mirror of
https://github.com/pomerium/pomerium.git
synced 2025-08-01 16:01:26 +02:00
d8d59ddded
The debian 'stable' images configure apt to install from the rolling 'stable' repository, rather than a specific Debian release. Thus even though we pin to a specific Docker image digest, the packages installed by 'apt-get' can change when a new Debian release is promoted to stable. Instead, pin to an image where apt is configured to install from repositories for a specific Debian release (in this case, bullseye).
18 lines
900 B
Text
18 lines
900 B
Text
# build our own root trust store from current stable
|
|
FROM debian:latest@sha256:432f545c6ba13b79e2681f4cc4858788b0ab099fc1cca799cc0fae4687c69070 as casource
|
|
RUN apt-get update && apt-get install -y ca-certificates=20210119
|
|
# Remove expired root (https://github.com/pomerium/pomerium/issues/2653)
|
|
RUN rm /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt && update-ca-certificates
|
|
|
|
|
|
FROM busybox:latest@sha256:caa382c432891547782ce7140fb3b7304613d3b0438834dce1cad68896ab110a as build
|
|
RUN touch /config.yaml
|
|
|
|
FROM gcr.io/distroless/base:debug@sha256:3a6219499a89088ff5d37ce8fd3e3a61fccb75ef05a4e0ba2092ea92d380f48f
|
|
ENV AUTOCERT_DIR /data/autocert
|
|
WORKDIR /pomerium
|
|
COPY pomerium /bin/
|
|
COPY --from=build /config.yaml /pomerium/config.yaml
|
|
COPY --from=casource /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
ENTRYPOINT [ "/bin/pomerium" ]
|
|
CMD ["-config","/pomerium/config.yaml"]
|