chore: switch to distroless Docker runtime images

fix: match Debian releases for build

closes #297

Co-authored-by: MaticPoh <85814976+MaticPoh@users.noreply.github.com>

Cargo.lock

@@ -4614,7 +4614,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-files"
-version = "0.1.1"
+version = "0.7.16"
 dependencies = [
  "aes-gcm 0.10.3",
  "aws-config",

Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM --platform="${BUILDPLATFORM}" rust:1.70.0-slim
+FROM --platform="${BUILDPLATFORM}" rust:1.80.1-slim-bookworm
 USER 0:0
 WORKDIR /home/rust/src
 
@@ -17,14 +17,17 @@ RUN sh /tmp/build-image-layer.sh tools
 
 # Build all dependencies
 COPY Cargo.toml Cargo.lock ./
+COPY crates/bindings/node/Cargo.toml ./crates/bindings/node/
 COPY crates/bonfire/Cargo.toml ./crates/bonfire/
 COPY crates/delta/Cargo.toml ./crates/delta/
 COPY crates/core/config/Cargo.toml ./crates/core/config/
 COPY crates/core/database/Cargo.toml ./crates/core/database/
+COPY crates/core/files/Cargo.toml ./crates/core/files/
 COPY crates/core/models/Cargo.toml ./crates/core/models/
 COPY crates/core/permissions/Cargo.toml ./crates/core/permissions/
 COPY crates/core/presence/Cargo.toml ./crates/core/presence/
 COPY crates/core/result/Cargo.toml ./crates/core/result/
+COPY crates/services/autumn/Cargo.toml ./crates/services/autumn/
 RUN sh /tmp/build-image-layer.sh deps
 
 # Build all apps

Dockerfile.useCurrentArch

@@ -1,5 +1,5 @@
 # Build Stage
-FROM rust:1.70.0-slim
+FROM rust:1.80.1-slim-bookworm
 USER 0:0
 WORKDIR /home/rust/src
 
@@ -13,14 +13,17 @@ COPY scripts/build-image-layer.sh /tmp/
 
 # Build all dependencies
 COPY Cargo.toml Cargo.lock ./
+COPY crates/bindings/node/Cargo.toml ./crates/bindings/node/
 COPY crates/bonfire/Cargo.toml ./crates/bonfire/
 COPY crates/delta/Cargo.toml ./crates/delta/
 COPY crates/core/config/Cargo.toml ./crates/core/config/
 COPY crates/core/database/Cargo.toml ./crates/core/database/
+COPY crates/core/files/Cargo.toml ./crates/core/files/
 COPY crates/core/models/Cargo.toml ./crates/core/models/
 COPY crates/core/permissions/Cargo.toml ./crates/core/permissions/
 COPY crates/core/presence/Cargo.toml ./crates/core/presence/
 COPY crates/core/result/Cargo.toml ./crates/core/result/
+COPY crates/services/autumn/Cargo.toml ./crates/services/autumn/
 RUN sh /tmp/build-image-layer.sh deps
 
 # Build all apps

crates/bonfire/Dockerfile

@@ -2,10 +2,9 @@
 FROM ghcr.io/revoltchat/base:latest AS builder
 
 # Bundle Stage
-FROM debian:bullseye-slim
-RUN apt-get update && \
-    apt-get install -y ca-certificates && \
-    apt-get clean
+FROM gcr.io/distroless/cc-debian12:nonroot
 COPY --from=builder /home/rust/src/target/release/revolt-bonfire ./
+
 EXPOSE 9000
+USER nonroot
 CMD ["./revolt-bonfire"]

crates/core/config/src/lib.rs

@@ -25,6 +25,8 @@ static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
             ));
         } else if std::path::Path::new("Revolt.toml").exists() {
             builder = builder.add_source(File::new("Revolt.toml", FileFormat::Toml));
+        } else if std::path::Path::new("/Revolt.toml").exists() {
+            builder = builder.add_source(File::new("/Revolt.toml", FileFormat::Toml));
         }
 
         builder.build().unwrap()

crates/core/files/Cargo.toml

@@ -1,7 +1,10 @@
 [package]
 name = "revolt-files"
-version = "0.1.1"
+version = "0.7.16"
 edition = "2021"
+license = "AGPL-3.0-or-later"
+authors = ["Paul Makles <me@insrt.uk>"]
+description = "Revolt Backend: S3 and encryption subroutines"
 
 [dependencies]
 aes-gcm = "0.10.3"

crates/delta/Dockerfile

@@ -2,13 +2,11 @@
 FROM ghcr.io/revoltchat/base:latest AS builder
 
 # Bundle Stage
-FROM debian:bullseye-slim
-RUN apt-get update && \
-    apt-get install -y ca-certificates && \
-    apt-get clean
+FROM gcr.io/distroless/cc-debian12:nonroot
 COPY --from=builder /home/rust/src/target/release/revolt-delta ./
 
 EXPOSE 8000
 ENV ROCKET_ADDRESS 0.0.0.0
 ENV ROCKET_PORT 8000
+USER nonroot
 CMD ["./revolt-delta"]

justfile

@@ -1,6 +1,7 @@
 publish:
     cargo publish --package revolt-config
     cargo publish --package revolt-result
+    cargo publish --package revolt-files
     cargo publish --package revolt-permissions
     cargo publish --package revolt-models
     cargo publish --package revolt-presence

scripts/build-image-layer.sh

@@ -22,20 +22,26 @@ tools() {
 
 deps() {
   mkdir -p \
+    crates/bindings/node/src \
     crates/bonfire/src \
     crates/delta/src \
     crates/core/config/src \
     crates/core/database/src \
+    crates/core/files/src \
     crates/core/models/src \
     crates/core/permissions/src \
     crates/core/presence/src \
-    crates/core/result/src
+    crates/core/result/src \
+    crates/services/autumn/src
   echo 'fn main() { panic!("stub"); }' |
     tee crates/bonfire/src/main.rs |
-    tee crates/delta/src/main.rs
+    tee crates/delta/src/main.rs |
+    tee crates/services/autumn/src/main.rs
   echo '' |
+    tee crates/bindings/node/src/lib.rs |
     tee crates/core/config/src/lib.rs |
     tee crates/core/database/src/lib.rs |
+    tee crates/core/files/src/lib.rs |
     tee crates/core/models/src/lib.rs |
     tee crates/core/permissions/src/lib.rs |
     tee crates/core/presence/src/lib.rs |