snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

.docker/Dockerfile-build

@@ -0,0 +1,46 @@
+FROM golang:1.26-trixie AS builder
+
+RUN apt-get update && apt-get upgrade -y &&\
+  mkdir -p /var/lib/sqlite
+
+WORKDIR /go/src/github.com/ory/kratos
+
+COPY oryx/go.mod oryx/go.mod
+COPY oryx/go.sum oryx/go.sum
+                
+
+COPY go.mod go.mod
+COPY go.sum go.sum
+COPY pkg/client-go/go.* pkg/client-go/
+
+ENV CGO_ENABLED 0
+
+RUN go mod download
+
+COPY . .
+
+ARG VERSION
+ARG COMMIT
+ARG BUILD_DATE
+
+RUN --mount=type=cache,target=/root/.cache/go-build go build \
+  -ldflags="-X 'github.com/ory/kratos/driver/config.Version=${VERSION}' -X 'github.com/ory/kratos/driver/config.Date=${BUILD_DATE}' -X 'github.com/ory/kratos/driver/config.Commit=${COMMIT}'" \
+  -o /usr/bin/kratos
+
+#########################
+# Kratos is built with CGO_ENABLED=0, so it needs no glibc at runtime. The static
+# base carries none, which keeps this image free of the unfixable libc6
+# advisories the base-nossl variant ships with, and matches the base the released
+# images use (.docker/Dockerfile-distroless-static).
+FROM gcr.io/distroless/static-debian12:nonroot AS runner
+
+COPY --from=builder --chown=nonroot:nonroot /var/lib/sqlite /var/lib/sqlite
+COPY --from=builder --chown=nonroot:nonroot /usr/bin/kratos /usr/bin/kratos
+
+VOLUME /var/lib/sqlite
+
+# Declare the standard ports used by Kratos (4433 for public service endpoint, 4434 for admin service endpoint)
+EXPOSE 4433 4434
+
+ENTRYPOINT ["kratos"]
+CMD ["serve"]