snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

.docker/Dockerfile-alpine

@@ -0,0 +1,35 @@
+FROM alpine:3.20.0
+
+# Because this image supports SQLite, we create /home/ory and /home/ory/sqlite which is owned by the ory user
+# and declare /home/ory/sqlite a volume.
+#
+# To get SQLite and Docker Volumes working with this image, mount the volume where SQLite should be written to at:
+#
+#   /home/ory/sqlite/some-file.
+
+RUN addgroup -S ory; \
+    adduser -S ory -G ory -D -u 10000 -h /home/ory -s /bin/nologin; \
+    chown -R ory:ory /home/ory
+RUN apk --update upgrade && apk --no-cache --update-cache --upgrade --latest add ca-certificates
+
+WORKDIR /home/ory
+
+COPY kratos /usr/bin/kratos
+
+# By creating the sqlite folder as the ory user, the mounted volume will be owned by ory:ory, which
+# is required for read/write of SQLite.
+RUN mkdir -p /var/lib/sqlite
+RUN chown ory:ory /var/lib/sqlite
+VOLUME /var/lib/sqlite
+
+# Exposing the ory home directory to simplify passing in Kratos configuration (e.g. if the file $HOME/.kratos.yaml
+# exists, it will be automatically used as the configuration file).
+VOLUME /home/ory
+
+# Declare the standard ports used by Kratos (4433 for public service endpoint, 4434 for admin service endpoint)
+EXPOSE 4433 4434
+
+USER 10000
+
+ENTRYPOINT ["kratos"]
+CMD ["serve"]

.docker/Dockerfile-build

@@ -0,0 +1,46 @@
+FROM golang:1.26-trixie AS builder
+
+RUN apt-get update && apt-get upgrade -y &&\
+  mkdir -p /var/lib/sqlite
+
+WORKDIR /go/src/github.com/ory/kratos
+
+COPY oryx/go.mod oryx/go.mod
+COPY oryx/go.sum oryx/go.sum
+                
+
+COPY go.mod go.mod
+COPY go.sum go.sum
+COPY pkg/client-go/go.* pkg/client-go/
+
+ENV CGO_ENABLED 0
+
+RUN go mod download
+
+COPY . .
+
+ARG VERSION
+ARG COMMIT
+ARG BUILD_DATE
+
+RUN --mount=type=cache,target=/root/.cache/go-build go build \
+  -ldflags="-X 'github.com/ory/kratos/driver/config.Version=${VERSION}' -X 'github.com/ory/kratos/driver/config.Date=${BUILD_DATE}' -X 'github.com/ory/kratos/driver/config.Commit=${COMMIT}'" \
+  -o /usr/bin/kratos
+
+#########################
+# Kratos is built with CGO_ENABLED=0, so it needs no glibc at runtime. The static
+# base carries none, which keeps this image free of the unfixable libc6
+# advisories the base-nossl variant ships with, and matches the base the released
+# images use (.docker/Dockerfile-distroless-static).
+FROM gcr.io/distroless/static-debian12:nonroot AS runner
+
+COPY --from=builder --chown=nonroot:nonroot /var/lib/sqlite /var/lib/sqlite
+COPY --from=builder --chown=nonroot:nonroot /usr/bin/kratos /usr/bin/kratos
+
+VOLUME /var/lib/sqlite
+
+# Declare the standard ports used by Kratos (4433 for public service endpoint, 4434 for admin service endpoint)
+EXPOSE 4433 4434
+
+ENTRYPOINT ["kratos"]
+CMD ["serve"]

.docker/Dockerfile-debug

@@ -0,0 +1,18 @@
+FROM golang:1.26-trixie
+ENV CGO_ENABLED 0
+
+RUN apt-get update && apt-get install -y --no-install-recommends inotify-tools psmisc
+RUN go install github.com/go-delve/delve/cmd/dlv@latest
+
+COPY script/debug-entrypoint.sh /entrypoint.sh
+
+VOLUME /dockerdev
+
+WORKDIR /dockerdev
+
+ENV DELVE_PORT 40000
+ENV SERVICE_NAME service
+
+EXPOSE 8000 $DELVE_PORT
+
+ENTRYPOINT ["/entrypoint.sh"]

.docker/Dockerfile-distroless-static

@@ -0,0 +1,7 @@
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY kratos /usr/bin/kratos
+EXPOSE 4433 4434
+
+ENTRYPOINT ["kratos"]
+CMD ["serve"]

.docker/docker-compose.template.dbg

@@ -0,0 +1,17 @@
+version: '3.7'
+
+services:
+  ${SERVICE_NAME}:
+    build:
+      dockerfile: ./.docker/Dockerfile-debug
+    ports:
+      - ${REMOTE_DEBUGGING_PORT}:40000
+    security_opt:
+      - apparmor=unconfined
+    cap_add:
+      - SYS_PTRACE
+    volumes:
+      - type: bind
+        source: ${SERVICE_ROOT}
+        target: /dockerdev
+        read_only: false