32 lines
1.3 KiB
Docker
32 lines
1.3 KiB
Docker
# secret-rotator — static musl binary in a FROM-scratch image.
|
|
#
|
|
# Nothing in the final image but the binary: no libc, no shell, no package
|
|
# manager, no CA bundle on disk. That means no base-image CVE stream to patch
|
|
# and nothing for a compromised rotator to exec.
|
|
#
|
|
# TLS still works: rustls is compiled in with webpki-roots, so the trust store
|
|
# lives inside the binary rather than in /etc/ssl. (In-cluster traffic to
|
|
# OpenBao and Home Assistant is plain HTTP anyway; TLS is here so the same
|
|
# binary can take over the external-API rotators — Cloudflare, Proxmox.)
|
|
FROM rust:1.99-alpine@sha256:0cce0a5e0e8ba67b455257a3a02a1d99005f382748789d6464460028810f1627 AS build
|
|
|
|
# musl-dev provides the C runtime bits the linker needs for a fully static
|
|
# binary; nothing from it ends up in the final image.
|
|
RUN apk add --no-cache musl-dev
|
|
|
|
WORKDIR /build
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY src ./src
|
|
|
|
RUN cargo build --release --target x86_64-unknown-linux-musl \
|
|
&& strip target/x86_64-unknown-linux-musl/release/secret-rotator
|
|
|
|
FROM scratch
|
|
COPY --from=build /build/target/x86_64-unknown-linux-musl/release/secret-rotator /secret-rotator
|
|
|
|
# Matches runAsUser on the rotation Jobs. There is no /etc/passwd in a scratch
|
|
# image, so this is a bare uid by necessity — which is also all Kubernetes needs.
|
|
USER 65534:65534
|
|
|
|
ENTRYPOINT ["/secret-rotator"]
|