mirror of
https://github.com/dani-garcia/vaultwarden.wiki.git
synced 2026-10-23 01:58:09 +03:00
Mathijs van Veluw
061694d0cb
When using xx-cargo it uses a different linker then the default one. This causes some default fixes Debian/Ubuntu add for the Cortex-A53 architectures to not be included. This commit fixes that by checking if the target architecture is arm64 and if so, will add the needed fix argument. This should prevent issues reported here #7754. We can not say this with 100% certainty since this bug sometimes appears and sometimes it does not. Fixes #7754 Signed-off-by: BlackDex <black.dex@gmail.com>
204 lines
8.7 KiB
Docker
204 lines
8.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# check=skip=FromPlatformFlagConstDisallowed,RedundantTargetPlatform
|
|
|
|
# This file was generated using a Jinja2 template.
|
|
# Please make your changes in `DockerSettings.yaml` or `Dockerfile.j2` and then `make`
|
|
# This will generate two Dockerfile's `Dockerfile.debian` and `Dockerfile.alpine`
|
|
|
|
# Using multistage build:
|
|
# https://docs.docker.com/develop/develop-images/multistage-build/
|
|
# https://whitfin.io/speeding-up-rust-docker-builds/
|
|
|
|
####################### VAULT BUILD IMAGE #######################
|
|
# The web-vault digest specifies a particular web-vault build on Docker Hub.
|
|
# Using the digest instead of the tag name provides better security,
|
|
# as the digest of an image is immutable, whereas a tag name can later
|
|
# be changed to point to a malicious image.
|
|
#
|
|
# To verify the current digest for a given tag name:
|
|
# - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
|
|
# click the tag name to view the digest of the image it currently points to.
|
|
# - From the command line:
|
|
# $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
|
|
# $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
|
|
# [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
|
|
#
|
|
# - Conversely, to get the tag name from the digest:
|
|
# $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
|
|
# [docker.io/vaultwarden/web-vault:v2026.7.0]
|
|
#
|
|
FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
|
|
|
|
########################## Cross Compile Docker Helper Scripts ##########################
|
|
## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
|
|
## And these bash scripts do not have any significant difference if at all
|
|
FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
|
|
|
|
########################## BUILD IMAGE ##########################
|
|
# hadolint ignore=DL3006
|
|
FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
|
|
# hadolint ignore=DL3067
|
|
COPY --from=xx / /
|
|
ARG TARGETARCH
|
|
ARG TARGETVARIANT
|
|
ARG TARGETPLATFORM
|
|
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
|
|
# Build time options to avoid dpkg warnings and help with reproducible builds.
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
LANG=C.UTF-8 \
|
|
TZ=UTC \
|
|
TERM=xterm-256color \
|
|
CARGO_HOME="/root/.cargo" \
|
|
USER="root"
|
|
# Install clang && xx-c-essentials to get `xx-cargo` working
|
|
# Install pkg-config to allow amd64 builds to find all libraries
|
|
# Install git so build.rs can determine the correct version
|
|
# Install the libc cross packages based upon the debian-arch
|
|
RUN apt-get update && \
|
|
apt-get install -y \
|
|
--no-install-recommends \
|
|
clang \
|
|
git && \
|
|
xx-apt-get install -y \
|
|
--no-install-recommends \
|
|
libpq-dev \
|
|
libpq5 \
|
|
libssl-dev \
|
|
libmariadb-dev \
|
|
pkg-config \
|
|
zlib1g-dev \
|
|
xx-c-essentials && \
|
|
# Run xx-cargo early, since it sometimes seems to break when run at a later stage
|
|
echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo
|
|
|
|
# Create CARGO_HOME folder and don't download rust docs
|
|
RUN mkdir -pv "${CARGO_HOME}" && \
|
|
rustup set profile minimal
|
|
|
|
# Creates a dummy project used to grab dependencies
|
|
RUN USER=root cargo new --bin /app
|
|
WORKDIR /app
|
|
|
|
RUN . /env-cargo && \
|
|
rustup target add "${CARGO_TARGET}"
|
|
|
|
# Copies over *only* your manifests and build files
|
|
COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
|
|
COPY ./macros ./macros
|
|
|
|
ARG CARGO_PROFILE=release
|
|
|
|
# Configure the DB ARG as late as possible to not invalidate the cached layers above
|
|
ARG DB=sqlite,mysql,postgresql
|
|
|
|
# Builds your dependencies and removes the
|
|
# dummy project, except the target folder
|
|
# This folder contains the compiled dependencies
|
|
RUN . /env-cargo && \
|
|
# Configure xx-cargo for target pkg-config and Debian transitive library lookup
|
|
# https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
|
|
# https://github.com/dani-garcia/vaultwarden/discussions/7522
|
|
if xx-info is-cross; then \
|
|
XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
|
|
fi && \
|
|
# Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
|
|
# Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
|
|
# This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
|
|
# See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
|
|
# See: https://github.com/dani-garcia/vaultwarden/issues/7754
|
|
if [ "$(xx-info arch)" = "arm64" ]; then \
|
|
XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
|
|
fi && \
|
|
export XX_RUSTFLAGS && \
|
|
PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
|
|
find . -not -path "./target*" -delete
|
|
|
|
# Copies the complete project
|
|
# To avoid copying unneeded files, use .dockerignore
|
|
COPY . .
|
|
|
|
ARG VW_VERSION
|
|
|
|
# Builds again, this time it will be the actual source files being build
|
|
RUN . /env-cargo && \
|
|
# Make sure that we actually build the project by updating the src/main.rs timestamp
|
|
# Also do this for build.rs to ensure the version is rechecked
|
|
touch build.rs src/main.rs && \
|
|
# Create a symlink to the binary target folder to easy copy the binary in the final stage
|
|
# Configure xx-cargo for target pkg-config and Debian transitive library lookup
|
|
# https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
|
|
# https://github.com/dani-garcia/vaultwarden/discussions/7522
|
|
if xx-info is-cross; then \
|
|
XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
|
|
fi && \
|
|
# Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
|
|
# Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
|
|
# This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
|
|
# See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
|
|
# See: https://github.com/dani-garcia/vaultwarden/issues/7754
|
|
if [ "$(xx-info arch)" = "arm64" ]; then \
|
|
XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
|
|
fi && \
|
|
export XX_RUSTFLAGS && \
|
|
PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
|
|
if [ "${CARGO_PROFILE}" = "dev" ] ; then \
|
|
ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
|
|
else \
|
|
ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
|
|
fi
|
|
|
|
|
|
######################## RUNTIME IMAGE ########################
|
|
# Create a new stage with a minimal image
|
|
# because we already have a binary built
|
|
#
|
|
# To build these images you need to have qemu binfmt support.
|
|
# See the following pages to help install these tools locally
|
|
# Ubuntu/Debian: https://wiki.debian.org/QemuUserEmulation
|
|
# Arch Linux: https://wiki.archlinux.org/title/QEMU#Chrooting_into_arm/arm64_environment_from_x86_64
|
|
#
|
|
# Or use a Docker image which modifies your host system to support this.
|
|
# The GitHub Actions Workflow uses the same image as used below.
|
|
# See: https://github.com/tonistiigi/binfmt
|
|
# Usage: docker run --privileged --rm tonistiigi/binfmt --install arm64,arm
|
|
# To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
|
|
#
|
|
# We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
|
|
# hadolint ignore=DL3065
|
|
FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim
|
|
|
|
ENV ROCKET_PROFILE="release" \
|
|
ROCKET_ADDRESS=0.0.0.0 \
|
|
ROCKET_PORT=80 \
|
|
DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Create data folder and Install needed libraries
|
|
RUN mkdir /data && \
|
|
apt-get update && apt-get install -y \
|
|
--no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
libmariadb3 \
|
|
libpq5 \
|
|
openssl && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
VOLUME /data
|
|
EXPOSE 80
|
|
|
|
# Copies the files from the context (Rocket.toml file and web-vault)
|
|
# and the binary from the "build" stage to the current stage
|
|
WORKDIR /
|
|
|
|
COPY docker/healthcheck.sh docker/start.sh /
|
|
|
|
COPY --from=vault /web-vault ./web-vault
|
|
COPY --from=build /app/target/final/vaultwarden .
|
|
|
|
HEALTHCHECK --interval=60s --timeout=10s CMD ["/healthcheck.sh"]
|
|
|
|
CMD ["/start.sh"]
|