basic docker build setup

Makefile

@@ -9,7 +9,6 @@ GOPATH=$(shell go env GOPATH)
 GOPATH := $(lastword $(subst :, ,${GOPATH}))# use last GOPATH entry
 
 # Project information
-GOVERSION := 1.13.12
 PROJECT := $(CURRENT_DIR:$(GOPATH)/src/%=%)
 NAME := $(notdir $(PROJECT))
 GIT_COMMIT ?= $(shell git rev-parse --short HEAD)
@@ -65,18 +64,22 @@ define make-xc-target
 endef
 $(foreach goarch,$(XC_ARCH),$(foreach goos,$(XC_OS),$(eval $(call make-xc-target,$(goos),$(goarch),$(if $(findstring windows,$(goos)),.exe,)))))
 
-pristine:
-	@docker run \
-		--interactive \
-		--user $$(id -u):$$(id -g) \
+docker:
+	@docker build \
 		--rm \
-		--dns="8.8.8.8" \
-		--volume="${CURRENT_DIR}:/go/src/${PROJECT}" \
-		--volume="${GOPATH}/pkg/mod:/go/pkg/mod" \
-		--workdir="/go/src/${PROJECT}" \
-		--env=CGO_ENABLED="0" \
-		--env=GO111MODULE=on \
-		"golang:${GOVERSION}" env GOCACHE=/tmp make -j4 build
+		--force-rm \
+		--no-cache \
+		--compress \
+		--file="docker/Dockerfile" \
+		--build-arg="LD_FLAGS=${LD_FLAGS}" \
+		--build-arg="GOTAGS=${GOTAGS}" \
+		--tag="${OWNER}/${NAME}" \
+		--tag="${OWNER}/${NAME}:${VERSION}" \
+		"${CURRENT_DIR}"
+
+docker-push:
+	docker push "${OWNER}/${NAME}"
+	docker push "${OWNER}/${NAME}:${VERSION}"
 
 # dev builds and installs the project locally.
 dev:

docker/Dockerfile

@@ -0,0 +1,40 @@
+# This Dockerfile creates a production release image for the project. This
+# downloads the release from releases.hashicorp.com and therefore requires that
+# the release is published before building the Docker image.
+#
+# We don't rebuild the software because we want the exact checksums and
+# binary signatures to match the software and our builds aren't fully
+# reproducible currently.
+FROM alpine:latest
+
+# NAME and VERSION are the name of the software in releases.hashicorp.com
+# and the version to download.
+ARG NAME=consul-esm
+ARG VERSION
+
+# version label is required for build process
+LABEL maintainer "John Eikenberry <jae@zhar.net>"
+LABEL version=$VERSION
+
+# UID and GID of consul-esm user and group.
+# These are the defaults, this makes them explicit and overridable.
+ARG UID=100
+ARG GID=1000
+
+# Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
+ENV NAME=${NAME}
+ENV VERSION=${VERSION}
+# This is the location of the releases.
+ENV HASHICORP_RELEASES=https://releases.hashicorp.com
+
+# Create a user and group first so the IDs get set the same way,
+# even as the rest of this may change over time.
+RUN addgroup -g ${GID} ${NAME} && adduser -u ${UID} -S -G ${NAME} ${NAME}
+
+# Set up certificates, base tools, and software.
+COPY fetch-n-verify.sh docker-entrypoint.sh /
+RUN /fetch-n-verify.sh # removes self when done
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+USER ${NAME}:${NAME}
+CMD /bin/${NAME}

docker/docker-entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# Don't use dumb-init as it isn't required and the end-user has the option
+# to set it via the `--init` option.
+
+set -e
+
+# If the user is trying to run consul-esm directly with some arguments,
+# then pass them to consul-esm.
+# On alpine /bin/sh is busybox which supports this bashism.
+if [ "${1:0:1}" = '-' ]
+then
+    set -- /bin/consul-esm "$@"
+fi
+
+# MUST exec here for consul-esm to replace the shell as PID 1 in order
+# to properly propagate signals from the OS to the consul-esm process.
+exec "$@"

docker/fetch-n-verify.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+# requires environment variables..
+#
+# HASHICORP_RELEASES - URL for releases
+# NAME - application's name
+# VERSION - application version (eg. 1.2.3)
+
+set -eux
+apk add --no-cache ca-certificates gnupg
+
+BUILD_GPGKEY=C874011F0AB405110D02105534365D9472D7468F
+found=''
+
+for server in \
+    hkp://p80.pool.sks-keyservers.net:80 \
+    hkp://keyserver.ubuntu.com:80 \
+    hkp://pgp.mit.edu:80 \
+; do
+    echo "Fetching GPG key $BUILD_GPGKEY from $server";
+    gpg --keyserver "$server" --recv-keys "$BUILD_GPGKEY" && found=yes && break;
+done
+
+test -z "$found" && echo >&2 "error: failed to fetch GPG key $BUILD_GPGKEY" && exit 1
+mkdir -p /tmp/build && cd /tmp/build
+
+apkArch="$(apk --print-arch)"
+case "${apkArch}" in \
+    aarch64) ARCH='arm64' ;;
+    armhf) ARCH='arm' ;;
+    x86) ARCH='386' ;;
+    x86_64) ARCH='amd64' ;;
+    *) echo >&2 "error: unsupported architecture: ${apkArch} (see ${HASHICORP_RELEASES}/${NAME}/${VERSION}/)" && exit 1 ;;
+esac
+
+wget ${HASHICORP_RELEASES}/${NAME}/${VERSION}/${NAME}_${VERSION}_linux_${ARCH}.zip
+wget ${HASHICORP_RELEASES}/${NAME}/${VERSION}/${NAME}_${VERSION}_SHA256SUMS
+wget ${HASHICORP_RELEASES}/${NAME}/${VERSION}/${NAME}_${VERSION}_SHA256SUMS.sig
+gpg --batch --verify ${NAME}_${VERSION}_SHA256SUMS.sig ${NAME}_${VERSION}_SHA256SUMS
+grep ${NAME}_${VERSION}_linux_${ARCH}.zip ${NAME}_${VERSION}_SHA256SUMS | sha256sum -c
+unzip -d /bin ${NAME}_${VERSION}_linux_${ARCH}.zip
+
+apk del gnupg
+cd /tmp
+rm -rf /tmp/build
+gpgconf --kill gpg-agent || true
+rm -rf /root/.gnupg || true
+rm -f "$0"