diff options
| author | mo khan <mo@mokhan.ca> | 2025-07-15 16:37:08 -0600 |
|---|---|---|
| committer | mo khan <mo@mokhan.ca> | 2025-07-17 16:30:22 -0600 |
| commit | 45df4d0d9b577fecee798d672695fe24ff57fb1b (patch) | |
| tree | 1b99bf645035b58e0d6db08c7a83521f41f7a75b /Dockerfile | |
| parent | f94f79608393d4ab127db63cc41668445ef6b243 (diff) | |
feat: migrate from Cedar to SpiceDB authorization system
This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.
Key changes:
- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization
This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.
Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.
Diffstat (limited to 'Dockerfile')
| -rw-r--r-- | Dockerfile | 10 |
1 files changed, 4 insertions, 6 deletions
@@ -1,11 +1,9 @@ # syntax=docker/dockerfile:1 -# Build stage for authzd -FROM rust:alpine AS authzd-builder -RUN apk add --no-cache musl-dev openssl-dev openssl-libs-static pkgconfig +FROM golang:1.24 AS authzd-builder +ENV CGO_ENABLED=0 WORKDIR /app COPY . ./ -RUN cargo build --bins --release --target x86_64-unknown-linux-musl --offline -RUN strip /app/target/x86_64-unknown-linux-musl/release/authzd +RUN go build -o /bin/authzd ./cmd/authzd/main.go # Build stage for getting Envoy binary FROM envoyproxy/envoy:v1.34-latest AS envoy-binary @@ -30,7 +28,7 @@ WORKDIR / COPY --from=authzd-builder /app/Procfile /Procfile COPY --from=authzd-builder /app/etc/authzd /etc/authzd COPY --from=authzd-builder /app/etc/envoy /etc/envoy -COPY --from=authzd-builder /app/target/x86_64-unknown-linux-musl/release/authzd /bin/authzd +COPY --from=authzd-builder /bin/authzd /bin/authzd COPY --from=envoy-binary /usr/local/bin/envoy /bin/envoy COPY --from=minit-builder /go/bin/minit /bin/minit COPY --from=dumb-init-builder /usr/bin/dumb-init /usr/bin/dumb-init |