From c9cee34c6decd71109f4367f50eafb2bec6fd280 Mon Sep 17 00:00:00 2001 From: "@permadeath.com" Date: Thu, 3 Sep 2026 02:04:06 -0400 Subject: [PATCH] docs(build): correct two Dockerfile comments that no longer hold The header described a startup refusal keyed on a secret the workspace removed, and the COPY block claimed a dependency-caching layer the ordering does not provide. Both now say what the build actually does. Co-Authored-By: Claude Opus 5 (1M context) --- Dockerfile | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 31a5cc52..105e87a4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,9 @@ # Multi-stage build for the didbot-dev binary, which — see its module doc at # crates/didbot-serve/src/bin/didbot-dev.rs — is the same binary for a laptop -# and for this image: it refuses to start against a real zone unless it is -# handed a real secret, and picks its DNS backend from the zone rather than -# hardcoding the development one. +# and for this image: it picks its DNS backend from the zone rather than +# hardcoding the development one, and refuses `--tls acme` at startup unless +# it is given somewhere durable to keep the certificate (`--data`), a zone +# outside `.localhost`, and a `--route53-zone-id` for every zone it serves. # # Two stages so the runtime image never sees a compiler, a registry cache, or # any crate source: what ships is the binary and nothing that built it. @@ -14,8 +15,16 @@ RUN apt-get update \ && apt-get install -y --no-install-recommends pkg-config libssl-dev \ && rm -rf /var/lib/apt/lists/* -# Dependencies first, so an edit to application code does not re-fetch or -# re-build the workspace's crates.io dependencies on every image build. +# Everything the build reads, and nothing else: the manifests, the workspace +# sources, and `lexicons/`, which `didbot-lexicon` `include_str!`s at compile +# time. `.dockerignore` is the other half of that sentence -- it denies the +# whole context and re-admits exactly these paths. +# +# There is no dependency-caching layer here: `crates/` lands before the only +# `cargo build`, so any source edit re-builds the crates.io graph too. Buying +# that back means a stub-source layer built against the manifests alone, which +# is a real change and not a reordering. Every image build compiles the world +# until someone makes it. COPY Cargo.toml Cargo.lock ./ COPY crates crates COPY lexicons lexicons -- 2.51.2