Git backed by object storage because you can't stop me
git
object-storage
kefka
build(docker): add Dockerfile and .dockerignore
Multi-stage build using golang:1.26 for compilation and
distroless/static-debian12:nonroot for runtime. The build stage
uses BuildKit caches for modules and build artifacts. The runtime
image includes only CA certs and tzdata, runs as nonroot, and
exposes ports 8080 (Smart HTTP), 9418 (git://), and 9090 (metrics).
Static stripped binary compiled with CGO_ENABLED=0 since objgitd
is pure Go and answers the git protocol natively without a git
binary dependency.
.dockerignore excludes the 600MB var/ Go SDK tree, .git, docs,
and other non-essential files to keep the build context lean.
Assisted-by: Claude Opus 4.8 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>
+40
+9
.dockerignore
+9
.dockerignore
+31
Dockerfile
+31
Dockerfile
···
1
+
# syntax=docker/dockerfile:1
2
+
3
+
# --- build stage -------------------------------------------------------------
4
+
FROM golang:1.26 AS build
5
+
6
+
WORKDIR /src
7
+
8
+
# Cache module downloads separately from the source tree.
9
+
COPY go.mod go.sum ./
10
+
RUN --mount=type=cache,target=/go/pkg/mod \
11
+
go mod download
12
+
13
+
COPY . .
14
+
15
+
# Static, stripped binary. No cgo: objgitd is pure Go and answers the git
16
+
# protocol natively (no `git` binary at runtime).
17
+
RUN --mount=type=cache,target=/go/pkg/mod \
18
+
--mount=type=cache,target=/root/.cache/go-build \
19
+
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
20
+
-o /objgitd ./cmd/objgitd
21
+
22
+
# --- runtime stage -----------------------------------------------------------
23
+
# distroless static: just CA certs (for Tigris/S3 TLS) + tzdata, nonroot user.
24
+
FROM gcr.io/distroless/static-debian12:nonroot
25
+
26
+
COPY --from=build /objgitd /objgitd
27
+
28
+
# Smart HTTP, git://, metrics. SSH (-ssh-bind) is opt-in; publish it yourself.
29
+
EXPOSE 8080 9418 9090
30
+
31
+
ENTRYPOINT ["/objgitd"]