53 lines
2.0 KiB
Docker
53 lines
2.0 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
# Dockhand Backup Helper - Minimal restic image (Wolfi-based, zero CVEs)
|
|
#
|
|
# Rebuild trigger: the dockhand-backup-image pipeline is change-gated on this
|
|
# file. Bumping this comment forces a build so docker.io/fnsys/dockhand-backup:latest
|
|
# is (re)published to Docker Hub — the tag DEFAULT_HELPER_IMAGE (restic.ts) pulls.
|
|
# (re-triggered after fixing the ARM-builder Docker Hub login secret)
|
|
# (buildx steps consolidated into one block scalar)
|
|
# (remote ARM login: pipe password over stdin, no quoted interpolation)
|
|
# (use write-capable dockerhub token so the Docker Hub push authorizes)
|
|
# (revert rclone — the rclone: backend is unfinished/removed; see vault rclone.md)
|
|
# (rebuild: registry GC orphaned a helper-image blob; force a clean multi-arch republish)
|
|
FROM alpine:3.21 AS os-builder
|
|
|
|
ARG TARGETARCH
|
|
WORKDIR /work
|
|
|
|
ARG APKO_VERSION=0.30.34
|
|
RUN apk add --no-cache curl \
|
|
&& ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") \
|
|
&& curl -sL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VERSION}/apko_${APKO_VERSION}_linux_${ARCH}.tar.gz" \
|
|
| tar -xz --strip-components=1 -C /usr/local/bin \
|
|
&& chmod +x /usr/local/bin/apko
|
|
|
|
RUN APKO_ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "aarch64" || echo "x86_64") \
|
|
&& printf '%s\n' \
|
|
"contents:" \
|
|
" repositories:" \
|
|
" - https://packages.wolfi.dev/os" \
|
|
" keyring:" \
|
|
" - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub" \
|
|
" packages:" \
|
|
" - wolfi-base" \
|
|
" - ca-certificates" \
|
|
" - busybox" \
|
|
" - restic" \
|
|
"entrypoint:" \
|
|
" command: /bin/sh" \
|
|
"archs:" \
|
|
" - ${APKO_ARCH}" \
|
|
> apko.yaml
|
|
|
|
RUN apko build apko.yaml dockhand-backup:latest output.tar \
|
|
&& mkdir -p rootfs \
|
|
&& tar -xf output.tar \
|
|
&& LAYER=$(tar -tf output.tar | grep '.tar.gz$' | head -1) \
|
|
&& tar -xzf "$LAYER" -C rootfs
|
|
|
|
FROM scratch
|
|
COPY --from=os-builder /work/rootfs /
|
|
COPY scripts/backup-entrypoint.sh /entrypoint.sh
|
|
ENTRYPOINT ["/entrypoint.sh"]
|