mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-21 00:56:28 +08:00
Marc Schier
96 lines
3.6 KiB
Docker
96 lines
3.6 KiB
Docker
# PumpDeviceIntegrationServer container image.
|
|
#
|
|
# Multi-stage, framework-dependent build on the .NET AzureLinux 3 base
|
|
# images.
|
|
#
|
|
# IMPORTANT: the build context MUST be the repository ROOT (not this
|
|
# folder), because the project pulls in the whole source tree (src/,
|
|
# src/, tools/). Build it like this:
|
|
#
|
|
# # from the repository root:
|
|
# docker build -f samples/PumpDeviceIntegrationServer/Dockerfile \
|
|
# -t pumpdeviceintegrationserver:local .
|
|
#
|
|
# Running `docker build .` from inside this folder will fail fast with a
|
|
# helpful message (the context would be missing the rest of the repo).
|
|
#
|
|
# The final image runs as a non-root user and listens on 0.0.0.0:62542
|
|
# (override host/port via the `host` / `port` environment variables).
|
|
|
|
FROM mcr.microsoft.com/dotnet/sdk:10.0-azurelinux3.0 AS build
|
|
WORKDIR /src
|
|
|
|
# JIT is disabled for the source generators unless W^X is turned off on
|
|
# some kernels; match the existing ConsoleReferenceServer Dockerfile.
|
|
ENV DOTNET_EnableWriteXorExecute=0
|
|
|
|
# Copy the full repository. The project pulls in many transitive
|
|
# ProjectReferences, a source-generator analyzer, and AdditionalFiles
|
|
# NodeSet2 XML/CSV inputs, so a per-csproj copy list would be fragile.
|
|
COPY . .
|
|
|
|
# Fail fast with a clear message when the build context is not the
|
|
# repository root (UA.slnx is the root marker).
|
|
RUN test -f UA.slnx || { \
|
|
echo ''; \
|
|
echo 'ERROR: build the repository ROOT as the Docker context, not this folder.'; \
|
|
echo ' The image needs the full source tree (src/, src/, tools/).'; \
|
|
echo ''; \
|
|
echo ' From the repository root run:'; \
|
|
echo ' docker build -f samples/PumpDeviceIntegrationServer/Dockerfile -t pumpdeviceintegrationserver .'; \
|
|
echo ''; \
|
|
exit 1; \
|
|
}
|
|
|
|
ARG Version
|
|
ARG SimpleVersion
|
|
ARG InformationalVersion
|
|
|
|
RUN dotnet restore "samples/PumpDeviceIntegrationServer/PumpDeviceIntegrationServer.csproj" \
|
|
--force -p:NoHttps=true
|
|
|
|
RUN dotnet publish "samples/PumpDeviceIntegrationServer/PumpDeviceIntegrationServer.csproj" \
|
|
--no-restore \
|
|
-c Release \
|
|
-f net10.0 \
|
|
-p:PublishAot=false \
|
|
-p:NoHttps=true \
|
|
-p:Dockerbuild=true \
|
|
-p:Version=${Version} \
|
|
-p:AssemblyVersion=${SimpleVersion} \
|
|
-p:FileVersion=${Version} \
|
|
-p:InformationalVersion=${InformationalVersion} \
|
|
-o /app/publish
|
|
|
|
FROM mcr.microsoft.com/dotnet/runtime:10.0-azurelinux3.0 AS final
|
|
|
|
# AzureLinux forces the SymCrypt OpenSSL provider as the default for all
|
|
# EVP operations (default_properties = "?provider=symcryptprovider" in
|
|
# openssl.cnf). SymCrypt's ECDSA SignHash path rejects the self-signing
|
|
# call the OPC UA stack makes when creating its ECC application-instance
|
|
# certificate ("operation not supported for this keytype"). Clearing the
|
|
# forced default lets the standard OpenSSL default provider handle ECDSA
|
|
# (still fully secure; just not the FIPS-validated SymCrypt module).
|
|
RUN sed -i 's/^default_properties = .*/default_properties = ""/' /etc/pki/tls/openssl.cnf
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /app/publish .
|
|
|
|
# The .NET base images ship a predefined non-root user `app` (UID 1654,
|
|
# exposed via the APP_UID env var). The server creates its
|
|
# certificate/PKI store under /app at runtime, so make it writable by
|
|
# that user.
|
|
ENV HOME=/app
|
|
RUN mkdir -p /app/pki && chown -R $APP_UID:$APP_UID /app
|
|
|
|
USER $APP_UID
|
|
|
|
# Bind to all interfaces so the endpoint is reachable from outside the
|
|
# container. Override with `-e host=...` / `-e port=...`.
|
|
ENV host=0.0.0.0 \
|
|
port=62542
|
|
|
|
EXPOSE 62542
|
|
|
|
ENTRYPOINT ["dotnet", "PumpDeviceIntegrationServer.dll"]
|