mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-05 14:55:44 +00:00
Lunny Xiaoandsilverwind
ee03687688
All images run `apk upgrade` before installing packages, so they pick up Alpine fixes their base images lag on. `docker:29.9.2-dind` shipped libexpat 2.9.0-r0 while Alpine 3.24 provides 2.10.0-r0 with the security fixes, and both `docker:29.9.3-dind` and `alpine:3.24` still ship apk-tools 3.0.8-r0 where 3.0.9-r0 is available. The dind bases are also bumped to `docker:29.9.3`, which drops several vulnerable bundled binaries' findings. Verified by building the targets locally: libexpat is 2.10.0-r0 (was 2.9.0-r0), apk-tools is 3.0.9-r0 (was 3.0.8-r0), and Trivy reports no Alpine package findings on the dind images. Assisted-by: Codet:claude Assisted-by: Claude Code:claude-opus-5-5 Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1388 Reviewed-by: silverwind <[email protected]> Co-authored-by: Lunny Xiao <[email protected]>
88 lines
2.1 KiB
Docker
88 lines
2.1 KiB
Docker
### BUILDER STAGE
|
|
#
|
|
#
|
|
FROM golang:1.27-alpine AS builder
|
|
|
|
# Do not remove `git` here, it is required for getting runner version when executing `make build`
|
|
RUN apk add --no-cache make git
|
|
|
|
ARG GOPROXY
|
|
ENV GOPROXY=${GOPROXY:-}
|
|
|
|
COPY . /opt/src/runner
|
|
WORKDIR /opt/src/runner
|
|
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
make clean && make build
|
|
|
|
### DIND VARIANT
|
|
#
|
|
#
|
|
FROM docker:29.9.3-dind AS dind
|
|
|
|
ARG VERSION=dev
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|
|
|
|
# upgrade first: the docker base image can lag behind Alpine security fixes
|
|
RUN apk upgrade --no-cache && apk add --no-cache s6 bash git tzdata nftables
|
|
|
|
COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
|
|
COPY scripts/run.sh /usr/local/bin/run.sh
|
|
COPY scripts/s6 /etc/s6
|
|
|
|
VOLUME /data
|
|
|
|
ENV TINI_SUBREAPER=1
|
|
|
|
ENTRYPOINT ["s6-svscan","/etc/s6"]
|
|
|
|
### DIND-ROOTLESS VARIANT
|
|
#
|
|
#
|
|
FROM docker:29.9.3-dind-rootless AS dind-rootless
|
|
|
|
ARG VERSION=dev
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|
|
|
|
USER root
|
|
# upgrade first: the docker base image can lag behind Alpine security fixes
|
|
RUN apk upgrade --no-cache && apk add --no-cache s6 bash git tzdata nftables
|
|
|
|
COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
|
|
COPY scripts/run.sh /usr/local/bin/run.sh
|
|
COPY scripts/s6 /etc/s6
|
|
|
|
VOLUME /data
|
|
|
|
RUN mkdir -p /data && chown -R rootless:rootless /etc/s6 /data
|
|
|
|
ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
|
|
ENV TINI_SUBREAPER=1
|
|
|
|
USER rootless
|
|
ENTRYPOINT ["s6-svscan","/etc/s6"]
|
|
|
|
### BASIC VARIANT
|
|
#
|
|
#
|
|
FROM alpine:3.24 AS basic
|
|
|
|
ARG VERSION=dev
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|
|
|
|
RUN apk upgrade --no-cache && apk add --no-cache tini bash git tzdata
|
|
|
|
COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
|
|
COPY scripts/run.sh /usr/local/bin/run.sh
|
|
|
|
VOLUME /data
|
|
|
|
ENTRYPOINT ["/sbin/tini","--","run.sh"]
|