Installing aws-cli for linux/arm64" && \ |
| 51 | + curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "/tmp/awscliv2.zip"; \ |
| 52 | + else \ |
| 53 | + echo "Installing aws-cli for linux/x86_64" && \ |
| 54 | + curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"; \ |
| 55 | + fi && \ |
| 56 | + unzip "/tmp/awscliv2.zip" && \ |
| 57 | + ./aws/install |
| 58 | + |
| 59 | +WORKDIR / |
| 60 | + |
| 61 | +COPY --from=build /function /function |
| 62 | +EXPOSE 9443 |
| 63 | +USER nonroot:nonroot |
| 64 | +ENTRYPOINT ["/function"] |
0 commit comments