1 # hu13 — multi-stage build (f0rge issue #11).2 #3 #   docker build -t hu13 .4 #   docker run --rm -p 39313:39313 \5 #     -v "$PWD:/data/repo:ro" -v hu13-inbox:/data/inbox \6 #     [-e HU13_BRANCH=main] [-e HU13_CLONE_URL=...] \7 #     [-e HU13_PUBLIC_ORIGIN=http://host:39313] \8 #     hu139 #10 # Stage 1: pinned Rust builder. Only the files cargo needs are copied so11 # the layer cache survives unrelated edits. `--locked` keeps Cargo.lock12 # authoritative.13 14 FROM rust:1.98-bookworm AS builder15 WORKDIR /src16 COPY Cargo.toml Cargo.lock ./17 COPY src/ ./src/18 COPY static/ ./static/19 RUN cargo build --locked --release20 21 # Stage 2: minimal runtime. ca-certificates for https clone URLs, git22 # (hu13 shells out to `git -C` for every read — no git, no build),23 # nonroot `hu13` (uid 10000), the static binary + entrypoint only.24 FROM debian:bookworm-slim25 RUN apt-get update \26     && apt-get install -y --no-install-recommends ca-certificates git \27     && rm -rf /var/lib/apt/lists \28     && useradd --uid 10000 --create-home --shell /usr/sbin/nologin hu13 \29     && mkdir -p /srv/www /data/inbox \30     && chown -R hu13:hu13 /srv/www /data/inbox31 COPY --from=builder /src/target/release/hu13 /usr/local/bin/hu1332 COPY entrypoint.sh /usr/local/bin/entrypoint.sh33 RUN chmod +x /usr/local/bin/entrypoint.sh34 # Header config defaults (m6, issues #21 + #24): empty means fallback —35 # repo dir name for the name (never blank), hidden line for the description.36 # Public origin default (m6, issue #32): empty means unset (bundle-first37 # presentation; set HU13_PUBLIC_ORIGIN to advertise `<origin>/repo.git`38 # (`git clone <origin>/repo.git` needs no smart server) and39 # `<origin>/repo.bundle` for the snapshot download).40 ENV HU13_REPO_NAME=""41 ENV HU13_DESCRIPTION=""42 ENV HU13_PUBLIC_ORIGIN=""43 USER hu1344 EXPOSE 3931345 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]