shadowdaoandClaude Opus 5.5
d1547f3418
With the pkg-cache BuildKit mirror on, `FROM almalinux/10-base` was resolved by tag through the cache, so a compromised cache could substitute the image. Each job using the mirror now looks up the base tag's digest DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh, HTTPS, HEAD on the manifest, regex-validated) and builds FROM image@sha256:... via the BASE_IMAGE build-arg, so the mirror can only serve content-addressed blobs. If the lookup fails, the mirror is NOT used for that job and the tag is pulled straight from Docker Hub. The digest is resolved every run (no manual bumps); local builds default to the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
78 lines
4.0 KiB
Docker
78 lines
4.0 KiB
Docker
## shared-ols — the shared OpenLiteSpeed webserver tier.
|
|
##
|
|
## One OLS container fronting MANY tenants' detached cac-lsphp sidecars — the
|
|
## OLS analogue of the shared-httpd container. Runs NO PHP locally: every site's
|
|
## PHP goes to its own cac-lsphp:phpNN sidecar over LSAPI (extProcessor type
|
|
## lsapi, address <sidecar>:9000). HAProxy stays the TLS/WAF/SNI edge and routes
|
|
## OLS-type hostnames here on :443.
|
|
##
|
|
## Built on the SAME litespeedtech prebuilt base as cac-litespeed / cac-lsphp so
|
|
## the OLS build + plumbing (lscgid, cgid socket — see feedback_ols_packaging_landmines)
|
|
## are the proven ones. The base is lsphp-tagged but we never run that lsphp;
|
|
## the tag just selects the OLS build. Pinned to lsphp83 / OLS 1.8.4.
|
|
##
|
|
## Config model (established by PoC 2026-06-10): OLS has NO top-level `include`,
|
|
## so render-shared-ols-config.sh assembles httpd_config.conf from the panel's
|
|
## per-site files at boot + on every change. See that script + the plan.
|
|
|
|
ARG OLS_VERSION=1.8.4
|
|
ARG PHPVER=83
|
|
## CI passes BASE_IMAGE=litespeedtech/openlitespeed@sha256:<digest> of the
|
|
## ${OLS_VERSION}-lsphp${PHPVER} tag, resolved DIRECTLY from Docker Hub in the same
|
|
## run (.gitea/scripts/resolve-base-image.sh), so the pkg-cache registry mirror can
|
|
## only serve content-addressed blobs. Local builds use the tag.
|
|
ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
|
|
FROM ${BASE_IMAGE}
|
|
|
|
## OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
|
|
## (CT130 pkg-cache, https only). Unset = upstream repositories. Release RPMs are
|
|
## GPG-verified against keys/pkg-cache/ either way. Repo files
|
|
## are restored at the end of every RUN, so no layer keeps the cache address.
|
|
## See scripts/pkg-cache-repos.sh.
|
|
ARG PKG_CACHE=
|
|
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
|
|
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
|
|
|
|
## Tooling the shared tier needs on top of the base:
|
|
## - inotify-tools: the .htaccess watcher (spec 5.3)
|
|
## - gettext-base: envsubst for render-shared-ols-config.sh
|
|
## - openssl: self-signed cert for the :443 listener (HAProxy verifies none)
|
|
## - curl/ca-certificates: HEALTHCHECK
|
|
## - procps: provides pgrep, which entrypoint-shared-ols.sh's ols_running()
|
|
## liveness check depends on. Only transitively present via the base image
|
|
## today (Ubuntu 24.04 pulls it in) — pin it explicitly so it can't be
|
|
## pruned as "unused" and silently break the supervisor's crash detection.
|
|
RUN /usr/local/sbin/pkg-cache-repos.sh apt && \
|
|
apt-get update && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
inotify-tools gettext-base openssl ca-certificates curl procps && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
|
|
|
|
## Snapshot the stock httpd_config.conf so render-shared-ols-config.sh always has
|
|
## a pristine base to strip-and-rebuild from (the base image keeps it at conf/).
|
|
RUN mkdir -p /usr/local/lsws/.conf && \
|
|
cp /usr/local/lsws/conf/httpd_config.conf /usr/local/lsws/.conf/httpd_config.conf
|
|
|
|
COPY ./scripts/entrypoint-shared-ols.sh \
|
|
./scripts/render-shared-ols-config.sh \
|
|
./scripts/ols-htaccess-watcher.sh \
|
|
/scripts/
|
|
RUN chmod +x /scripts/entrypoint-shared-ols.sh /scripts/render-shared-ols-config.sh /scripts/ols-htaccess-watcher.sh
|
|
COPY ./configs/shared-ols/ /etc/shared-ols-templates/
|
|
|
|
## Admin console unreachable from tenant/edge networks (spec 5.2): bind the
|
|
## WebAdmin listener to loopback. Same sed as Dockerfile.litespeed.
|
|
RUN sed -i 's|^[[:space:]]*address[[:space:]]\+\*:| address 127.0.0.1:|' \
|
|
/usr/local/lsws/admin/conf/admin_config.conf 2>/dev/null || true
|
|
|
|
EXPOSE 80 443
|
|
|
|
## Health: the entrypoint renders a catch-all _health vhost serving /healthz, so
|
|
## this passes from boot (zero customer sites) onward. Self-signed :443.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD curl -fsSk https://127.0.0.1/healthz || exit 1
|
|
|
|
ENTRYPOINT ["/scripts/entrypoint-shared-ols.sh"]
|