mirror of
https://github.com/aphrody-labs/obscura.git
synced 2026-10-13 21:04:57 +00:00
71 lines
3.1 KiB
Docker
71 lines
3.1 KiB
Docker
FROM rust:1-slim-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
ca-certificates \
|
|
perl \
|
|
make \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
|
|
# Cache dependency compilation by copying manifests first
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY vendor/ vendor/
|
|
COPY crates/obscura-dom/Cargo.toml crates/obscura-dom/Cargo.toml
|
|
COPY crates/obscura-net/Cargo.toml crates/obscura-net/Cargo.toml
|
|
COPY crates/obscura-browser/Cargo.toml crates/obscura-browser/Cargo.toml
|
|
COPY crates/obscura-cdp/Cargo.toml crates/obscura-cdp/Cargo.toml
|
|
COPY crates/obscura-js/Cargo.toml crates/obscura-js/Cargo.toml
|
|
COPY crates/obscura-mcp/Cargo.toml crates/obscura-mcp/Cargo.toml
|
|
COPY crates/obscura-render/Cargo.toml crates/obscura-render/Cargo.toml
|
|
COPY crates/obscura-cli/Cargo.toml crates/obscura-cli/Cargo.toml
|
|
COPY crates/obscura/Cargo.toml crates/obscura/Cargo.toml
|
|
|
|
# Create stub src files so cargo can resolve the dependency graph
|
|
RUN for crate in obscura-dom obscura-net obscura-browser obscura-cdp obscura-js obscura-mcp obscura-render obscura; do \
|
|
mkdir -p crates/$crate/src && echo "// stub" > crates/$crate/src/lib.rs; \
|
|
done && \
|
|
mkdir -p crates/obscura-cli/src && \
|
|
echo "fn main() {}" > crates/obscura-cli/src/main.rs && \
|
|
echo "fn main() {}" > crates/obscura-cli/src/worker.rs
|
|
|
|
RUN cargo build --release --features render --bin obscura --bin obscura-worker 2>/dev/null || true
|
|
|
|
ARG OBSCURA_VERSION
|
|
|
|
# Copy real sources and build
|
|
COPY crates/ crates/
|
|
RUN echo "Building Obscura version ${OBSCURA_VERSION:-from Cargo.toml}" && \
|
|
touch crates/*/src/*.rs && cargo build --release --features render --bin obscura --bin obscura-worker
|
|
|
|
# ---
|
|
|
|
# distroless/cc: glibc + libgcc + CA certs only — no shell, no package manager.
|
|
#
|
|
# `:nonroot` runs as uid/gid 65532 instead of root. Obscura executes untrusted
|
|
# page JavaScript in-process through V8, so a V8 exploit lands with the
|
|
# process's privileges; there is no reason for those to be root's. The image
|
|
# needs no privileged operation: it binds an unprivileged port, reads the CA
|
|
# bundle, and writes only to the storage dir and a temp dir.
|
|
#
|
|
# The tag is deliberately not pinned to a digest. distroless is rebuilt often
|
|
# with base-layer security patches, and tracking the tag picks those up; a
|
|
# digest pin would freeze them until someone remembers to bump it, which for a
|
|
# *base* image trades a real ongoing risk for a theoretical one.
|
|
FROM gcr.io/distroless/cc-debian12:nonroot
|
|
|
|
COPY --from=builder /build/target/release/obscura /obscura
|
|
COPY --from=builder /build/target/release/obscura-worker /obscura-worker
|
|
|
|
EXPOSE 9222
|
|
|
|
# Bind to 0.0.0.0 *inside the container*: a container-loopback bind is
|
|
# unreachable through `-p`, so this is required for the port to work at all.
|
|
# It is not a licence to expose the port. Non-loopback binds require
|
|
# OBSCURA_CDP_TOKEN; publish to host loopback as an additional boundary.
|
|
# The native binary still defaults to 127.0.0.1.
|
|
#
|
|
ENTRYPOINT ["/obscura"]
|
|
CMD ["serve", "--port", "9222", "--host", "0.0.0.0"]
|