iceBear67andClaude Opus 5
f37cd0a125
Multi-stage Dockerfile on debian:trixie-slim. openvpn3 and lwIP are cloned at pinned refs and handed to CMake through OVG_OPENVPN3_DIR/OVG_LWIP_DIR rather than left to FetchContent, whose GIT_TAG master would make the same Dockerfile build a different VPN client each week. The unit suite runs in the builder stage. docker/openvpngate.conf overrides only the keys whose host default is wrong inside a container -- loopback listen addresses, which make a published port reach nothing, and relative state paths, which put the node failure history on a layer that gets thrown away. Everything else stays absent and takes the compiled-in default so the file cannot drift from the code. The compose example drops every capability, runs read-only as uid 10001 and publishes both ports to host loopback: the admin endpoint has no auth and includes POST /switch. That configuration is the design constraint of this project (no root, no tun device) turned into something testable. docs/DOCKER.md 8 records what was checked against the source and what was not: this sandbox has no docker daemon, so neither the image build nor the compose file has actually been run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
33 lines
934 B
Plaintext
33 lines
934 B
Plaintext
# The build context is COPYied wholesale into the builder stage. Without this
|
|
# the two local build trees (~1 GB with the openvpn3 objects) would be shipped
|
|
# to the daemon on every `docker build`, only to be overwritten by the
|
|
# container's own cmake run.
|
|
build/
|
|
build-tunnel/
|
|
build*/
|
|
|
|
# The image builds from the working tree, not from git history.
|
|
.git/
|
|
.gitignore
|
|
.dockerignore
|
|
|
|
# Runtime state. The node cache and the outcome history belong to whichever
|
|
# machine produced them; the container gets its own in a volume.
|
|
var/
|
|
|
|
# Local operator config and credentials. The container reads its config from a
|
|
# mount (see docker-compose.yml), never from something baked into the layer.
|
|
etc/
|
|
# Patterns match the whole context-relative path, so a bare *.auth would only
|
|
# cover the top level -- and the credential file lives in docker/.
|
|
**/*.auth
|
|
|
|
# Editor and OS noise
|
|
*.swp
|
|
*~
|
|
.vscode/
|
|
.idea/
|
|
.DS_Store
|
|
.cache/
|
|
compile_commands.json
|