Spaces:

ccyyss
/

ffooxx

Running

ffooxx / Dockerfile

cleanup: remove temporary /diag/ log exposure and OBS log dir override (multipart fix verified)

0717de4 verified 23 days ago

2.34 kB

FROM debian:bookworm-slim

RUN apt-get update && \
    apt-get install -y --no-install-recommends nginx curl unzip ca-certificates gcc libc6-dev && \
    rm -rf /var/lib/apt/lists/*

# RustFS 1.0.3 binary (glibc build) from the official GitHub release,
# verified against the release SHA256SUMS.
RUN curl -fsSL https://github.com/rustfs/rustfs/releases/download/1.0.3/rustfs-linux-x86_64-gnu-v1.0.3.zip -o /tmp/rustfs.zip && \
    curl -fsSL https://github.com/rustfs/rustfs/releases/download/1.0.3/SHA256SUMS -o /tmp/SHA256SUMS && \
    SHA=$(grep 'rustfs-linux-x86_64-gnu-v1.0.3.zip$' /tmp/SHA256SUMS | awk '{print $1}') && \
    echo "$SHA  /tmp/rustfs.zip" | sha256sum -c - && \
    unzip -o /tmp/rustfs.zip -d /tmp/rustfs-bin && \
    find /tmp/rustfs-bin -name rustfs -type f -exec install -m 0755 {} /usr/bin/rustfs \; && \
    rm -rf /tmp/rustfs.zip /tmp/SHA256SUMS /tmp/rustfs-bin

COPY nginx.conf /etc/nginx/nginx.conf

# linkshim: the HF bucket FUSE mount has no hard-link support, and RustFS
# 1.0.3 publishes multipart part metadata via hard_link() (EOPNOTSUPP ->
# every UploadPart fails). The shim falls back to copying on EOPNOTSUPP.
COPY linkshim.c /usr/local/src/linkshim.c
RUN gcc -shared -fPIC -O2 -o /usr/local/lib/linkshim.so /usr/local/src/linkshim.c -ldl && \
    apt-get purge -y gcc libc6-dev && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*

RUN mkdir -p /data /logs

# DIRECT_IO off and DRIVE_SYNC off: the HF bucket FUSE mount rejects
# several POSIX ops with EOPNOTSUPP; keep RustFS on its plainest I/O path.
# (Multipart itself is fixed by linkshim above, not by these toggles.)
ENV RUSTFS_ADDRESS=0.0.0.0:9000 \
    RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001 \
    RUSTFS_CONSOLE_ENABLE=true \
    RUSTFS_VOLUMES=/data \
    RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="*" \
    RUSTFS_OBJECT_DIRECT_IO_WRITE_ENABLE=false \
    RUSTFS_DRIVE_SYNC_ENABLE=false \
    RUSTFS_OBS_LOGGER_LEVEL=warn

EXPOSE 8080

# Start RustFS only when root credentials are provided via Space secrets,
# so the instance never runs on the well-known default credentials.
CMD ["/bin/sh", "-c", "if [ -n \"$RUSTFS_ACCESS_KEY\" ] && [ -n \"$RUSTFS_SECRET_KEY\" ]; then LD_PRELOAD=/usr/local/lib/linkshim.so rustfs /data & else echo 'RUSTFS_ACCESS_KEY / RUSTFS_SECRET_KEY not set, storage not started'; fi; exec nginx -g 'daemon off;'"]

	FROM debian:bookworm-slim

	RUN apt-get update && \
	apt-get install -y --no-install-recommends nginx curl unzip ca-certificates gcc libc6-dev && \
	rm -rf /var/lib/apt/lists/*

	# RustFS 1.0.3 binary (glibc build) from the official GitHub release,
	# verified against the release SHA256SUMS.
	RUN curl -fsSL https://github.com/rustfs/rustfs/releases/download/1.0.3/rustfs-linux-x86_64-gnu-v1.0.3.zip -o /tmp/rustfs.zip && \
	curl -fsSL https://github.com/rustfs/rustfs/releases/download/1.0.3/SHA256SUMS -o /tmp/SHA256SUMS && \
	SHA=$(grep 'rustfs-linux-x86_64-gnu-v1.0.3.zip$' /tmp/SHA256SUMS \| awk '{print $1}') && \
	echo "$SHA /tmp/rustfs.zip" \| sha256sum -c - && \
	unzip -o /tmp/rustfs.zip -d /tmp/rustfs-bin && \
	find /tmp/rustfs-bin -name rustfs -type f -exec install -m 0755 {} /usr/bin/rustfs \; && \
	rm -rf /tmp/rustfs.zip /tmp/SHA256SUMS /tmp/rustfs-bin

	COPY nginx.conf /etc/nginx/nginx.conf

	# linkshim: the HF bucket FUSE mount has no hard-link support, and RustFS
	# 1.0.3 publishes multipart part metadata via hard_link() (EOPNOTSUPP ->
	# every UploadPart fails). The shim falls back to copying on EOPNOTSUPP.
	COPY linkshim.c /usr/local/src/linkshim.c
	RUN gcc -shared -fPIC -O2 -o /usr/local/lib/linkshim.so /usr/local/src/linkshim.c -ldl && \
	apt-get purge -y gcc libc6-dev && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*

	RUN mkdir -p /data /logs

	# DIRECT_IO off and DRIVE_SYNC off: the HF bucket FUSE mount rejects
	# several POSIX ops with EOPNOTSUPP; keep RustFS on its plainest I/O path.
	# (Multipart itself is fixed by linkshim above, not by these toggles.)
	ENV RUSTFS_ADDRESS=0.0.0.0:9000 \
	RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001 \
	RUSTFS_CONSOLE_ENABLE=true \
	RUSTFS_VOLUMES=/data \
	RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="*" \
	RUSTFS_OBJECT_DIRECT_IO_WRITE_ENABLE=false \
	RUSTFS_DRIVE_SYNC_ENABLE=false \
	RUSTFS_OBS_LOGGER_LEVEL=warn

	EXPOSE 8080

	# Start RustFS only when root credentials are provided via Space secrets,
	# so the instance never runs on the well-known default credentials.
	CMD ["/bin/sh", "-c", "if [ -n \"$RUSTFS_ACCESS_KEY\" ] && [ -n \"$RUSTFS_SECRET_KEY\" ]; then LD_PRELOAD=/usr/local/lib/linkshim.so rustfs /data & else echo 'RUSTFS_ACCESS_KEY / RUSTFS_SECRET_KEY not set, storage not started'; fi; exec nginx -g 'daemon off;'"]