-
Notifications
You must be signed in to change notification settings - Fork 9
Create Dockerfile #133
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Create Dockerfile #133
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reviewed b44296a. In addition to my comments, the zizmor failures need to be fixed.
echo "zallet_version=$(echo ${{ github.ref_name }} | sed 's/v//g')" >> $GITHUB_OUTPUT | ||
|
||
build_push: | ||
uses: zcash/.github/.github/workflows/build-and-push-docker-hub.yaml@main |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is this doing? It looks recursive to me which makes no sense. Is this actually pulling from the zcash/zcash
repo?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, this is the template we're using in Zcash and across several of our other repositories. - Just realized I missed updating a path — just fixed it now.
|
||
- name: Run command inside Docker container | ||
run: | | ||
docker run --rm zallet -h |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
FYI the problem you last commit was fixing is that you tried to use -help
as the flag, which is incorrect for Zallet. --help
is what you should use (or -h
), as the help text itself should show.
In general, zcashd
's support for single-hypen word flags to CLI is not something we are going to support in Zallet.
This PR adds a multi-stage Docker build for the
zallet
binary, resulting in a minimal and secure container image.Build Stage (
builder
)rust:1-slim
(amd64).clang
,libclang-dev
,pkg-config
,git
).--release
mode.strip
to reduce binary size.Runtime Stage (
distroless
)gcr.io/distroless/cc
for a minimal and secure runtime environment.zallet
binary.Additional Changes
This setup ensures small image size, strong security practices, and a clear separation between build and runtime environments.