Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/Dockerfile.native
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
FROM debian:bookworm-slim AS certs
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates tzdata && rm -rf /var/lib/apt/lists/*

# The backups bin drives kopia as in-process subprocesses, so the image must
# carry the kopia CLI. buildx pulls the matching arch of this base per target
Expand All @@ -14,6 +14,10 @@ RUN addgroup -g 1000 tamanu && adduser -D -u 1000 -G tamanu tamanu
# rustls-platform-verifier reads the system trust store; busybox:glibc has none.
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

# jiff resolves IANA zone names against the system tzdb, which busybox:glibc
# also lacks. TZif files are arch-neutral, so the certs stage is a fine source.
COPY --from=certs /usr/share/zoneinfo /usr/share/zoneinfo

# kopia is a static binary, so it runs as-is in busybox:glibc. The backups bin
# spawns it via a bare `kopia` (PATH lookup), so /usr/bin is correct.
COPY --from=kopia /usr/bin/kopia /usr/bin/kopia
Expand Down