freudenreichan/EinfuehrungInDocker_Pipeline2
1
0
Fork 23
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apk update for security fix

Browse Source
This commit is contained in:
Michael Weig 2026-04-11 14:05:44 +02:00
parent ed7cef53c4
commit 98e948e360
1 changed files with 3 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Dockerfile
View File

@ -4,30 +4,26 @@ FROM gcc:14-bookworm AS builder
WORKDIR /build WORKDIR /build
COPY deployment.c . COPY deployment.c .
# Statisch linken → kein libc im Runtime-Image nötig
RUN gcc -O2 -static -o deployment deployment.c RUN gcc -O2 -static -o deployment deployment.c
# ── Stage 2: Runtime ───────────────────────────────────────────────────────── # ── Stage 2: Runtime ─────────────────────────────────────────────────────────
FROM alpine:3.21 FROM alpine:3.21
# Alle Pakete auf neuesten Stand bringen → patcht libcrypto3/libssl3 auf 3.3.7-r0
RUN apk update && apk upgrade --no-cache
# Nicht-root-User anlegen # Nicht-root-User anlegen
RUN addgroup -S appgroup && adduser -S appuser -G appgroup RUN addgroup -S appgroup && adduser -S appuser -G appgroup
# Output-Verzeichnis mit korrekten Rechten anlegen # Output-Verzeichnis mit korrekten Rechten anlegen
RUN mkdir /output && chown appuser:appgroup /output RUN mkdir /output && chown appuser:appgroup /output
# Kompiliertes Binary aus Build-Stage kopieren
COPY --from=builder /build/deployment /app/deployment COPY --from=builder /build/deployment /app/deployment
# Volume für Ausgabe-Dateien
VOLUME ["/output"] VOLUME ["/output"]
# Als nicht-root laufen
USER appuser USER appuser
WORKDIR /app WORKDIR /app
# Healthcheck: prüft ob das Binary vorhanden und ausführbar ist,
# und ob die Ausgabedatei wächst / existiert
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD test -f /output/output.txt && test -s /output/output.txt || exit 1 CMD test -f /output/output.txt && test -s /output/output.txt || exit 1