1.0.38

2026-07-25 08:45:12 +02:00
1 parent 64b6dcd744
commit 123e04d17f
@@ -0,0 +1,51 @@
+# syntax=docker/dockerfile:1.4
+# Dockhand Backup Helper - Minimal restic image (Wolfi-based, zero CVEs)
+#
+# Rebuild trigger: the dockhand-backup-image pipeline is change-gated on this
+# file. Bumping this comment forces a build so docker.io/fnsys/dockhand-backup:latest
+# is (re)published to Docker Hub — the tag DEFAULT_HELPER_IMAGE (restic.ts) pulls.
+# (re-triggered after fixing the ARM-builder Docker Hub login secret)
+# (buildx steps consolidated into one block scalar)
+# (remote ARM login: pipe password over stdin, no quoted interpolation)
+# (use write-capable dockerhub token so the Docker Hub push authorizes)
+# (revert rclone — the rclone: backend is unfinished/removed; see vault rclone.md)
+FROM alpine:3.21 AS os-builder
+
+ARG TARGETARCH
+WORKDIR /work
+
+ARG APKO_VERSION=0.30.34
+RUN apk add --no-cache curl \
+    && ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") \
+    && curl -sL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VERSION}/apko_${APKO_VERSION}_linux_${ARCH}.tar.gz" \
+       | tar -xz --strip-components=1 -C /usr/local/bin \
+    && chmod +x /usr/local/bin/apko
+
+RUN APKO_ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "aarch64" || echo "x86_64") \
+    && printf '%s\n' \
+    "contents:" \
+    "  repositories:" \
+    "    - https://packages.wolfi.dev/os" \
+    "  keyring:" \
+    "    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub" \
+    "  packages:" \
+    "    - wolfi-base" \
+    "    - ca-certificates" \
+    "    - busybox" \
+    "    - restic" \
+    "entrypoint:" \
+    "  command: /bin/sh" \
+    "archs:" \
+    "  - ${APKO_ARCH}" \
+    > apko.yaml
+
+RUN apko build apko.yaml dockhand-backup:latest output.tar \
+    && mkdir -p rootfs \
+    && tar -xf output.tar \
+    && LAYER=$(tar -tf output.tar | grep '.tar.gz$' | head -1) \
+    && tar -xzf "$LAYER" -C rootfs
+
+FROM scratch
+COPY --from=os-builder /work/rootfs /
+COPY scripts/backup-entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]