PwnMesh/Dockerfile at main · do-whilefor/PwnMesh · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
FROM node:22-bookworm AS web-build
WORKDIR /web
COPY web/package.json web/package-lock.json ./
RUN npm ci
COPY web/ ./
RUN --network=none npm run build

FROM golang:1.26-bookworm AS source
RUN apt-get update && apt-get install -y --no-install-recommends python3 \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
# Test and documentation edits must not invalidate the application build.
COPY cmd/ ./cmd/
COPY internal/ ./internal/
COPY scripts/build.sh scripts/common.sh ./scripts/

FROM source AS backend-build
RUN --network=none PWNMESH_HEADLESS=1 bash scripts/build.sh /out/pwnmesh

FROM backend-build AS backend-test
COPY tests/ ./tests/
COPY scripts/test.sh ./scripts/test.sh
RUN --network=none go vet -mod=readonly -tags=headless ./cmd/... ./internal/... \
    && go test -mod=readonly -timeout=60s ./tests/... \
    && PWNMESH_TEST_HEADLESS=1 bash scripts/test.sh /out/pwnmesh

FROM source AS build
COPY web/embed.go ./web/embed.go
COPY --from=web-build /web/dist ./web/dist
RUN --network=none PWNMESH_WEB_PREBUILT=1 bash scripts/build.sh /out/pwnmesh

FROM build AS test
COPY tests/ ./tests/
COPY scripts/test.sh ./scripts/test.sh
# CI builds this same target through the default runtime image.
RUN --network=none go vet -mod=readonly ./cmd/... ./internal/... ./web \
    && go test -mod=readonly -timeout=60s ./tests/... \
    && bash scripts/test.sh /out/pwnmesh

FROM debian:bookworm-slim AS runtime-base
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl bash ripgrep \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/pwnmesh"]
CMD ["serve", "--host", "0.0.0.0", "--db-path", "/data/pwnmesh.db"]

# Explicit opt-in for development; the default final target retains validation.
FROM runtime-base AS development
COPY --from=build /out/pwnmesh /usr/local/bin/pwnmesh

# API, Dispatcher and Worker binary without the Node/Web build dependency.
FROM runtime-base AS headless
COPY --from=backend-test /out/pwnmesh /usr/local/bin/pwnmesh

FROM runtime-base AS runtime
COPY --from=test /out/pwnmesh /usr/local/bin/pwnmesh