server/Dockerfile.native at main · durable-workflow/server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# Durable Workflow native (Rust) server (Server #325), published from a
# native-<version> tag as durableworkflow/server 3.x. A release build (its
# version passed as DW_SERVER_VERSION) starts as is; a development build
# without a release version refuses to start without DW_RUST_EXPERIMENTAL=1.
#
# The same image runs the takeover commands an operator uses to move a
# stopped, backed-up PHP database to native: upgrade-inspect,
# upgrade-queue-inspect, upgrade-payload-inspect, upgrade-fingerprint,
# upgrade-prepare-sqlite and upgrade-takeover
# (docs/rust-server-upgrade-takeover.md).

# Rust 1.99.0 on Debian 12 (glibc 2.36, matching the runtime below), pinned
# as its multi-architecture index so each architecture builds natively:
# linux/amd64 b36c246742b4…, linux/arm64 e393e07b3c3c… (Security verified
# the index, server#803 comment 6434047541).
FROM mirror.gcr.io/library/rust@sha256:114c7a4425406451c2866b6aafe69fe29b1b298832db1277d411ac73c82d04d6 AS build
ARG CARGO_BUILD_JOBS=2
# The release version cluster info reports (the native- tag without its
# prefix); empty outside a release build.
ARG DW_SERVER_VERSION=
ENV DW_SERVER_VERSION=${DW_SERVER_VERSION} \
    CARGO_BUILD_JOBS=${CARGO_BUILD_JOBS} \
    CARGO_INCREMENTAL=0 \
    CARGO_PROFILE_RELEASE_DEBUG=0
WORKDIR /source/rust
COPY rust/ /source/rust/
# --locked: every crate is the one Cargo.lock names, checksum included.
RUN cargo build --release --locked \
    && install -m 0755 target/release/durable-workflow-server /durable-workflow-server

# A digest-pinned slim runtime: glibc for the binary, nothing else. TLS uses
# rustls with compiled-in web PKI roots, and SQLite is bundled. Debian 12
# bookworm-slim (12.15) as its multi-architecture index, refreshed for
# CVE-2026-109518 (apt 2.6.2), which the release scan found fixable in the
# previous pin (server#802).
FROM mirror.gcr.io/library/debian@sha256:734a72b3d6142a71993b4bc580ca01d8ca687f77a2c422d96a961d3376b179bc
COPY --from=build /durable-workflow-server /usr/local/bin/durable-workflow-server
# The PHP image's paths, so a taken-over installation keeps its volumes:
# SQLite in /app/database, and external payload objects under /app/storage,
# whose absolute file:// paths PHP records in the database. Native's default
# local payload root is <working directory>/storage/app/external-payloads.
RUN install -d -o 1000 -g 1000 -m 0750 /app /app/database /app/storage
# Native runs the repair pass itself: this image has no separate scheduler
# container, as published PHP's Compose deployment does.
ENV DW_BIND_ADDRESS=0.0.0.0:8080 \
    DW_RUST_MAINTENANCE_LOOP=1 \
    DB_DATABASE=/app/database/database.sqlite
USER 1000:1000
WORKDIR /app
VOLUME ["/app/database", "/app/storage"]
EXPOSE 8080
# Native stops gracefully on SIGTERM; PHP's image declares SIGWINCH.
STOPSIGNAL SIGTERM
ENTRYPOINT ["/usr/local/bin/durable-workflow-server"]
LABEL org.opencontainers.image.title="Durable Workflow Server (native)" \
      org.opencontainers.image.source="https://github.com/durable-workflow/server" \
      org.opencontainers.image.licenses="MIT"