Erich Blume
0e2c10176d
## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231
32 lines
847 B
Docker
32 lines
847 B
Docker
# Miniflux RSS feed reader
|
|
# Based on upstream packaging/docker/alpine/Dockerfile
|
|
|
|
ARG CONTAINER_APP_VERSION=2.2.17
|
|
ARG MINIFLUX_VERSION=${CONTAINER_APP_VERSION}
|
|
|
|
FROM golang:alpine3.22 AS build
|
|
|
|
ARG MINIFLUX_VERSION
|
|
RUN apk add --no-cache build-base git make
|
|
|
|
# Clone specific version
|
|
RUN git clone --depth 1 --branch ${MINIFLUX_VERSION} \
|
|
https://github.com/miniflux/v2.git /go/src/app
|
|
|
|
WORKDIR /go/src/app
|
|
RUN make miniflux
|
|
|
|
FROM alpine:3.22
|
|
|
|
LABEL org.opencontainers.image.title=Miniflux
|
|
LABEL org.opencontainers.image.description="Miniflux is a minimalist and opinionated feed reader"
|
|
LABEL org.opencontainers.image.source=https://github.com/miniflux/v2
|
|
|
|
EXPOSE 8080
|
|
ENV LISTEN_ADDR=0.0.0.0:8080
|
|
|
|
RUN apk --no-cache add ca-certificates tzdata
|
|
COPY --from=build /go/src/app/miniflux /usr/bin/miniflux
|
|
|
|
USER 65534
|
|
CMD ["/usr/bin/miniflux"]
|