shadowdaoandClaude Opus 5.5
d1547f3418
With the pkg-cache BuildKit mirror on, `FROM almalinux/10-base` was resolved by tag through the cache, so a compromised cache could substitute the image. Each job using the mirror now looks up the base tag's digest DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh, HTTPS, HEAD on the manifest, regex-validated) and builds FROM image@sha256:... via the BASE_IMAGE build-arg, so the mirror can only serve content-addressed blobs. If the lookup fails, the mirror is NOT used for that job and the tag is pulled straight from Docker Hub. The digest is resolved every run (no manual bumps); local builds default to the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.4 KiB
Docker
58 lines
2.4 KiB
Docker
# Base image. CI passes BASE_IMAGE=almalinux/10-base@sha256:<digest>, resolved
|
|
# DIRECTLY from Docker Hub in the same run (.gitea/scripts/resolve-base-image.sh),
|
|
# so the pkg-cache registry mirror can only serve content-addressed blobs.
|
|
# Local builds use the tag. docs/pkg-cache.md "Base-image digest pinning".
|
|
ARG BASE_IMAGE=almalinux/10-base
|
|
FROM ${BASE_IMAGE}
|
|
|
|
# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
|
|
# (CT130 pkg-cache, https only). Unset = upstream repositories. Release RPMs are
|
|
# GPG-verified against keys/pkg-cache/ either way. Repo files
|
|
# are restored at the end of every RUN, so no layer keeps the cache address.
|
|
# See scripts/pkg-cache-repos.sh.
|
|
ARG PKG_CACHE=
|
|
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
|
|
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
|
|
|
|
# Install Apache and minimal dependencies (no PHP at all)
|
|
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
/usr/local/sbin/pkg-cache-repos.sh release-install epel && \
|
|
/usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
dnf update -y && \
|
|
dnf install -y httpd mod_ssl openssl iproute cronie procps curl && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/*
|
|
|
|
# Copy scripts and set permissions
|
|
COPY ./scripts/detect-memory.sh /scripts/detect-memory.sh
|
|
COPY ./scripts/create-apache-mpm-config.sh /scripts/create-apache-mpm-config.sh
|
|
COPY ./scripts/log-rotate.sh /scripts/log-rotate.sh
|
|
COPY ./scripts/entrypoint-shared-httpd.sh /scripts/entrypoint-shared-httpd.sh
|
|
COPY ./scripts/stop-services.sh /scripts/stop-services.sh
|
|
COPY ./scripts/tune-mpm.sh /scripts/tune-mpm.sh
|
|
RUN chmod +x /scripts/*
|
|
|
|
# Generate self-signed SSL cert (same as main CAC image)
|
|
RUN openssl req -newkey rsa:2048 -nodes \
|
|
-keyout /etc/pki/tls/private/localhost.key \
|
|
-x509 -days 3650 -subj "/CN=localhost" \
|
|
-out /etc/pki/tls/certs/localhost.crt
|
|
|
|
# Copy Apache configs
|
|
COPY ./configs/remote_ip.conf /etc/httpd/conf.d/
|
|
COPY ./configs/default-index.conf /etc/httpd/conf.d/
|
|
|
|
# Create vhosts directory (will be volume-mounted from host)
|
|
RUN mkdir -p /etc/httpd/conf.d/vhosts
|
|
|
|
# Set up cron job for log rotation
|
|
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
|
|
|
|
EXPOSE 80 443
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD curl -sfk https://localhost/ping || exit 1
|
|
|
|
ENTRYPOINT [ "/scripts/entrypoint-shared-httpd.sh" ]
|