Dockerfile

# Build the production daemon as a static Linux binary. BuildKit supplies
# TARGETOS/TARGETARCH for ordinary and multi-platform builds.
FROM golang:1.26.8-alpine3.24 AS builder
ENV GOTOOLCHAIN=local GOWORK=off
WORKDIR /src

COPY go.mod go.sum ./
RUN test "$(go env GOVERSION)" = "$(awk '$1 == "toolchain" { print $2 }' go.mod)" \
 && go mod download
COPY . .

ARG TARGETOS=linux
ARG TARGETARCH
ARG VERSION=dev
ARG COMMIT=""
ARG BUILD_DATE=""
RUN target_arch="${TARGETARCH:-$(go env GOARCH)}" && \
    CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${target_arch}" \
    go build -trimpath \
      -ldflags="-s -w \
        -X github.com/KazuhaHub/passwall-node/v4/internal/version.Version=${VERSION} \
        -X github.com/KazuhaHub/passwall-node/v4/internal/version.Commit=${COMMIT} \
        -X github.com/KazuhaHub/passwall-node/v4/internal/version.BuildDate=${BUILD_DATE}" \
      -o /out/passwall-node ./cmd/node

# The entrypoint starts as root only to turn a read-only Docker secret into the
# daemon's required mode-0600 credential and to repair the state-volume owner.
# It then execs the daemon through su-exec as an unprivileged numeric UID/GID.
FROM alpine:3.24.1
ARG VERSION=dev
ARG STATE_SCHEMA=9
ARG UPGRADE_CONTRACT=1
# THE UPDATER HANDOVER LABEL IS A LITERAL, NOT A BUILD ARGUMENT. It lists the
# handover protocols this source's updater speaks, and an updater moves itself
# onto the agent's image only if that image lists its own; an argument could make
# an image promise code its binary does not have. A deployment test holds it to
# upgrade.UpdaterHandoverProtocols.
LABEL org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.version="${VERSION}" \
      io.kazuhahub.passwall-node.state-schema="${STATE_SCHEMA}" \
      io.kazuhahub.passwall-node.upgrade-contract="${UPGRADE_CONTRACT}" \
      io.kazuhahub.passwall-node.updater-handover="1"
RUN apk add --no-cache ca-certificates tzdata su-exec \
 && addgroup -g 10001 passwall-node \
 && adduser -D -H -u 10001 -G passwall-node passwall-node

ENV TZ=UTC \
    PSP_NODE_DATA_DIR=/var/lib/passwall-node \
    PSP_NODE_CREDENTIAL_FILE=/run/secrets/node_credential \
    PSP_NODE_XRAY_API_LISTEN=127.0.0.1:10085 \
    PSP_NODE_SING_BOX_API_LISTEN=127.0.0.1:10086 \
    PUID=10001 \
    PGID=10001

WORKDIR /var/lib/passwall-node
COPY --from=builder /out/passwall-node /usr/local/bin/passwall-node
COPY LICENSE NOTICE /usr/share/licenses/passwall-node/
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod 0755 /usr/local/bin/passwall-node /usr/local/bin/docker-entrypoint.sh \
 && mkdir -p /var/lib/passwall-node /run/passwall-node \
 && chown -R 10001:10001 /var/lib/passwall-node /run/passwall-node

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]