50 lines
1.9 KiB
Docker
50 lines
1.9 KiB
Docker
# ==============================
|
||
# 乾坤 · 魂镜安全沙箱镜像（Sandbox Engine）：Rust + axum，多阶段构建。
|
||
# 构建：rust:bookworm（含 toolchain）；运行：debian:bookworm-slim（需 glibc）。
|
||
# 监听 8090，健康检查走 GET /healthz。
|
||
# 隔离在进程组 + 超时 + 资源限制层面；如需更强隔离（seccomp / cgroup / read-only 根），见 sandbox/README.md「后续加固」。
|
||
# ==============================
|
||
|
||
# ---------- 构建阶段 ----------
|
||
FROM rust:1.83-bookworm AS builder
|
||
WORKDIR /build
|
||
|
||
# 国内 crates 镜像（按网络情况保留或删除该 RUN）
|
||
RUN printf '[source.crates-io]\nreplace-with = "ustc"\n[source.ustc]\nregistry = "sparse+https://mirrors.ustc.edu.cn/crates.io-index"\n' \
|
||
> /usr/local/cargo/config.toml
|
||
|
||
# 先复制依赖清单以最大化层缓存（dummy src 触发依赖编译），再覆盖真实源码
|
||
COPY sandbox/Cargo.toml ./
|
||
RUN mkdir -p src && echo 'fn main() {}' > src/main.rs && cargo build --release || true
|
||
|
||
# 复制真实源码并构建（sandbox/ 整体拷入；根 .dockerignore 已忽略 target/）
|
||
COPY sandbox/ ./
|
||
RUN touch src/main.rs && cargo build --release
|
||
|
||
# ---------- 运行阶段 ----------
|
||
FROM debian:bookworm-slim
|
||
|
||
ENV TZ=Asia/Shanghai \
|
||
RUST_LOG=info \
|
||
SANDBOX_HOST=0.0.0.0 \
|
||
SANDBOX_PORT=8090 \
|
||
SANDBOX_BASE_WORKDIR=/app/sandbox-work \
|
||
SANDBOX_LOG_DIR=/app/logs
|
||
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
ca-certificates tzdata curl \
|
||
&& rm -rf /var/lib/apt/lists/* \
|
||
&& ln -snf "/usr/share/zoneinfo/$TZ" /etc/localtime && echo "$TZ" > /etc/timezone
|
||
|
||
WORKDIR /app
|
||
RUN mkdir -p /app/sandbox-work /app/logs
|
||
|
||
COPY --from=builder /build/target/release/hunjing-sandbox /usr/local/bin/hunjing-sandbox
|
||
|
||
EXPOSE 8090
|
||
|
||
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
||
CMD curl -fsS "http://127.0.0.1:${SANDBOX_PORT}/healthz" || exit 1
|
||
|
||
CMD ["hunjing-sandbox"]
|