feat(packers/swift): Update Dockerfile template of Vapor

internal/swift/swift.go

@@ -20,55 +20,91 @@ func NewPacker() packer.Packer {
 // GenerateDockerfile generates a Dockerfile for Swift project
 func GenerateDockerfile(_ types.PlanMeta) (string, error) {
 	// TODO: following dockerfile is copied from Vapor's template, need to be modified to support other Swift use cases
-	return `FROM swift:5.9-jammy AS build
+	return `# ================================
+# Build image
+# ================================
+FROM swift:6.0-noble AS build
 
+# Install OS updates
 RUN export DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
-  && apt-get -q update \
-  && apt-get -q dist-upgrade -y \
-  && apt-get install -y libjemalloc-dev
+    && apt-get -q update \
+    && apt-get -q dist-upgrade -y \
+    && apt-get install -y libjemalloc-dev
 
+# Set up a build area
 WORKDIR /build
 
+# First just resolve dependencies.
+# This creates a cached layer that can be reused
+# as long as your Package.swift/Package.resolved
+# files do not change.
 COPY ./Package.* ./
-RUN swift package resolve --skip-update \
-  $([ -f ./Package.resolved ] && echo "--force-resolved-versions" || true)
+RUN swift package resolve \
+        $([ -f ./Package.resolved ] && echo "--force-resolved-versions" || true)
 
+# Copy entire repo into container
 COPY . .
 
+# Build the application, with optimizations, with static linking, and using jemalloc
+# N.B.: The static version of jemalloc is incompatible with the static Swift runtime.
 RUN swift build -c release \
-  --static-swift-stdlib \
-  -Xlinker -ljemalloc
+        --product App \
+        --static-swift-stdlib \
+        -Xlinker -ljemalloc
 
+# Switch to the staging area
 WORKDIR /staging
 
+# Copy main executable to staging area
 RUN cp "$(swift build --package-path /build -c release --show-bin-path)/App" ./
 
+# Copy static swift backtracer binary to staging area
 RUN cp "/usr/libexec/swift/linux/swift-backtrace-static" ./
 
+# Copy resources bundled by SPM to staging area
 RUN find -L "$(swift build --package-path /build -c release --show-bin-path)/" -regex '.*\.resources$' -exec cp -Ra {} ./ \;
 
+# Copy any resources from the public directory and views directory if the directories exist
+# Ensure that by default, neither the directory nor any of its contents are writable.
 RUN [ -d /build/Public ] && { mv /build/Public ./Public && chmod -R a-w ./Public; } || true
 RUN [ -d /build/Resources ] && { mv /build/Resources ./Resources && chmod -R a-w ./Resources; } || true
 
-FROM ubuntu:jammy
+# ================================
+# Run image
+# ================================
+FROM ubuntu:noble
 
+# Make sure all system packages are up to date, and install only essential packages.
 RUN export DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
-  && apt-get -q update \
-  && apt-get -q dist-upgrade -y \
-  && apt-get -q install -y \
-  libjemalloc2 \
-  ca-certificates \
-  tzdata \
-  libcurl4 \
-  libxml2 \
-  && rm -r /var/lib/apt/lists/*
-
+    && apt-get -q update \
+    && apt-get -q dist-upgrade -y \
+    && apt-get -q install -y \
+      libjemalloc2 \
+      ca-certificates \
+      tzdata \
+      libcurl4 \
+      libxml2 \
+    && rm -r /var/lib/apt/lists/*
+
+# Create a vapor user and group with /app as its home directory
+RUN useradd --user-group --create-home --system --skel /dev/null --home-dir /app vapor
+
+# Switch to the new home directory
 WORKDIR /app
 
+# Copy built executable and any staged resources from builder
 COPY --from=build --chown=vapor:vapor /staging /app
 
+# Provide configuration needed by the built-in crash reporter and some sensible default behaviors.
 ENV SWIFT_BACKTRACE=enable=yes,sanitize=yes,threads=all,images=all,interactive=no,swift-backtrace=./swift-backtrace-static
 
+# Ensure all further commands run as the vapor user
+USER vapor:vapor
+
+# Let Docker bind to port 8080
+EXPOSE 8080
+
+# Start the Vapor service when the image is run, default to listening on 8080 in production environment
 ENTRYPOINT ["./App"]
 CMD ["serve", "--env", "production", "--hostname", "0.0.0.0", "--port", "8080"]
 `, nil