Dockerfile

ARG BINARY_NAME_DEFAULT=speer-test

FROM clux/muslrust:stable as builder
RUN groupadd -g 10001 -r dockergrp && useradd -r -g dockergrp -u 10001 dockeruser
ARG BINARY_NAME_DEFAULT
ENV BINARY_NAME=$BINARY_NAME_DEFAULT

ARG TARGET

RUN apt-get install -y --no-install-recommends ca-certificates
RUN update-ca-certificates
# Build the project with target x86_64-unknown-linux-musl

# Build dummy main with the project's Cargo lock and toml
# This is a docker trick in order to avoid downloading and building
# dependencies when lock and toml not is modified.
COPY Cargo.lock .
COPY Cargo.toml .
RUN mkdir src \
    && echo "fn main() {print!(\"Dummy main\");} // dummy file" > src/main.rs
RUN set -x && cargo build --target ${TARGET} --release
RUN ["/bin/bash", "-c", "set -x && rm target/${TARGET}/release/deps/${BINARY_NAME//-/_}*"]

# Now add the rest of the project and build the real main
COPY src ./src
RUN set -x && cargo build --target ${TARGET} --release
RUN mkdir -p /build-out
RUN set -x && cp target/${TARGET}/release/$BINARY_NAME /build-out/

# Create a minimal docker image
FROM scratch

COPY --from=0 /etc/passwd /etc/passwd
COPY --from=0 /etc/ssl/certs /etc/ssl/certs

USER dockeruser

ARG BINARY_NAME_DEFAULT
ENV BINARY_NAME=$BINARY_NAME_DEFAULT

ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_DIR=/etc/ssl/certs

ENV RUST_LOG="error,$BINARY_NAME=info"
COPY --from=builder /build-out/$BINARY_NAME /

# Start with an execution list (there is no sh in a scratch image)
# No shell => no variable expansion, |, <, >, etc
# Hard coded start command
CMD ["/speer-test"]