Dockerfile

# Project:   dfe-transform-vector
# File:      Dockerfile
# Purpose:   production container image
#
# License:   BUSL-1.1
# Copyright: (c) 2026 HYPERI PTY LIMITED
#
# AUTOGENERATED -- do not edit by hand.
# Generated by scalo::deployment::generate_dockerfile()
# Schema version: 4
# Source contract: dfe-transform-vector::deployment::contract()
# Regenerate by calling scalo::deployment::generate_dockerfile() on that contract.

FROM debian:trixie-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad

LABEL io.hyperi.profile="production"

# Runtime shared libraries for dynamically-linked Rust crates.
# Apt versions are unpinned because Debian drops superseded ones, so the digest-pinned base is what fixes the release.
# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && apt-get update && apt-get install -y --no-install-recommends \
       curl \
    && rm -rf /var/lib/apt/lists/*

COPY dfe-transform-vector /usr/local/bin/dfe-transform-vector
RUN chmod +x /usr/local/bin/dfe-transform-vector

# A base image may ship its own user at UID 1000 (Ubuntu's `ubuntu`), so remove it first.
RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi && useradd --create-home --uid 1000 appuser
RUN mkdir -p '/var/lib/vector' '/var/run/vector' '/var/spool/scalo/dlq' && chown 1000:1000 '/var/lib/vector' '/var/run/vector' '/var/spool/scalo/dlq'
WORKDIR /home/appuser
# Vector binary -- downloaded inside the build for portability. Multi-arch via
# $TARGETARCH. Bump the version deliberately: Vector's CLI flags and config
# schema can shift between minor releases.
#
# Vector is MPL-2.0, so redistributing this binary carries two obligations --
# ship the licence text, and tell recipients where the source is. Both are
# discharged from the release archive's own LICENSE / NOTICE / licenses tree
# rather than a separate download, so the attribution always matches the exact
# binary shipped.
#
# This fragment is spliced into the generated Dockerfile by
# `src/deployment.rs::emit_dockerfile()`, which substitutes 0.61.0,
# 84a27c3ad6b772fdb05bb76ea01a31498bfc8f5e71f32cc78a0d96841f1aa827 and 4f6e3093c0963611c8e31478137adca07920e729bdcc734d4ba7ab6f948a7e9f.
# It lives in its own file rather than inside a Rust string so that hadolint
# and shellcheck can actually read it -- shell embedded in `format!` is
# validated by nothing until the image build runs in CI.
ARG VECTOR_VERSION=0.61.0
# Pinned from Vector's own published SHA256SUMS for this version, cross-checked
# against the GitHub release asset of the same name -- not fetched at build
# time, which would only prove the download matches itself.
ARG VECTOR_SHA256_AMD64=84a27c3ad6b772fdb05bb76ea01a31498bfc8f5e71f32cc78a0d96841f1aa827
ARG VECTOR_SHA256_ARM64=4f6e3093c0963611c8e31478137adca07920e729bdcc734d4ba7ab6f948a7e9f
ARG TARGETARCH
# hadolint ignore=DL4006
RUN set -eu \
    && case "${TARGETARCH:-amd64}" in \
        amd64) ARCH=x86_64; VECTOR_SHA256="${VECTOR_SHA256_AMD64}" ;; \
        arm64) ARCH=aarch64; VECTOR_SHA256="${VECTOR_SHA256_ARM64}" ;; \
        *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
    esac \
    && VDIR="/tmp/vector-${ARCH}-unknown-linux-gnu" \
    && curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v${VECTOR_VERSION}/vector-${VECTOR_VERSION}-${ARCH}-unknown-linux-gnu.tar.gz" \
        -o /tmp/vector.tar.gz \
    && echo "${VECTOR_SHA256}  /tmp/vector.tar.gz" | sha256sum -c - \
    && tar xz -C /tmp -f /tmp/vector.tar.gz \
    && mv "${VDIR}/bin/vector" /usr/local/bin/vector \
    && chmod +x /usr/local/bin/vector \
    && mkdir -p /usr/share/doc/vector \
    && cp -a "${VDIR}/LICENSE" "${VDIR}/NOTICE" "${VDIR}/LICENSE-3rdparty.csv" \
        "${VDIR}/licenses" /usr/share/doc/vector/ \
    && printf '%s\n' \
        'Vector is redistributed here unmodified, under the Mozilla Public' \
        'License 2.0. Version: 0.61.0' \
        '' \
        'Source code for this version (MPL-2.0 section 3.2(a)):' \
        '  https://github.com/vectordotdev/vector/releases/tag/v0.61.0' \
        '' \
        'Upstream LICENSE, NOTICE and third-party attributions are in this' \
        'directory, taken from the release archive itself.' \
        > /usr/share/doc/vector/README.hyperi \
    && rm -rf /tmp/vector.tar.gz "${VDIR}" \
    && /usr/local/bin/vector --version

# Vector data and config directories
RUN mkdir -p /var/lib/vector /var/run/vector/config /etc/dfe-transform-vector/transforms \
    && chown -R appuser:appuser /var/lib/vector /var/run/vector /etc/dfe-transform-vector

LABEL io.hyperi.vector.version="0.61.0"

# Numeric, so Kubernetes runAsNonRoot can verify it without reading /etc/passwd.
USER 1000

EXPOSE 9090
# Conditional listeners, not EXPOSEd -- publish explicitly when enabled:
#   6000/tcp push -- when config.source.transport is one of "direct", "grpc"

# bash builtins only, so the image needs no HTTP client. A status other than 200 exits 1.
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD ["bash", "-c", "exec 3<>/dev/tcp/localhost/9090 && printf 'GET /livez HTTP/1.0\\r\\n\\r\\n' >&3 && read -r _ code _ <&3 && [ \"$code\" = 200 ]"]

ENTRYPOINT ["dfe-transform-vector"]
CMD ["--config", "/etc/dfe-transform-vector/config.yaml"]