Skip to content
This repository was archived by the owner on Dec 26, 2024. It is now read-only.

Commit b120fb8

Browse files
s0up4200s0up4200
authored
feat: add distroless docker builds (#84)
* feat: add distroless docker builds * disable unsupported distroless platforms * add missing digest upload * Revert "add missing digest upload" This reverts commit fb17fb8. * add digests * Revert "add digests" This reverts commit 63fb950. * add digests again * speculative fix * speculating * weebs * weeeeeebs * need to ask kyle * another attempt * speculatarr * update readme and compose * Revert "fix(dockerfile): remove unnecessary spaces" This reverts commit 50520b7, reversing changes made to d3af84b. * fix: bring in kyles changes * fix: cleanup bad merge * fix(dockerfile): remove unnecessary spaces
1 parent 81446c6 commit b120fb8

File tree

4 files changed

+180
-0
lines changed

4 files changed

+180
-0
lines changed

‎.github/workflows/build.yaml

+124
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,84 @@ jobs:
168168
if-no-files-found: error
169169
retention-days: 1
170170

171+
docker-distroless:
172+
name: Build and publish Distroless Docker images
173+
runs-on: ubuntu-latest
174+
needs: [test]
175+
strategy:
176+
fail-fast: true
177+
matrix:
178+
platform:
179+
- linux/amd64
180+
- linux/arm64
181+
steps:
182+
- name: Checkout
183+
uses: actions/checkout@v4
184+
with:
185+
fetch-depth: 0
186+
187+
- name: Login to GitHub Container Registry
188+
uses: docker/login-action@v3
189+
with:
190+
registry: ${{ env.REGISTRY }}
191+
username: ${{ github.repository_owner }}
192+
password: ${{ secrets.GITHUB_TOKEN }}
193+
194+
- name: Extract metadata
195+
id: meta
196+
uses: docker/metadata-action@v5
197+
with:
198+
images: ${{ env.REGISTRY_IMAGE }}-distroless
199+
tags: |
200+
type=semver,pattern={{version}},prefix=v
201+
type=semver,pattern={{major}}.{{minor}},prefix=v
202+
type=ref,event=branch
203+
type=ref,event=pr
204+
flavor: |
205+
latest=auto
206+
207+
- name: Set up QEMU
208+
uses: docker/setup-qemu-action@v3
209+
210+
- name: Set up Docker Buildx
211+
uses: docker/setup-buildx-action@v3
212+
213+
- name: Supported Architectures
214+
run: docker buildx ls
215+
216+
- name: Build and publish distroless image
217+
id: docker_build
218+
uses: docker/build-push-action@v5
219+
with:
220+
context: .
221+
file: ./Dockerfile-distroless.ci
222+
platforms: ${{ matrix.platform }}
223+
outputs: type=image,name=${{ env.REGISTRY_IMAGE }}-distroless,push-by-digest=true,name-canonical=true,push=${{ (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request') && 'true' || 'false' }}
224+
labels: ${{ steps.meta.outputs.labels }}
225+
build-args: |
226+
BUILDTIME=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
227+
VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
228+
REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
229+
cache-from: type=gha
230+
cache-to: type=gha,mode=max
231+
provenance: false
232+
233+
- name: Export image digest for Distroless
234+
id: digest-prep-distroless
235+
run: |
236+
mkdir -p /tmp/digests-distroless
237+
digest="${{ steps.docker_build.outputs.digest }}"
238+
echo "manifest-hash=${digest#sha256:}" >> "$GITHUB_OUTPUT"
239+
touch "/tmp/digests-distroless/${digest#sha256:}"
240+
241+
- name: Upload image digest for Distroless
242+
uses: actions/upload-artifact@v4
243+
with:
244+
name: docker-distroless-digests-${{ steps.digest-prep-distroless.outputs.manifest-hash }}
245+
path: /tmp/digests-distroless/*
246+
if-no-files-found: error
247+
retention-days: 1
248+
171249
docker-merge:
172250
name: Publish Docker multi-arch manifest
173251
if: ${{ github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request' }}
@@ -213,3 +291,49 @@ jobs:
213291
- name: Inspect image
214292
run: |
215293
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
294+
295+
docker-merge-distroless:
296+
name: Publish Distroless Docker multi-arch manifest
297+
if: ${{ github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request' }}
298+
runs-on: ubuntu-latest
299+
needs: [docker-distroless, test]
300+
steps:
301+
- name: Download image digests for Distroless
302+
uses: actions/download-artifact@v4
303+
with:
304+
path: /tmp/digests-distroless
305+
pattern: docker-distroless-digests-*
306+
merge-multiple: true
307+
308+
- name: Set up Docker Buildx
309+
uses: docker/setup-buildx-action@v3
310+
311+
- name: Login to GitHub Container Registry
312+
uses: docker/login-action@v3
313+
with:
314+
registry: ${{ env.REGISTRY }}
315+
username: ${{ github.repository_owner }}
316+
password: ${{ secrets.GITHUB_TOKEN }}
317+
318+
- name: Extract metadata for Distroless
319+
id: meta
320+
uses: docker/metadata-action@v5
321+
with:
322+
images: ${{ env.REGISTRY_IMAGE }}-distroless
323+
tags: |
324+
type=semver,pattern={{version}},prefix=v
325+
type=semver,pattern={{major}}.{{minor}},prefix=v
326+
type=ref,event=branch
327+
type=ref,event=pr
328+
flavor: |
329+
latest=auto
330+
331+
- name: Create manifest list and push for Distroless
332+
working-directory: /tmp/digests-distroless
333+
run: |
334+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
335+
$(printf '${{ env.REGISTRY_IMAGE }}-distroless@sha256:%s ' *)
336+
337+
- name: Inspect Distroless image
338+
run: |
339+
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}-distroless:${{ steps.meta.outputs.version }}

‎Dockerfile-distroless.ci

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# build app
2+
FROM --platform=$BUILDPLATFORM golang:1.22-alpine3.19 AS app-builder
3+
#RUN apk add --no-cache git tzdata
4+
5+
ENV SERVICE=omegabrr
6+
7+
WORKDIR /src
8+
9+
# Cache Go modules
10+
COPY go.mod go.sum ./
11+
RUN go mod download
12+
13+
COPY . ./
14+
15+
ARG VERSION=main
16+
ARG REVISION=main
17+
ARG BUILDTIME
18+
ARG TARGETOS TARGETARCH TARGETVARIANT
19+
20+
RUN --network=none --mount=target=. \
21+
export GOOS=$TARGETOS; \
22+
export GOARCH=$TARGETARCH; \
23+
echo $GOARCH $GOOS; \
24+
go build -ldflags "-s -w -X github.com/autobrr/omegabrr/internal/buildinfo.Version=${VERSION} -X github.com/autobrr/omegabrr/internal/buildinfo.Commit=${REVISION} -X github.com/autobrr/omegabrr/internal/buildinfo.Date=${BUILDTIME}" -o /out/bin/omegabrr cmd/omegabrr/main.go
25+
26+
# build runner
27+
FROM gcr.io/distroless/static-debian12:nonroot
28+
29+
LABEL org.opencontainers.image.source="https://github.com/autobrr/omegabrr"
30+
LABEL org.opencontainers.image.licenses="MIT"
31+
LABEL org.opencontainers.image.base.name="gcr.io/distroless/static-debian12:nonroot"
32+
33+
COPY --from=app-builder /out/bin/omegabrr /usr/local/bin/
34+
35+
WORKDIR /config
36+
37+
EXPOSE 7441
38+
39+
ENTRYPOINT ["omegabrr", "run", "--config", "/config/config.yaml"]

‎README.md

+16
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,16 @@
22

33
Omegabrr transforms items monitored by arrs or lists into autobrr filters. Useful for automating your filters for monitored media or racing criteria.
44

5+
## Table of Contents
6+
- [Config](#config)
7+
- [Tags](#tags)
8+
- [Lists](#lists)
9+
- [Commands](#commands)
10+
- [Service](#service)
11+
- [Docker Compose](#docker-compose)
12+
- [Distroless alternative](#distroless-docker-images)
13+
- [Systemd Setup](#systemd)
14+
515
## Config
616

717
You can set multiple filters per arr. Find the filter ID by going into the webui and get the ID from the url like `http://localhost:7474/filters/10` where `10` is the filter ID.
@@ -273,6 +283,12 @@ Check the `docker-compose.yml` example.
273283

274284
If you have custom networks then make sure to add those, so it can communicate with autobrr, sonarr and radarr.
275285

286+
### Distroless Docker Images
287+
288+
For users who prioritize container security, we offer alternative Docker images built on [Distroless](https://github.com/GoogleContainerTools/distroless). Specifically the `distroless/static-debian12:nonroot` base image.
289+
290+
Distroless images do not contain a package manager or shell, thereby reducing the potential attack surface and making them a more secure option. These stripped-back images contain only the application and its runtime dependencies.
291+
276292
### Systemd
277293

278294
On Linux-based systems it is recommended to run omegabrr as a systemd service.

‎docker-compose.yml

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ services:
44
omegabrr:
55
container_name: omegabrr
66
image: ghcr.io/autobrr/omegabrr:latest
7+
#image: ghcr.io/autobrr/omegabrr-distroless:latest
78
ports:
89
- "7441:7441"
910
user: 1000:1000

0 commit comments

Comments
 (0)