anonde/Dockerfile.anonde at main · anonde-io/anonde · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
FROM golang:1.26-alpine AS build
RUN apk add --no-cache git
WORKDIR /src

COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 go build -o /out/anonde ./cmd/anonde

RUN go version -m /out/anonde | grep -qE '^\s+build\s+vcs\.revision=[0-9a-f]' || \
    (echo 'ERROR: vcs.revision missing — git in builder + .git in build context?' && exit 1)

FROM gcr.io/distroless/static-debian12
COPY --from=build /out/anonde /anonde
# Third-party attribution for the redistributed (statically linked) Go
# dependencies. Baked in so a `docker pull` user who never sees the repo
# still receives the notices. NOTICE covers anonde's own source.
COPY LICENSE NOTICE /
# Patterns-only image — this static build has no CGO and no bundled
# libonnxruntime, so it cannot run in-process NER regardless of
# ANALYZER_BACKEND. For GLiNER NER, use the Dockerfile.anonde-ner image
# (ANALYZER_BACKEND=gliner, model + libonnxruntime baked in).
ENV ANALYZER_BACKEND=patterns \
    ANONDE_DATA_DIR=/var/lib/anonde

# Single anchor for every piece of state the container persists:
#  - telemetry install_id  → /var/lib/anonde/install_id
#  - bbolt vault DB        → /var/lib/anonde/anonde.db (when
#                            STORE_BACKEND=bbolt; default is memory)
#  - any future on-disk state should land here too.
# Declared as VOLUME so Docker creates an anonymous volume on first
# run; operators wanting durability across `docker rm` should mount
# a named volume to the same path (-v anonde-data:/var/lib/anonde).
VOLUME /var/lib/anonde

# OCI image annotations — see Dockerfile.anonde-ner for the rationale.
ARG IMAGE_REVISION=
ARG IMAGE_CREATED=
ARG IMAGE_VERSION=dev
LABEL org.opencontainers.image.title="anonde" \
      org.opencontainers.image.description="anonde server — patterns-only PII detection + anonymisation. ~12 MB distroless image, no model downloads, no CGO. Use Dockerfile.anonde-ner for NER + PDF redaction." \
      org.opencontainers.image.source="https://github.com/anonde-io/anonde" \
      org.opencontainers.image.url="https://github.com/anonde-io/anonde" \
      org.opencontainers.image.documentation="https://github.com/anonde-io/anonde#readme" \
      org.opencontainers.image.vendor="anonde-io" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.revision=$IMAGE_REVISION \
      org.opencontainers.image.created=$IMAGE_CREATED \
      org.opencontainers.image.version=$IMAGE_VERSION

EXPOSE 8080
ENTRYPOINT ["/anonde"]