Containerfile.k8s

# --------------------------------------------------------------------------
# THIS FILE IS AUTOGENERATED - DO NOT EDIT MANUALLY
#
# Source: Containerfile.k8s.j2
# --------------------------------------------------------------------------

ARG BASE_VERSION=15.1-pkg
FROM ghcr.io/daemonless/base-core:${BASE_VERSION}

ARG FREEBSD_ARCH=amd64
ARG PACKAGES="ca_root_nss"
ARG UPSTREAM_URL="https://api.github.com/repos/traefik/traefik/releases/latest"
ARG UPSTREAM_JQ=".tag_name"
ARG HEALTHCHECK_ENDPOINT="http://localhost:8080/ping"

ENV HEALTHCHECK_URL="${HEALTHCHECK_ENDPOINT}"

# --- Metadata (Injected by Generator) ---
LABEL org.opencontainers.image.title="Traefik" \
      org.opencontainers.image.description="Modern HTTP reverse proxy and load balancer on FreeBSD." \
      org.opencontainers.image.source="https://github.com/daemonless/traefik" \
      org.opencontainers.image.url="https://traefik.io/" \
      org.opencontainers.image.documentation="https://doc.traefik.io/traefik/" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Infrastructure" \
      io.daemonless.port="80" \
      io.daemonless.volumes="/config" \
      io.daemonless.arch="${FREEBSD_ARCH}" \
      io.daemonless.upstream-url="${UPSTREAM_URL}" \
      io.daemonless.upstream-jq="${UPSTREAM_JQ}" \
      io.daemonless.healthcheck-url="${HEALTHCHECK_ENDPOINT}" \
      io.daemonless.packages="${PACKAGES}"

# Install ca_root_nss for HTTPS backends
RUN pkg update && \
    pkg install -y ${PACKAGES} && \
    pkg clean -ay && \
    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*

# Download and install Traefik
RUN TRAEFIK_VERSION=$(fetch -qo - "${UPSTREAM_URL}" | \
    jq -r "${UPSTREAM_JQ}") && \
    echo "Installing Traefik $TRAEFIK_VERSION" && \
    fetch -qo /tmp/traefik.tar.gz "https://github.com/traefik/traefik/releases/download/${TRAEFIK_VERSION}/traefik_${TRAEFIK_VERSION}_freebsd_amd64.tar.gz" && \
    mkdir -p /usr/local/bin && \
    tar xzf /tmp/traefik.tar.gz -C /usr/local/bin traefik && \
    chmod +x /usr/local/bin/traefik && \
    mkdir -p /app && echo "$TRAEFIK_VERSION" > /app/version && \
    rm /tmp/traefik.tar.gz

# Dir for the file provider referenced by the default CMD below. chown to bsd
# (1000:1000) like base-core does for /config, so it doesn't seed a root-owned
# path into the user's /config volume.
RUN mkdir -p /config/dynamic && chown -R bsd:bsd /config
# --- Expose (Injected by Generator) ---
EXPOSE 80 443 8080
# --- Volumes (Injected by Generator) ---
VOLUME /config

# Traefik IS the entrypoint, matching upstream's Linux image and the Traefik
# helm charts (which configure the proxy via CLI flags, not a config file).
# This image ships NO s6 supervision and writes NOTHING to /config; configure
# it via CLI flags, env vars, or a mounted --configFile. Runs as root so it can
# bind :80/:443 — restrict with podman --user or a Kubernetes securityContext.
#
# The default CMD is a self-contained dashboard+ping config so a bare
# `podman run` is healthcheckable out of the box. helm/compose override CMD
# entirely, in which case none of these defaults apply.
ENTRYPOINT ["/usr/local/bin/traefik"]
CMD ["--api.insecure=true", \
     "--ping=true", \
     "--providers.file.directory=/config/dynamic", \
     "--entrypoints.traefik.address=:8080", \
     "--entrypoints.web.address=:80", \
     "--entrypoints.websecure.address=:443"]