5 Commits

Include renames

Author	SHA1	Message	Date
shadowdaoandClaude Opus 5.5	6b015141dc	ci: pin base images by digest resolved directly from Docker Hub ... With the pkg-cache BuildKit mirror on, `FROM almalinux/10-base` was resolved by tag through the cache, so a compromised cache could substitute the image. Each job using the mirror now looks up the base tag's digest DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh, HTTPS, HEAD on the manifest, regex-validated) and builds FROM image@sha256:... via the BASE_IMAGE build-arg, so the mirror can only serve content-addressed blobs. If the lookup fails, the mirror is NOT used for that job and the tag is pulled straight from Docker Hub. The digest is resolved every run (no manual bumps); local builds default to the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 06:58:18 -07:00
shadowdaoandClaude Opus 5.5	0edd0d3c53	fix(ci): build through the internal package cache; keep bundled npm on Node 18/20 ... - The first Node 24/26 run timed out on every job: public AlmaLinux mirrors served the runners at 1-150 kB/s. Use the CT130 package cache the same way cloud-apache-container does (same pkg-cache-repos.sh and pinned CA), with the upstream repos as fallback when the probe fails. epel-release is now GPG-verified before install instead of fetched unverified by URL. - npm 12 requires Node >=22.22.2; on 18/20 keep the npm Node ships with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 06:52:07 -07:00
shadowdaoandClaude Opus 5.5	ae6acdd009	feat: Node.js 24 and 26 images; refuse builds below the Oct 2026 security floor ... - One install-node.sh <major> replaces install-node{18,20,22}.sh. It fails the build if NodeSource hands back a version below the newest security release for the line (22.23.4 / 24.22.1 / 26.12.1: CVE-2026-111497 Brotli OOB write and 9 others), so a lagging mirror can't ship a vulnerable image silently. 18 and 20 are EOL: they still build, with a warning. - CI matrix adds 24 and 26; fail-fast off so one line can't cancel the rest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 05:50:49 -07:00
shadowdaoandClaude	f8edb2b407	Change container name from cnc to cnoc to avoid nginx container conflict ... - Update Gitea pipeline to build cnoc:node18, cnoc:node20, cnoc:node22 - Update local-dev.sh to use cnoc container from registry - Update documentation references from CNC to CNOC - Update default app package name to cnoc-default-app - Avoid conflict with existing nginx container (cnc) 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-21 16:17:16 -07:00
shadowdaoandClaude	2989cd590a	Complete Node.js container implementation with multi-version support ... - Add Dockerfile with AlmaLinux 9 base, Nginx reverse proxy, and PM2 - Support Node.js versions 18, 20, 22 with automated installation - Implement memory-optimized configuration (256MB minimum, 512MB recommended) - Add Memcached session storage for development environments - Create comprehensive documentation (README, USER-GUIDE, MEMORY-GUIDE, CLAUDE.md) - Include example applications (simple website and REST API) - Add Gitea CI/CD pipeline for automated multi-version builds - Provide local development script with helper utilities - Implement health monitoring, log rotation, and backup systems 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-21 16:00:46 -07:00