shadowdaoandClaude Opus 5.5
9166c0953e
- Base image pinned by digest resolved directly from Docker Hub (.gitea/scripts/resolve-base-image.sh); registry mirror only when pinned. - Probe the cache over TLS with the pinned CA; without it, builds use the upstream repositories and Docker Hub exactly as before. - Dockerfile: ARG BASE_IMAGE / PKG_CACHE; package RUN rewrites repos via scripts/pkg-cache-repos.sh (canonical copy from cloud-apache-container), installs epel-release with GPG-verified release-install, restores repo files before the RUN ends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
1.3 KiB
Docker
27 lines
1.3 KiB
Docker
# Base image. CI passes BASE_IMAGE=almalinux/9-base@sha256:<digest>, resolved
|
|
# DIRECTLY from Docker Hub in the same run (.gitea/scripts/resolve-base-image.sh),
|
|
# so the pkg-cache registry mirror can only serve content-addressed blobs.
|
|
# Local builds use the tag.
|
|
ARG BASE_IMAGE=almalinux/9-base
|
|
FROM ${BASE_IMAGE}
|
|
|
|
# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
|
|
# (CT130 pkg-cache, https only). Unset = upstream repositories. epel-release is
|
|
# GPG-verified against keys/pkg-cache/ either way. Repo files are restored at
|
|
# the end of the RUN, so no layer keeps the cache address. Same script as
|
|
# cloud-apache-container (scripts/pkg-cache-repos.sh, docs/pkg-cache.md there).
|
|
ARG PKG_CACHE=
|
|
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
|
|
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
|
|
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
/usr/local/sbin/pkg-cache-repos.sh release-install epel && \
|
|
/usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
dnf update -y && \
|
|
dnf install -y memcached procps-ng && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /var/cache/yum
|
|
COPY ./scripts/entrypoint.sh /
|
|
RUN chmod +x /entrypoint.sh
|
|
ENTRYPOINT [ "/entrypoint.sh" ]
|