shadowdaoandClaude Opus 5.5
6b015141dc
With the pkg-cache BuildKit mirror on, `FROM almalinux/10-base` was resolved by tag through the cache, so a compromised cache could substitute the image. Each job using the mirror now looks up the base tag's digest DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh, HTTPS, HEAD on the manifest, regex-validated) and builds FROM image@sha256:... via the BASE_IMAGE build-arg, so the mirror can only serve content-addressed blobs. If the lookup fails, the mirror is NOT used for that job and the tag is pulled straight from Docker Hub. The digest is resolved every run (no manual bumps); local builds default to the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.6 KiB
Docker
58 lines
2.6 KiB
Docker
# Base image. CI passes BASE_IMAGE=almalinux/10-base@sha256:<digest>, resolved
|
|
# DIRECTLY from Docker Hub in the same run (.gitea/scripts/resolve-base-image.sh),
|
|
# so the pkg-cache registry mirror can only serve content-addressed blobs.
|
|
# Local builds use the tag. cloud-apache-container docs/pkg-cache.md.
|
|
ARG BASE_IMAGE=almalinux/10-base
|
|
FROM ${BASE_IMAGE}
|
|
ARG NODEVER=20
|
|
|
|
# OPTIONAL internal package cache, e.g. --build-arg PKG_CACHE=https://192.168.1.40
|
|
# (CT130 pkg-cache, https only). Unset = upstream repositories. epel-release is
|
|
# GPG-verified against keys/pkg-cache/ either way. Repo files are restored at
|
|
# the end of the RUN, so no layer keeps the cache address. Same script as
|
|
# cloud-apache-container (scripts/pkg-cache-repos.sh, docs/pkg-cache.md there).
|
|
ARG PKG_CACHE=
|
|
COPY ./scripts/pkg-cache-repos.sh /usr/local/sbin/pkg-cache-repos.sh
|
|
COPY ./keys/pkg-cache/ /usr/local/share/pkg-cache/
|
|
# Install repos, update, install only needed packages, clean up in one layer
|
|
RUN /usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
/usr/local/sbin/pkg-cache-repos.sh release-install epel && \
|
|
/usr/local/sbin/pkg-cache-repos.sh rpm && \
|
|
printf 'retries=10\ntimeout=60\n' >> /etc/dnf/dnf.conf && \
|
|
dnf update -y && \
|
|
dnf install -y wget procps cronie iproute nginx openssl git microdnf make gcc gcc-c++ dumb-init && \
|
|
dnf group install -y 'Development Tools' && \
|
|
/usr/local/sbin/pkg-cache-repos.sh restore && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/* \
|
|
/var/cache/yum /tmp/* /var/tmp/*
|
|
|
|
# Copy scripts into the image and set permissions
|
|
COPY ./scripts/ /scripts/
|
|
RUN chmod +x /scripts/*
|
|
|
|
# Generate self-signed cert, create needed dirs, install Node.js, clean up
|
|
RUN openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 3650 -subj "/CN=localhost" -out /etc/pki/tls/certs/localhost.crt && \
|
|
mkdir -p /var/log/nodejs && \
|
|
/scripts/install-node.sh "$NODEVER" && \
|
|
rm -rf /tmp/*
|
|
|
|
# Install PM2 globally for process management with minimal footprint
|
|
RUN npm install -g pm2@latest --production && \
|
|
npm cache clean --force && \
|
|
rm -rf /tmp/*
|
|
|
|
# Copy nginx config
|
|
COPY ./configs/nginx.conf /etc/nginx/nginx.conf
|
|
|
|
# Copy examples directory for default app fallback
|
|
COPY ./examples/ /examples/
|
|
|
|
# Set up cron job for log rotation
|
|
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD bash -c ': </dev/tcp/127.0.0.1/3000 && : </dev/tcp/127.0.0.1/80' \
|
|
|| exit 1
|
|
|
|
ENTRYPOINT [ "/scripts/entrypoint.sh" ] |