mirror of
https://github.com/anthropics/claude-code.git
synced 2026-07-31 01:33:28 +00:00
843297f6b1
Reference artifacts accompanying the Gateway-on-AWS walkthrough (https://code.claude.com/docs/en/claude-apps-gateway-on-aws), sibling to the existing examples/gateway/gcp assets: - setup.sh: scripts the walkthrough end to end via the aws CLI (security groups, IAM roles, ECR image build/push with gateway.yaml baked in, private-subnet RDS for PostgreSQL, Secrets Manager secrets, ECS Fargate service behind an internal ALB) - Dockerfile: distroless runtime image for the gateway; the Claude Code release binary is verified against an operator-supplied sha256 - gateway.yaml.example: config template (Bedrock upstream, Okta IdP) - terraform/: module provisioning the same architecture (ECS track) Provided as a working example to adapt, not a supported production deployment.
68 lines
3.1 KiB
Docker
68 lines
3.1 KiB
Docker
# Runtime image for `claude gateway`.
|
|
#
|
|
# This image does NOT build the binary. It expects a prebuilt native
|
|
# linux-x64 `claude` executable in the build context — the Claude Code release
|
|
# binary, which includes the `gateway` subcommand. setup.sh places it at
|
|
# ./claude (downloading and checksum-verifying it via DIST_URL/DIST_SHA256 if
|
|
# missing). Override CLAUDE_BINARY to point at a different path.
|
|
#
|
|
# Unlike the GCP example (which mounts the config from Secret Manager at
|
|
# runtime), this image BAKES gateway.yaml in at /etc/claude/gateway.yaml — on
|
|
# ECS the task definition injects only the secrets the YAML references, as env
|
|
# vars. gateway.yaml therefore must be fully filled in (no REPLACE_ME) before
|
|
# building; setup.sh enforces this. A config edit means a rebuild under a new
|
|
# tag. The file contains no secret values — every credential resolves at boot
|
|
# via ${ENV_VAR} expansion.
|
|
#
|
|
# The image also bakes in the AWS RDS CA bundle (rds-global-bundle.pem —
|
|
# setup.sh downloads it from https://truststore.pki.rds.amazonaws.com before
|
|
# the build) and trusts it via NODE_EXTRA_CA_CERTS, so the store connection
|
|
# string's `?sslmode=verify-full` verifies the RDS server certificate chain
|
|
# and hostname. NOTE the gateway's driver reads `sslmode` from the URL but NOT
|
|
# a libpq-style `sslrootcert=` param — the CA must come from this env var.
|
|
#
|
|
# Build:
|
|
# docker build --platform=linux/amd64 --provenance=false \
|
|
# --build-arg CLAUDE_BINARY=./claude -t claude-gateway .
|
|
#
|
|
# (For Fargate on ARM64/Graviton: build --platform=linux/arm64 with the
|
|
# linux-arm64 binary and set the task definition's cpuArchitecture to ARM64.)
|
|
#
|
|
# Run:
|
|
# docker run --rm -p 8080:8080 \
|
|
# -e OIDC_CLIENT_SECRET -e GATEWAY_JWT_SECRET -e GATEWAY_POSTGRES_URL \
|
|
# claude-gateway
|
|
|
|
ARG CLAUDE_BINARY=./claude
|
|
ARG GATEWAY_CONFIG=./gateway.yaml
|
|
ARG RDS_CA_BUNDLE=./rds-global-bundle.pem
|
|
|
|
# distroless/cc provides glibc + libstdc++ (required by the Bun-compiled
|
|
# native binary). The :nonroot tag runs as uid/gid 65532. Pinned by digest so
|
|
# the build never silently takes new upstream bytes (the digest is the
|
|
# multi-arch OCI index, so --platform still selects amd64/arm64). To refresh
|
|
# the pin after reviewing upstream changes:
|
|
# docker manifest inspect -v gcr.io/distroless/cc-debian12:nonroot # prints the index digest
|
|
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151
|
|
|
|
ARG CLAUDE_BINARY
|
|
ARG GATEWAY_CONFIG
|
|
ARG RDS_CA_BUNDLE
|
|
COPY --chmod=0755 ${CLAUDE_BINARY} /usr/local/bin/claude
|
|
# WORKDIR pre-creates /etc/claude with 0755 — without it, COPY --chmod would
|
|
# also stamp the auto-created parent directory 0644 (no execute bit), making
|
|
# the config unreadable for the nonroot user.
|
|
WORKDIR /etc/claude
|
|
COPY --chmod=0644 ${GATEWAY_CONFIG} /etc/claude/gateway.yaml
|
|
COPY --chmod=0644 ${RDS_CA_BUNDLE} /etc/claude/rds-global-bundle.pem
|
|
WORKDIR /
|
|
|
|
ENV CLAUDE_CONFIG_DIR=/tmp/.claude
|
|
# Trust anchor for the store's sslmode=verify-full (see header comment).
|
|
ENV NODE_EXTRA_CA_CERTS=/etc/claude/rds-global-bundle.pem
|
|
|
|
EXPOSE 8080
|
|
USER nonroot
|
|
|
|
ENTRYPOINT ["/usr/local/bin/claude", "gateway", "--config", "/etc/claude/gateway.yaml"]
|