mrambossekandClaude Fable 5
3cdbccee18
Running an unfamiliar binary by name should tell you what it does, not bind a dozen ports and start answering the internet. --serve (or --daemon) now does that, and a bare invocation prints usage and exits 2 - non-zero on purpose, so a service manager sees a failure rather than concluding the server ran and finished cleanly. The hazard this creates is worth spelling out, because it bites once and silently: three places started the binary with no arguments - the systemd unit, the unit template, and the Dockerfile - and --self-update replaces the binary but never the unit. A routine update would therefore leave a service that cannot start, discovered whenever the host next rebooted. So the updater repairs it: after replacing the binary it appends --serve to an ExecStart that has no flags, but only in a unit this program wrote (identified by its description). Editing an operator's hand-written unit would be overreach; leaving ours broken would be negligence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
29 lines
1.1 KiB
Docker
29 lines
1.1 KiB
Docker
# SPDX-FileCopyrightText: 2026 Echolot contributors
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# syntax=docker/dockerfile:1
|
|
|
|
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod ./
|
|
RUN go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags "-s -w -X main.Version=${VERSION}" \
|
|
-o /out/echolot-server ./cmd/echolot-server
|
|
|
|
# Distroless static: no shell, no package manager; the server is pure Go.
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
COPY --from=build /out/echolot-server /echolot-server
|
|
# State (device store + generated TLS) must persist across container restarts.
|
|
ENV ECHOLOT_STATE_DIR=/state
|
|
VOLUME ["/state"]
|
|
# Ports are documentation only — run with network_mode: host (see compose.yaml):
|
|
# the data plane must see real client source addresses/TTLs, and Docker's
|
|
# userland NAT would falsify exactly what this server exists to observe.
|
|
EXPOSE 8441/tcp 8442/udp 8443/tcp
|
|
# The verb is explicit here too, so `docker run <image>` serves and `docker run <image> --help`
|
|
# still works by overriding the command.
|
|
ENTRYPOINT ["/echolot-server"]
|
|
CMD ["--serve"]
|