snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

.docker/Dockerfile

@@ -0,0 +1,22 @@
+FROM alpine:3.21.3
+
+RUN addgroup -S ory; \
+    adduser -S ory -G ory -D  -h /home/ory -s /bin/nologin; \
+    chown -R ory:ory /home/ory
+
+RUN apk --no-cache --latest upgrade
+RUN apk --no-cache --upgrade --latest add ca-certificates
+
+COPY keto /usr/bin/keto
+
+# Exposing the ory home directory to simplify passing in keto configuration (e.g. if the file $HOME/keto.yaml
+# exists, it will be automatically used as the configuration file).
+VOLUME /home/ory
+
+# Declare the standard ports used by keto (4433 for read service endpoint, 4434 for write service endpoint)
+EXPOSE 4433 4434
+
+USER ory
+
+ENTRYPOINT ["keto"]
+CMD ["serve"]

.docker/Dockerfile-alpine

@@ -0,0 +1,14 @@
+FROM alpine:3.21.3
+
+RUN addgroup -S ory; \
+    adduser -S ory -G ory -D -H -s /bin/nologin
+
+RUN apk --no-cache --latest upgrade &&\
+    apk --no-cache --upgrade --latest add ca-certificates
+
+COPY keto /usr/bin/keto
+
+USER ory
+
+ENTRYPOINT ["keto"]
+CMD ["serve"]

.docker/Dockerfile-build

@@ -0,0 +1,38 @@
+# Workaround for https://github.com/GoogleContainerTools/distroless/issues/1342
+FROM golang:1.26-trixie AS builder
+
+WORKDIR /go/src/github.com/ory/keto
+
+RUN apt-get update && apt-get upgrade -y &&\
+    mkdir -p /var/lib/sqlite &&\
+    mkdir -p ./internal/httpclient
+
+COPY go.mod go.mod
+COPY go.sum go.sum
+
+COPY proto/go.mod proto/go.mod
+COPY proto/go.sum proto/go.sum
+COPY oryx/go.mod oryx/go.mod
+COPY oryx/go.sum oryx/go.sum
+
+ENV CGO_ENABLED=1
+
+RUN go mod download
+
+COPY . .
+
+RUN go build -buildvcs=false  -o /usr/bin/keto .
+
+#########################
+
+FROM gcr.io/distroless/base-nossl-debian12:nonroot AS runner
+
+COPY --from=builder --chown=nonroot:nonroot /var/lib/sqlite /var/lib/sqlite
+COPY --from=builder /usr/bin/keto /usr/bin/keto
+
+VOLUME /var/lib/sqlite
+
+EXPOSE 4466 4467
+
+ENTRYPOINT ["keto"]
+CMD ["serve"]

.docker/Dockerfile-distroless-static

@@ -0,0 +1,7 @@
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY keto /usr/bin/keto
+EXPOSE 4466 4467
+
+ENTRYPOINT ["keto"]
+CMD ["serve"]

.docker/Dockerfile-sqlite

@@ -0,0 +1,37 @@
+FROM alpine:3.21.3
+
+# Because this image is built for SQLite, we create /home/ory and /home/ory/sqlite which is owned by the ory user
+# and declare /home/ory/sqlite a volume.
+#
+# To get SQLite and Docker Volumes working with this image, mount the volume where SQLite should be written to at:
+#
+#   /home/ory/sqlite/some-file.
+
+RUN addgroup -S ory; \
+    adduser -S ory -G ory -D  -h /home/ory -s /bin/nologin; \
+    chown -R ory:ory /home/ory
+
+RUN apk --no-cache --latest upgrade &&\
+    apk --no-cache --upgrade --latest add ca-certificates
+
+WORKDIR /home/ory
+
+COPY keto /usr/bin/keto
+
+# By creating the sqlite folder as the ory user, the mounted volume will be owned by ory:ory, which
+# is required for read/write of SQLite.
+RUN mkdir -p /var/lib/sqlite
+RUN chown ory:ory /var/lib/sqlite
+VOLUME /var/lib/sqlite
+
+# Exposing the ory home directory to simplify passing in keto configuration (e.g. if the file $HOME/.keto.yaml
+# exists, it will be automatically used as the configuration file).
+VOLUME /home/ory
+
+# Declare the standard ports used by keto (4433 for read service endpoint, 4434 for write service endpoint)
+EXPOSE 4433 4434
+
+USER ory
+
+ENTRYPOINT ["keto"]
+CMD ["serve"]