Leonardo Devai
3a72aad99d
Pinned 2026 toolchains (Go 1.26, Rust 1.98/edition 2024, Python 3.14 + uv, Node 24, Zig 0.16, NixOS 26.05), postgres 18 / mongo 8, lockfiles built from, non-root runtimes, .dockerignore, per-project LICENSE, READMEs with the git.devai.io clone line, checkout@v7 CI. Security fixes in the legacy Rust APIs (any-password login, self-assigned admin, hard-coded JWT secret), JWT alg/exp/sub enforcement across the blog series, safe markdown links in the frontends, and many smaller bugs — every project was built, run and exercised end to end. Adds scripts/publish.sh + a CI publish job that splits every folder into its own repo at git.devai.io/templates/<folder>. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01128fhuZbgivaSJvtMf4s1G
23 lines
914 B
Docker
23 lines
914 B
Docker
FROM debian:trixie-slim AS build
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates curl xz-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
ARG ZIG_VERSION=0.16.0
|
|
RUN curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-$(uname -m)-linux-${ZIG_VERSION}.tar.xz" \
|
|
| tar -xJ -C /opt \
|
|
&& ln -s "/opt/zig-$(uname -m)-linux-${ZIG_VERSION}/zig" /usr/local/bin/zig
|
|
WORKDIR /app
|
|
# Fetch the dependencies pinned in build.zig.zon in their own cached layer.
|
|
COPY build.zig build.zig.zon ./
|
|
RUN zig build --fetch
|
|
COPY schema.sql ./
|
|
COPY src ./src
|
|
# -Dcpu=baseline: run on any CPU of this architecture, not just the build machine's.
|
|
RUN zig build -Doptimize=ReleaseSafe -Dcpu=baseline
|
|
|
|
# The binary is fully static: no libc needed at runtime.
|
|
FROM gcr.io/distroless/static-debian13:nonroot
|
|
COPY --from=build /app/zig-out/bin/blog /usr/local/bin/blog
|
|
ENV PORT=8080
|
|
EXPOSE 8080
|
|
CMD ["blog"]
|