starfield-datastore 0.1.3

Pull-through artifact cache with fail-closed validation, an S3 mirror served by presigned redirect, and a credential model that keeps upstream secrets in one place
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# syntax=docker/dockerfile:1
FROM rust:1.96-bookworm AS build
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
COPY src ./src
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/build/target \
    CARGO_BUILD_JOBS=2 cargo build --locked --release --features server \
    && install -m 0755 target/release/starfield-datastore /usr/local/bin/starfield-datastore

FROM debian:bookworm-slim AS runtime
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid 10001 starfield \
    && useradd --uid 10001 --gid starfield --home-dir /var/lib/starfield-datastore starfield \
    && install -d -o starfield -g starfield /var/lib/starfield-datastore/cache
COPY --from=build /usr/local/bin/starfield-datastore /usr/local/bin/starfield-datastore
COPY manifests/ephemeris.toml /usr/share/starfield-datastore/ephemeris.toml
LABEL org.opencontainers.image.source="https://github.com/OrbitalCommons/starfield-datastore" \
      org.opencontainers.image.description="Validated artifact cache and private ephemeris server" \
      org.opencontainers.image.licenses="MIT"
ENV STARFIELD_CACHE_DIR=/var/lib/starfield-datastore/cache
WORKDIR /var/lib/starfield-datastore
USER 10001:10001
EXPOSE 8080
STOPSIGNAL SIGTERM
ENTRYPOINT ["/usr/local/bin/starfield-datastore"]
CMD ["--config", "/etc/starfield-datastore/config.toml", "--service", "ephemeris", "serve"]