distribution/Dockerfile
# Holger's server image for Kubernetes (lane B4, A31 §7.7): ONE static musl
# binary FROM scratch. No shell, no libc, no package manager; uid 65532.
#
# The image comes from holger.rs ITSELF (owner decision 2026-10-26): Holger
# serves its own OCI images. The release pushes
# holger.rs/nordisk/holger:<ver> (this file)
# holger.rs/nordisk/holger-scan-worker:<ver> (distribution/scan-worker/Containerfile)
# and the Helm chart (deploy/helm/holger) pulls both from there.
#
# Build (the binary is built in the pinned toolchain, not in this file, so the
# build needs no network and no sibling checkout in the image context):
# cargo xtask k8s image # static musl holger + scan worker, both images
# cargo xtask k8s chart # helm lint + template, the pod checked
# cargo xtask k8s test # the pod played: /readyz follows the sidecar,
# # a local Holger serves the image to podman pull
# cargo xtask k8s publish # the release's pushes, printed (nothing pushed)
#
# The context `cargo xtask k8s image` hands this file: `holger` (static, checked
# for no ELF interpreter), `passwd` and `group` (uid 65532, and 65533 for the
# sidecar). Run (config and data on mounted volumes, root read-only):
# podman run --read-only --tmpfs /tmp -v ./holger.ron:/etc/holger/holger.ron:ro \
# -v holger-data:/var/lib/holger -p 8443:8443 holger.rs/nordisk/holger:<ver>
FROM scratch
COPY --chmod=0555 holger /holger
COPY passwd /etc/passwd
COPY group /etc/group
USER 65532:65532
ENV HOME=/tmp
# 50051 gRPC, 8443 HTTP/OCI and the package doors, /healthz and /readyz
EXPOSE 50051 8443
ENTRYPOINT ["/holger"]
CMD ["start", "--config", "/etc/holger/holger.ron"]