micromize/Dockerfile at main · micromize-dev/micromize · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
FROM ghcr.io/inspektor-gadget/gadget-builder:main AS gadget-builder

ARG IG_VERSION=v0.47.0
ARG IMAGE_TAG=dev
ARG TARGETOS
ARG TARGETARCH

# Install ig
RUN wget -qO- https://github.com/inspektor-gadget/inspektor-gadget/releases/download/${IG_VERSION}/ig-${TARGETOS}-${TARGETARCH}-${IG_VERSION}.tar.gz \
    | tar -xz -C /usr/local/bin ig

WORKDIR /app
COPY include/micromize /usr/include/micromize
COPY gadgets gadgets

# Build gadgets
RUN mkdir -p build/gadgets && \
    for gadget in fs-restrict cap-restrict ptrace-restrict binary-attestation; do \
        echo "Building gadget: $gadget" && \
        ig image build \
            --local \
            -t ghcr.io/micromize-dev/micromize/${gadget}:${IMAGE_TAG} \
            gadgets/${gadget} && \
        ig image export \
            ghcr.io/micromize-dev/micromize/${gadget}:${IMAGE_TAG} \
            build/gadgets/${gadget}.tar; \
    done

FROM --platform=$BUILDPLATFORM golang:1.25.5-alpine AS builder

ARG IG_VERSION=v0.47.0
ARG IMAGE_TAG=dev
ARG TARGETOS
ARG TARGETARCH

WORKDIR /app

# Cache dependencies
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Copy built gadgets from the gadget-builder stage
# They need to be placed where embeds.go expects them (cmd/micromize/build/)
RUN mkdir -p cmd/micromize/build
COPY --from=gadget-builder /app/build/gadgets/*.tar cmd/micromize/build/

# Build the static binary
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build \
    -tags release \
    -ldflags "-X github.com/inspektor-gadget/inspektor-gadget/internal/version.version=${IG_VERSION} -X main.Version=${IMAGE_TAG} -w -s -extldflags '-static'" \
    -o /micromize \
    ./cmd/micromize

# Build the image
FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=builder /micromize /micromize

# Access to kernel debug filesystem (tracefs)
VOLUME ["/sys/kernel/debug"]

# Access to kernel security configuration (LSM)
VOLUME ["/sys/kernel/security"]

# Access to BPF filesystem for map pinning
VOLUME ["/sys/fs/bpf"]

# Access to cgroup hierarchy
VOLUME ["/sys/fs/cgroup"]

# Access to host process information
VOLUME ["/host/proc"]

# Access to host system information
VOLUME ["/host/sys"]

# Access to host binaries and libraries
VOLUME ["/host/bin"]
VOLUME ["/host/usr"]

# Access to host runtime files (sockets, etc.)
VOLUME ["/host/run"]

ENV HOST_ROOT=/host
ENTRYPOINT ["/micromize"]