iceBear67
c7afb86ebc
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
33 lines
1.3 KiB
Docker
33 lines
1.3 KiB
Docker
FROM golang:1.25-alpine AS bubble-builder
|
|
|
|
WORKDIR /src
|
|
RUN apk add git && git clone https://github.com/iceBear67/bubble . && go mod download && mkdir /build
|
|
RUN CGO_ENABLED=0 go build -o /build/daemon . && \
|
|
CGO_ENABLED=0 go build -o /build/auth_server ./gitea-auth/
|
|
|
|
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
|
|
go build -o /build/daemon . && \
|
|
CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
|
|
go build -o /build/auth_server ./gitea-auth/
|
|
|
|
FROM alpine:3.24 AS rootfs-builder
|
|
RUN apk update && apk add alpine-make-vm-image
|
|
COPY ./image /kitchen
|
|
COPY .env /kitchen/.env
|
|
RUN sh /kitchen/substitution.sh < /kitchen/.env
|
|
COPY --from=bubble-builder --chmod=755 /build/daemon /kitchen/overlay/usr/bin/bubble
|
|
COPY --from=bubble-builder --chmod=755 /build/auth_server /kitchen/overlay/usr/bin/auth-server
|
|
# Ship only the SSH host private keys (sshd derives the public halves), with
|
|
# strict perms — not the whole secret/ dir (which also holds .pub/.gitkeep).
|
|
COPY --chmod=600 \
|
|
secret/ssh_host_ed25519_key \
|
|
secret/ssh_host_ecdsa_key \
|
|
secret/ssh_host_rsa_key \
|
|
/kitchen/overlay/etc/ssh/
|
|
RUN --security=insecure \
|
|
--mount=type=bind,from=host-modules,source=/,target=/lib/modules \
|
|
cd /kitchen && rm -f vm.raw && ALPINE_BRANCH="3.24" ./build-image.sh
|
|
|
|
FROM scratch AS export
|
|
COPY --from=rootfs-builder /kitchen/vm.raw /vm.raw
|