2024-05-28 20:29:09 -04:00
|
|
|
ARG SYNAPSE_VERSION=1.108.0
|
2024-05-28 04:27:21 -04:00
|
|
|
ARG PYTHON_VERSION=3.12
|
2024-06-01 02:01:18 -04:00
|
|
|
ARG HARDENED_MALLOC_VERSION=2024053100
|
2021-06-02 13:07:35 -04:00
|
|
|
ARG UID=991
|
|
|
|
ARG GID=991
|
|
|
|
|
|
|
|
|
|
|
|
### Build Hardened Malloc
|
2024-05-28 04:49:09 -04:00
|
|
|
FROM alpine:latest as hmalloc-builder
|
2021-06-02 13:07:35 -04:00
|
|
|
|
|
|
|
ARG HARDENED_MALLOC_VERSION
|
|
|
|
ARG CONFIG_NATIVE=false
|
2022-12-04 17:09:15 -05:00
|
|
|
ARG VARIANT=default
|
2021-06-02 13:07:35 -04:00
|
|
|
|
2023-03-10 09:51:23 -05:00
|
|
|
RUN apk -U upgrade \
|
2024-05-28 04:27:21 -04:00
|
|
|
&& apk --no-cache add build-base git gnupg openssh-keygen
|
|
|
|
|
|
|
|
RUN cd /tmp \
|
|
|
|
&& git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
|
|
|
|
&& cd hardened_malloc \
|
|
|
|
&& wget -q https://grapheneos.org/allowed_signers -O grapheneos_allowed_signers \
|
|
|
|
&& git config gpg.ssh.allowedSignersFile grapheneos_allowed_signers \
|
|
|
|
&& git verify-tag $(git describe --tags) \
|
|
|
|
&& make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}
|
2021-06-02 13:07:35 -04:00
|
|
|
|
|
|
|
|
|
|
|
### Build Synapse
|
2024-05-28 04:49:09 -04:00
|
|
|
FROM python:${PYTHON_VERSION}-alpine as synapse-builder
|
2021-06-02 13:07:35 -04:00
|
|
|
|
|
|
|
ARG SYNAPSE_VERSION
|
|
|
|
|
|
|
|
RUN apk -U upgrade \
|
2024-05-28 04:27:21 -04:00
|
|
|
&& apk --no-cache add -t build-deps build-base libffi-dev libjpeg-turbo-dev libxslt-dev linux-headers openssl-dev postgresql-dev rustup zlib-dev
|
|
|
|
|
|
|
|
RUN rustup-init -y && source $HOME/.cargo/env \
|
|
|
|
&& pip install --upgrade pip \
|
|
|
|
&& pip install --prefix="/install" --no-warn-script-location \
|
|
|
|
matrix-synapse[all]==${SYNAPSE_VERSION}
|
2021-06-02 13:07:35 -04:00
|
|
|
|
|
|
|
|
2024-05-28 04:42:38 -04:00
|
|
|
### Get RootFS Files
|
|
|
|
FROM alpine:latest as rootfs
|
|
|
|
|
|
|
|
ARG SYNAPSE_VERSION
|
|
|
|
|
|
|
|
RUN apk -U upgrade \
|
|
|
|
&& apk --no-cache add git
|
|
|
|
|
|
|
|
RUN cd /tmp \
|
|
|
|
&& git clone --depth 1 --branch v${SYNAPSE_VERSION} https://github.com/element-hq/synapse
|
|
|
|
|
|
|
|
|
2021-06-02 13:07:35 -04:00
|
|
|
### Build Production
|
|
|
|
|
2023-10-10 14:39:58 -04:00
|
|
|
FROM python:${PYTHON_VERSION}-alpine
|
2021-06-02 13:07:35 -04:00
|
|
|
|
2023-03-16 19:06:02 -04:00
|
|
|
LABEL maintainer="Thien Tran contact@tommytran.io"
|
|
|
|
|
2021-06-02 13:07:35 -04:00
|
|
|
ARG UID
|
|
|
|
ARG GID
|
|
|
|
|
|
|
|
RUN apk -U upgrade \
|
2024-05-28 04:27:21 -04:00
|
|
|
&& apk --no-cache add -t run-deps libffi libgcc libjpeg-turbo libstdc++ libxslt libpq openssl zlib tzdata xmlsec git curl icu-libs \
|
|
|
|
&& rm -rf /var/cache/apk/*
|
|
|
|
|
|
|
|
RUN adduser -g ${GID} -u ${UID} --disabled-password --gecos "" synapse
|
2021-06-02 13:07:35 -04:00
|
|
|
|
2022-12-04 17:09:15 -05:00
|
|
|
RUN pip install --upgrade pip \
|
2024-05-28 04:27:21 -04:00
|
|
|
&& pip install -e "git+https://github.com/matrix-org/mjolnir.git#egg=mjolnir&subdirectory=synapse_antispam"
|
2021-06-02 13:07:35 -04:00
|
|
|
|
2024-05-28 04:49:09 -04:00
|
|
|
COPY --from=hmalloc-builder /tmp/hardened_malloc/out/libhardened_malloc.so /usr/local/lib/
|
|
|
|
COPY --from=synapse-builder /install /usr/local
|
2024-05-28 04:44:39 -04:00
|
|
|
COPY --from=rootfs --chown=synapse:synapse /tmp/synapse/docker/start.py /start.py
|
|
|
|
COPY --from=rootfs --chown=synapse:synapse /tmp/synapse/docker/conf /conf
|
2021-06-02 13:07:35 -04:00
|
|
|
|
2022-12-04 17:09:15 -05:00
|
|
|
ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
|
2021-06-02 13:07:35 -04:00
|
|
|
|
|
|
|
USER synapse
|
|
|
|
|
|
|
|
VOLUME /data
|
|
|
|
|
|
|
|
EXPOSE 8008/tcp 8009/tcp 8448/tcp
|
|
|
|
|
2021-06-03 12:21:20 -04:00
|
|
|
ENTRYPOINT ["python3", "start.py"]
|
2022-09-07 19:36:18 -04:00
|
|
|
|
|
|
|
HEALTHCHECK --start-period=5s --interval=15s --timeout=5s \
|
2023-02-04 05:13:05 -05:00
|
|
|
CMD curl -fSs http://localhost:8008/health || exit 1
|