Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
92 lines
4.0 KiB
Docker
92 lines
4.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# aptly-server — aptly built from source, cross-compiled, plus the tools its
|
|
# own entrypoint/reconcile scripts need (jq, yq, envsubst, gpg). Doubles as
|
|
# the CLI/debug image: `docker run --rm aptly-server aptly version`.
|
|
#
|
|
# Built from source rather than the upstream .deb or release zip because:
|
|
# - the aptly release assets ship no checksums file, so a zip download can
|
|
# only ever be "trust the network", never "verify the bytes";
|
|
# - cross-compiling is native on an arm64 build host (the expensive part
|
|
# needs no QEMU — only the tiny runtime stage below does), which matters
|
|
# because there is no amd64 runner in this project's CI;
|
|
# - it removes any dependency on repo.aptly.info having published a build
|
|
# for this exact Debian release/arch combination in time for a rebuild.
|
|
#
|
|
# renovate: datasource=github-releases depName=aptly-dev/aptly
|
|
ARG APTLY_VERSION=1.6.3
|
|
ARG GO_IMAGE=golang:1.25-trixie
|
|
ARG RUNTIME_IMAGE=debian:trixie-slim
|
|
|
|
# renovate: datasource=github-releases depName=mikefarah/yq
|
|
ARG YQ_VERSION=4.53.3
|
|
ARG YQ_SHA256_AMD64=fa52a4e758c63d38299163fbdd1edfb4c4963247918bf9c1c5d31d84789eded4
|
|
ARG YQ_SHA256_ARM64=578648e463a11c1b6db6010cbf41eafed6bee79466fcffa1bb446672cf7945ea
|
|
|
|
FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS build
|
|
ARG APTLY_VERSION
|
|
ARG TARGETARCH
|
|
WORKDIR /src
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
git clone --depth 1 --branch "v${APTLY_VERSION}" https://github.com/aptly-dev/aptly . \
|
|
&& printf '%s' "${APTLY_VERSION}" > VERSION \
|
|
&& CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" \
|
|
go build -trimpath -ldflags="-s -w" -o /out/aptly .
|
|
|
|
FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS build-tools
|
|
# Runs once for BUILDPLATFORM, not per target arch — cheap even on an
|
|
# emulated runtime stage below, since we just copy the right binary in.
|
|
ARG YQ_VERSION
|
|
ARG YQ_SHA256_AMD64
|
|
ARG YQ_SHA256_ARM64
|
|
WORKDIR /out
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
RUN set -eux; \
|
|
curl -fsSL -o yq_linux_amd64 "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64"; \
|
|
curl -fsSL -o yq_linux_arm64 "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_arm64"; \
|
|
echo "${YQ_SHA256_AMD64} yq_linux_amd64" | sha256sum -c -; \
|
|
echo "${YQ_SHA256_ARM64} yq_linux_arm64" | sha256sum -c -; \
|
|
chmod +x yq_linux_amd64 yq_linux_arm64
|
|
|
|
FROM ${RUNTIME_IMAGE}
|
|
ARG TARGETARCH
|
|
ARG APTLY_VERSION
|
|
ARG APTLY_REVISION=1
|
|
|
|
LABEL org.opencontainers.image.title="aptly-server" \
|
|
org.opencontainers.image.description="aptly (Debian repository management tool), containerized: REST API + non-root runtime" \
|
|
org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
|
|
org.opencontainers.image.licenses="MIT" \
|
|
org.opencontainers.image.version="${APTLY_VERSION}-${APTLY_REVISION}"
|
|
|
|
# hadolint ignore=DL3008
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates gnupg bzip2 xz-utils curl jq gettext-base openssl \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& addgroup --system --gid 10001 aptly \
|
|
&& adduser --system --uid 10001 --ingroup aptly --home /var/lib/aptly --disabled-password aptly \
|
|
&& mkdir -p /var/lib/aptly/public /run/aptly /etc/aptly-src \
|
|
&& chown -R aptly:aptly /var/lib/aptly /run/aptly
|
|
|
|
COPY --from=build /out/aptly /usr/local/bin/aptly
|
|
COPY --from=build-tools /out/yq_linux_${TARGETARCH} /usr/local/bin/yq
|
|
COPY rootfs/ /
|
|
|
|
ENV APTLY_ROOT_DIR=/var/lib/aptly \
|
|
APTLY_RUN_DIR=/run/aptly \
|
|
APTLY_CONFIG=/run/aptly/aptly.yaml \
|
|
APTLY_CONFIG_SRC=/etc/aptly-src/aptly.yaml \
|
|
APTLY_CONFIG_DST=/run/aptly/aptly.yaml \
|
|
APTLY_API_LISTEN=127.0.0.1:8080
|
|
|
|
USER 10001:10001
|
|
WORKDIR /var/lib/aptly
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD ["curl", "-fsS", "http://127.0.0.1:8080/api/healthy"]
|
|
|
|
ENTRYPOINT ["/usr/local/bin/aptly-entrypoint"]
|