mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-26 09:32:32 +02:00
10de344c5c
* Fix Docker --cap-drop=all and add multi-arch support
Fixes #14899
## Bug Fix: CAP_DROP_ALL Permission Denied
The `chown -R algo:algo /algo` line added in commit 2ab57c3 broke
`--cap-drop=all` functionality. When running as root with all
capabilities dropped, root loses CAP_DAC_OVERRIDE and cannot write
to files owned by other users.
The fix removes the unnecessary chown since:
- Container runs as USER root
- algo-docker.sh writes to /algo/config.cfg at runtime
- /algo must be root-owned for --cap-drop=all to work
## Multi-arch Support
The Docker image was only built for linux/amd64. Added:
- QEMU setup for ARM emulation
- Docker Buildx for multi-platform builds
- platforms: linux/amd64,linux/arm64
This enables native support for Apple Silicon Macs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Update Docker actions to latest versions
- setup-qemu-action: v3.6.0 → v3.7.0
- setup-buildx-action: v3.10.0 → v3.11.1
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
57 lines
1.9 KiB
Docker
57 lines
1.9 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM python:3.12-alpine
|
|
|
|
ARG VERSION="git"
|
|
# Removed rust/cargo (not needed with uv), simplified package list
|
|
ARG PACKAGES="bash openssh-client openssl rsync tini"
|
|
|
|
LABEL name="algo" \
|
|
version="${VERSION}" \
|
|
description="Set up a personal IPsec VPN in the cloud" \
|
|
maintainer="Trail of Bits <https://github.com/trailofbits/algo>" \
|
|
org.opencontainers.image.source="https://github.com/trailofbits/algo" \
|
|
org.opencontainers.image.description="Algo VPN - Set up a personal IPsec VPN in the cloud" \
|
|
org.opencontainers.image.licenses="AGPL-3.0"
|
|
|
|
# Install system packages in a single layer
|
|
RUN apk --no-cache add ${PACKAGES} && \
|
|
adduser -D -H -u 19857 algo && \
|
|
mkdir -p /algo /algo/configs
|
|
|
|
WORKDIR /algo
|
|
|
|
# Copy uv binary from official image (using latest tag for automatic updates)
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
|
|
|
|
# Copy dependency files and install in single layer for better optimization
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN uv sync --locked --no-dev
|
|
|
|
# Copy application code
|
|
COPY . .
|
|
|
|
# Set executable permissions and prepare runtime
|
|
# Note: /algo must remain root-owned for --cap-drop=all compatibility
|
|
# (root without CAP_DAC_OVERRIDE cannot write to files owned by others)
|
|
RUN chmod 0755 /algo/algo-docker.sh && \
|
|
mkdir -p /data && \
|
|
chown algo:algo /data
|
|
|
|
# Multi-arch support metadata
|
|
ARG TARGETPLATFORM
|
|
ARG BUILDPLATFORM
|
|
RUN printf "Built on: %s\nTarget: %s\n" "${BUILDPLATFORM}" "${TARGETPLATFORM}" > /algo/build-info
|
|
|
|
# Note: Running as root for bind mount compatibility with algo-docker.sh
|
|
# The script handles /data volume permissions and needs root access
|
|
# This is a Docker limitation with bind-mounted volumes
|
|
USER root
|
|
|
|
# Health check to ensure container is functional
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
|
CMD /bin/uv --version || exit 1
|
|
|
|
VOLUME ["/data"]
|
|
CMD [ "/algo/algo-docker.sh" ]
|
|
ENTRYPOINT [ "/sbin/tini", "--" ]
|